Privacy & DPA
School official relationship
Under FERPA, districts may disclose education records to a contractor performing institutional services — often called a “school official” relationship — when use is limited and controlled by agreement.
What we process
Meeting audio and discussion content, attendee roles, student identifiers needed to attach documentation to the correct IEP file, and staff account data for access control.
What we will not do
- Sell student or family data
- Use customer meeting content to train models
- Share documentation outside the contracting district except as directed
- Keep raw recordings longer than needed to produce reviewed documentation
Data Processing Agreement
Enterprise and district deployments include a DPA that states: we act only on documented instructions; we implement access controls and audit logging; subprocessors (meeting capture, LLM, hosting, database) are listed and bound by equivalent protections; and data is returned or deleted on request at contract end.
Parent and guardian rights
Consent is obtained before documenting. Families may request access to education records through the district under FERPA. We support district staff in fulfilling inspection and amendment requests related to documentation we store on their behalf.
Human review
Draft documentation is not final until district staff review and approve it. We do not auto-send notes to families.
Contact
For DPA review or security questionnaires, contact your IEP Note Taker account representative or email privacy@iepnotetaker.com.