FERPA & COPPA Policy
The Force for Health Network ("FFH") serves educational institutions, learners of all ages, and families. This Policy explains how we protect student educational records under the Family Educational Rights and Privacy Act ("FERPA") and how we obtain appropriate consent for children under age 13 under the Children's Online Privacy Protection Act ("COPPA").
1. FERPA Compliance
1.1 School Official Designation
When FFH provides Services to a school or district, we act as a "school official" with a "legitimate educational interest" under FERPA. We use educational records only to perform the Services we have been engaged to provide, and we do not redisclose those records except as authorized by the educational agency or as required by law.
1.2 Direct Control
Educational agencies retain direct control over the use and maintenance of educational records. We provide tools for agencies to access, correct, and delete records, and we honor requests from eligible students and parents that are routed through the educational agency.
1.3 Data Minimization
We collect only the educational record information needed to deliver the Services. We do not use student data for advertising or build personal profiles for commercial purposes.
1.4 Contractual Safeguards
- FFH offers Data Processing Agreements (DPAs) to every educational institution.
- We comply with state student privacy laws (including SOPIPA, California AB 1584, NY Ed Law 2-d, and others).
- Subcontractors accessing student data are bound by flow-down contractual protections.
1.5 Technical Safeguards for Educational Records
- FERPA-protected boards and records are excluded from browser local storage when a user is authenticated.
- All access to educational records generates an audit log entry.
- Row-Level Security ensures that students, teachers, and administrators see only records they are authorized to see.
2. COPPA Compliance
2.1 Verifiable Parental Consent
For users under the age of 13 accessing FFH outside the school context, we require verifiable parental consent before collecting personal information. Consent is logged in the consent_records database under the "coppa_parental" consent type.
2.2 School Consent Pathway
When a user under 13 accesses FFH as part of a school-authorized program, we rely on the school's consent authority under FTC guidance, provided the school has authorized the use of FFH for educational purposes. This consent is logged under the "coppa_school" type.
2.3 Information Collected from Children
We limit information collected from children under 13 to what is reasonably necessary to participate in the activity. We do not condition participation on the disclosure of more personal information than is necessary.
2.4 Parental Rights
Parents may review their child's personal information, request deletion, and refuse further collection at any time by contacting privacy@forceforhealth.com.
2.5 No Behavioral Advertising
We do not engage in behavioral advertising targeting children, and we do not permit third-party tracking for advertising purposes on pages accessible to children.
3. How to Exercise Rights
Eligible students, parents, and educational agencies may exercise rights by contacting the school directly or by emailing privacy@forceforhealth.com. We respond to verified requests within 45 days.
4. Contact
Education Privacy Contact: privacy@forceforhealth.com
General Compliance: compliance@forceforhealth.com