Data Privacy Agreement

1. Purpose & scope

The Service is a drafting and case-management tool for speech-language pathologists (SLPs). The District's SLPs enter case information — such as assessment scores, language samples, session notes, and draft evaluation reports — into the Service to organize their caseload and produce clinical reports. This DPA applies only to student information entered by the District's authorized staff for that purpose.

2. FERPA & school official status

Under the Family Educational Rights and Privacy Act (FERPA), SLP Draft is a "school official" with a legitimate educational interest in the student records it processes on the District's behalf. We do not use student information for any commercial purpose, advertising, or unrelated product development. All processing is done solely to provide the Service to the District's SLPs.

We do not re-disclose student records to third parties except as set out in this DPA and our Privacy Notice.

3. Categories of student data

The Service is designed for de-identified workflow use. Users are encouraged to enter student initials or case codes rather than full names. Depending on how the District's SLPs use the Service, the following data categories may be entered:

• Student initials, case codes, or pseudonyms
• Age or grade level
• Standardized test scores (e.g., CELF, GFTA, PLI)
• Language sample transcriptions and analyses
• Session notes, observation data, and parent intake responses
• Draft evaluation and progress reports
• Uploaded documents (e.g., prior IEPs, assessment protocols)

Card or payment data is handled directly by Stripe, our PCI-compliant payment processor, and never enters our systems.

4. Use restrictions

SLP Draft agrees to process student data only:

• For the purpose of operating the Service for the District's SLPs;
• As instructed by the District (i.e., when an authorized user clicks Generate, Draft, Save, Export, or Delete);
• To comply with applicable law or a valid court order, after notifying the District where legally permitted.

We do not:

• Sell student data;
• Use it to build advertising or marketing profiles;
• Use it to train or improve third-party AI models (see Section 7);
• Re-disclose it beyond the subprocessors listed in Section 5 without prior written notice.

5. Subprocessors

We rely on a small set of vetted subprocessors to operate the Service. Each has a contractual obligation to keep student data confidential and to process it only as directed by us:

• Supabase — encrypted database, authentication, and file storage (US region).
• Cloudflare — application hosting, edge runtime, and CDN.
• Google (Gemini) and OpenAI (GPT) — AI inference via the Lovable AI Gateway. Student data is sent only insofar as needed to generate a draft at the user's explicit request. Inputs are not used to train models and are retained only briefly for abuse monitoring (typically ≤30 days). No persistent storage of student content on AI-provider systems.
• Stripe — payment processing and billing. Does not process student education records.
• Transactional email provider — account, billing, and security notifications. Does not process student education records.

We will notify the District of any material change to this list at least 30 days in advance.

6. Security measures

We apply the following technical and organizational measures:

• TLS 1.2+ for all data in transit.
• AES-256 encryption at rest for database and file storage.
• Row-level security — each record is tagged with its owner's account ID; database policies enforce that users can access only their own data.
• Google OAuth — no passwords stored by us; sessions use short-lived tokens with refresh rotation.
• Least-privilege credentials — production secrets are stored in a secrets manager, not in source code.
• Audit logging — administrative actions on production systems are logged.
• Backups — encrypted daily, retained for 30 days, same-region storage.

7. AI processing of student data

When an authorized SLP clicks Generate or Draft, only the text needed for that section is sent to an AI model (Google Gemini or OpenAI GPT via the Lovable AI Gateway). The following safeguards apply:

• Full case files, other students' data, and irrelevant documents are not transmitted.
• Under our provider agreements, prompts and outputs are not used to train models.
• Inputs may be retained briefly for abuse monitoring (typically ≤30 days) and then deleted.
• Test scores are never AI-generated — they come only from what the SLP enters.
• A score-fabrication check blocks invented numbers in drafts.

8. Data retention & deletion

Student data is retained while the District's SLP has an active account. When a user deletes a case or their entire account, the data is removed from active systems immediately. Backups containing that data are overwritten on the normal rotation cycle (30 days) and are not used for any other purpose in the meantime.

On termination of this DPA, we will, at the District's written request and within 30 days, permanently delete or return all student data in our possession or control.

9. Incident notification

If we confirm a security incident that materially affects the confidentiality, integrity, or availability of student data, we will notify the District by email without undue delay, and in any event within 72 hours of confirmation. The notice will describe what happened, what data was affected, what steps we've taken to contain it, and what (if anything) the District should do.

10. Parent & student rights

FERPA rights (access, amendment, and complaint) remain with the parent or eligible student, exercised through the District as the educational record holder. SLP Draft does not maintain education records for FERPA purposes; it processes them on the District's behalf. Requests from parents should be directed to the District, which can then contact us for technical assistance (e.g., exporting a specific case).

11. Term & termination

This DPA is effective when the District's authorized SLPs begin using the Service and continues until the last District user account is deleted or the District notifies us in writing that it no longer wishes to be bound. Either party may terminate this DPA with 30 days' written notice. On termination, we will comply with Section 8 (Data retention & deletion).

12. Changes

If we make material changes to this DPA, we will notify the District by email at least 30 days before the changes take effect. Continued use of the Service after the effective date constitutes acceptance of the updated DPA.

13. Governing law

This DPA is governed by the laws of the State of California, United States.

14. Contact & countersignature

To request a countersigned copy, or to ask questions about this DPA, contact:

SLP Draft
Email: hello@slpdraft.com

For District use — signature block

District/School Name: _________________________________
Authorized Signatory: _________________________________
Title: _________________________________
Date: _________________________________

Please email a scanned copy or photo of the signed page to hello@slpdraft.com. We will return a countersigned copy within 5 business days.