Last updated: September 3, 2026
SLP Draft is built for solo speech-language pathologists handling sensitive student information. This page describes the technical and organizational measures we use to protect that data, the subprocessors involved, and our posture toward FERPA and district data agreements. For the legal contract, see our Privacy Notice and Terms of Service.
Every record in our database — cases, notes, test scores, drafts, uploads, templates — is tagged with the owning user's account ID. Row-level security policies enforce that you can only read or write your own data, at the storage layer. Even our own server code uses your authenticated session when reading your data; the only paths that bypass row-level security are narrowly scoped server jobs (e.g., processing a verified payment webhook) that never return data to another user.
When you click Generate or Draft, only the case text needed for that section is sent to a large-language model (Google Gemini or OpenAI GPT, via the Lovable AI Gateway). Your full case file, other students' data, and any uploaded source documents not relevant to that section are not transmitted.
Per our provider agreements, prompts and outputs are not used to train models. Inputs may be retained briefly by the provider for abuse monitoring (typically ≤30 days) and then deleted.
Test scores are never AI-generated. Standard scores, percentiles, and confidence intervals come only from what you enter. A score-fabrication check blocks the AI from inventing numbers in narrative drafts, and a contamination check prevents content from a prior case from leaking into a new draft.
We rely on a small set of vetted vendors to operate the Service:
We notify customers of material changes to this list. A current list is available on request at hello@slpdraft.com.
Primary data storage and backups are hosted in the United States. AI inference is performed by US-based providers. If you access the Service from outside the US, your data will be transferred to and processed in the US.
If we confirm a security incident affecting your data, we will notify you by email without undue delay, and in any event within 72 hours of confirming the incident. The notification will describe what happened, what data was affected, what we've done to contain it, and what (if anything) you should do.
FERPA (the Family Educational Rights and Privacy Act) applies to educational agencies — schools and districts — not directly to private software vendors. When a district contracts with a vendor to handle student records, the vendor typically becomes a school official under FERPA's exception, governed by a Data Privacy Agreement (DPA) between the district and the vendor.
SLP Draft is designed for use by individual clinicians, not contracted by districts. You — the clinician — are responsible for following your district's policies about which tools may store student-identifying information.
To make compliant use practical, the app is built around student initials and de-identified data by default. The drafting workflow does not require full names, addresses, or dates of birth beyond what you choose to enter. If your district requires a signed DPA before you may use the Service with identifiable student records, you can find our Data Privacy Agreement template here — we will countersign upon request.
SLP Draft is not a HIPAA-covered service and we do not currently offer a Business Associate Agreement (BAA). The Service is intended for school-based speech-language pathologists documenting educational evaluations, which fall under FERPA, not HIPAA, when performed as part of a student's IEP or 504 process.
Do not enter Protected Health Information (PHI) into SLP Draft if you provide services in a setting governed by HIPAA (private practice, clinic, hospital, telehealth under HIPAA, etc.) without first de-identifying the data. Use initials and minimum-necessary details — never full names, dates of birth, Social Security numbers, insurance identifiers, or medical record numbers from a HIPAA-covered source.
If your work requires a signed BAA, contact us before using the Service so we can confirm whether a HIPAA-eligible plan is available for your situation.
The Service runs on managed infrastructure (Cloudflare, Supabase) with their standard availability guarantees. Automated daily database backups are retained for 30 days. In the event the Service is discontinued, we will provide at least 30 days' notice and a final export window so you can download your data.
If you believe you've found a security issue, please email hello@slpdraft.com with details and steps to reproduce. We will acknowledge within two business days. Please do not publicly disclose the issue until we've had a reasonable opportunity to fix it.
Security or compliance questions, or a DPA request? Email hello@slpdraft.com. See also our Privacy Notice, Terms of Service, and Refund Policy.