Written from the conservative chair. What the free community tier actually requires, what changes the moment we private-label into a school, a foundation or a payer, and the ordered staircase from where we stand today to something Banner's privacy office can sign.
Offering free games and content to families, and monetising de-identified engagement through seat-based dashboards, is a defensible model — other consumer apps run it and HIPAA does not reach it. One part of the plan does not survive contact with the law, and it is the part we are most excited about.
FFH is not a HIPAA covered entity and holds no PHI today. Steps from a member's own watch, delivered to a consumer wellness app, have never been protected health information. Whoop, Oura, Strava and Fitbit all operate here. Nothing about the free community tier requires a BAA, a HIPAA-eligible server, or a compliance officer's signature.
If we become a school "operator", engagement data from that channel cannot feed a commercial analytics product — even de-identified. Arizona's statute says an operator "may not sell or rent a student's information," and the SOPIPA-family laws permit de-identified student data only to improve the provider's own educational product or demonstrate its effectiveness — a scope read to preclude marketing that analysis as a standalone product. That is precisely the Bloomberg-terminal model.
But "operator" is a defined term with a door on it, and we choose whether to walk through. See §2a — this is the most commercially consequential paragraph on the page. Either way the architectural fix in §4 is the same and should be built now.
Selling counties insight into "what people are inquiring about" reads directly onto Washington's My Health My Data definition of consumer health data, which expressly covers inferences derived from non-health information and data identifying a consumer seeking health care services — where "health care services" is defined as broadly as any service to "assess, measure, improve, or learn about a person's mental or physical health." Health-topic inquiry data is consumer health data by name.
MHMD carries a private right of action on any violation, routed through the Washington Consumer Protection Act — actual damages, attorneys' fees, and treble damages to $25,000. Traction is not the same as defensibility. Copy the market position, not the data practice.
Free games, media and content. Families and schools. No clinical partners, no physicians, no PHI. Here is what actually applies — in priority order, not alphabetical.
| Regime | Reaches us? | What it requires of us today |
|---|---|---|
| HIPAA | No | We are not a provider, plan or clearinghouse, and not anyone's business associate. Nothing required — and this stops being true the day a clinical partner engages. |
| COPPA amended rule | Yes — hard | The amended rule has been in full force since 22 April 2026. Under-13 users need verifiable parental consent; third-party disclosure now needs its own separate consent — a parent can allow collection and refuse sharing. Data may be kept only as long as reasonably necessary, with a written retention and deletion policy. School consent covers only school-authorised educational purposes. |
| State student privacy AZ ARS §15-1046 + SOPIPA family | Yes — hard | No selling or renting student information. No targeted advertising from school-obtained data. No building a student profile except for school purposes. De-identified use limited to improving or demonstrating our own product. Contractual flow-down to any service provider. |
| FERPA | Only if contracted | Bites when a school contracts us and we hold education records under the school-official exception: direct control, no secondary use, no re-disclosure. Avoidable by not touching the education record — which the FHIR brief already recommends. |
| WA My Health My Data + Nevada SB 370 | Yes | Broad definition catching inferences and health-seeking signals. Selling consumer health data requires a signed valid authorisation from each consumer — described by counsel commentators as a practical bar to most sales. Private right of action on any violation. The de-identification carve-out is the lane (§5). |
| FTC Act §5 + Health Breach Notification Rule | Yes | Say what we do, do what we say. HBNR already enforced against consumer health apps (GoodRx, Premom). Breach notice duties attach to consumer health records even with no HIPAA nexus. |
| State comprehensive privacy CO, CT, VA, TX, OR… | Yes, by volume | Sensitive-data opt-in, access and deletion rights, and — in several states — a flat ban on targeted advertising to minors that consent does not cure. |
"We are a consumer wellness platform, not a healthcare provider. We hold no medical records. The laws that govern us are children's privacy law, student data law, and state consumer health privacy law — and we are built to them." That sentence is true today and is a stronger opening than any HIPAA claim, because HIPAA does not apply and claiming it invites the question of why we think it does.
Neither law has an exemption for optional activities. But the question is a good one, because the club route does change the analysis — just not through the door people expect.
| Does "optional" exempt us? | What actually decides it | |
|---|---|---|
| FERPA | Irrelevant | FERPA turns on whether an education record exists and who maintains it — never on whether the activity was elective. Band, athletics and clubs all generate education records at the school. But FERPA binds the school, not us, unless we are acting as a school official or receiving records from them. Parent enrols directly, no roster passes, school holds nothing of ours → we are not touching an education record. |
| COPPA | No exemption | COPPA follows the operator and the child's age, full stop. It does not care where the child was standing when they signed up. Parental consent is the compliance path, not an exemption — and it must be verifiable by an approved method, with a separate consent for any third-party disclosure. |
| State student privacy | Possibly outside | This is where the club route genuinely helps — not because it is optional, but because a general-audience service is outside the "operator" definition entirely. See §2a. |
In the 2025 amendments the FTC declined to codify the ed-tech school consent exception. It survives only in FAQ guidance, and the Chairman has expressed scepticism about it. Leaning on a school to consent on parents' behalf is therefore the weaker footing, not the stronger one — it rests on guidance the Commission specifically chose not to put in the rule. Direct verifiable parental consent is both the safer path and the one that keeps us general-audience. The two risks point the same way, which is unusual and worth taking advantage of.
The instinct is that de-identification solves everything — strip the identifiers and the data is free to monetise. Under HIPAA that instinct is roughly right. Under student privacy law it is wrong, and this is the single most expensive misunderstanding available to us.
SOPIPA-family statutes do not restrict student data because it is identifiable. They restrict what an operator may do with data obtained through a school relationship, full stop. The permitted de-identified uses are enumerated and narrow: improve your educational product, demonstrate its effectiveness. Selling the analysis as its own product is outside that list.
So the restriction travels with the record's origin, not with its identifiability. A de-identified engagement row that originated in a school district carries the school restriction forever. Aggregating it with community data does not cleanse it; it contaminates the aggregate.
Our most fundable channel — districts, activation through schools, community partners who reach families through schools — is the channel whose data we may not sell. Meanwhile the channel we can monetise (direct family sign-up) is the harder one to fill. The business model and the growth model point in opposite directions, and nobody notices until a district's counsel asks where their students' engagement data went.
Added 16 September as a correction. The first draft of this page stated the school restriction as absolute. It is conditional, and the condition is one we control.
ARS §15-1046 reaches the operator of a service "with actual knowledge that the site, service or application is used primarily for school purposes AND was designed and marketed for school purposes." Both limbs. And the statute then says expressly that it does not apply to:
"general audience internet websites, general audience online services, general audience online applications or general audience mobile applications, even if login credentials created for an operator's site, service or application may be used to access those general audience sites."
A general-audience family wellness platform that a school club happens to use is not an operator. The restriction is not triggered by children using the product, or by a teacher recommending it, or by the club meeting in a school gym. It is triggered by what the product is built and sold as.
Staying outside the operator definition keeps the commercial product open — but it means giving up the easiest distribution we have: the signed district deal, the bulk roster, the purchase order. Those are the things that make a school channel efficient, and they are exactly the things that trigger the restriction. This is a genuine strategic choice, not a compliance technicality, and it should be made deliberately by the two of you rather than discovered later by a salesperson closing a district.
A middle path exists: run both, and keep them structurally
separate. District-contracted deployments are their own tenant, marked channel_origin =
'school', excluded from the commercial product and governed as an operator. Community and
family members stay general-audience. §4's provenance tag is what makes that separation real
rather than aspirational — which is why it is step 1 either way.
Thirteen states read against primary statutory text. The other thirty-seven were not checked, and that limit is stated rather than papered over. No public source enumerates which states have SOPIPA-style laws; the best citable figure is "more than 20", unattributed to a list.
The two-limb "used primarily for school purposes and designed and marketed for school purposes" test, with an express general-audience carve-out, is copied nearly verbatim in California, Illinois, Texas, New Hampshire, Colorado, Virginia and Washington. In most of the country the escape in §2a holds.
Three states protect us even more strongly than Arizona. Colorado, Virginia and Washington exclude services "designed and marketed for use by individuals or entities generally, even if it is also marketed to a … school." That language directly blesses marketing a general-audience product through schools — which is what you are proposing to do.
| State | Trigger | General-audience carve-out | What it means for us |
|---|---|---|---|
| Colorado Virginia Washington |
Designed & marketed primarily for K-12 | Strongest | Express protection even if also marketed to schools. The safest states for this model. Note VA and WA have no de-identified exception to the sale ban — so if we ever do become an operator there, the restriction is absolute. |
| California Arizona Illinois Texas New Hampshire |
Two-limb, near-verbatim SOPIPA | Express | The escape holds on the statutory text. But none of these states defines "general audience" — the whole escape rests on an undefined term, which makes it an argument rather than a shield. |
| Utah | Contract with an education entity. No design/marketing limb. | Defined — narrowly | The only state that defines the term: an app "not specifically intended for use by … kindergarten or grades 1 to 12." Defined by intended use, not marketing posture — a harder test to meet. |
| Maryland | FERPA school-official exception + agreement, or "issued at the direction of a public school, a teacher, or any other employee" | Express but undefined | The "at the direction of … a teacher" prong maps directly onto a club advisor telling students to install the app. Carve-out exists; "general audience" undefined. |
| Connecticut | "Used for school purposes" — drops "primarily" | None found | Lower bar on limb one, and no express general-audience exclusion in the definitions section. Not fully verified — the rest of the chapter was not read. Still requires a board-of-education contract. |
| New York Educ. Law §2-d |
Receives student data pursuant to a contract or other written agreement. No design limb at all. | None — anywhere | The single biggest risk state. How we market is legally irrelevant. Bans PII being "sold or used for marketing purposes" — broader than a sale ban. Adds a Parents' Bill of Rights and a mandatory data security plan in every contract. |
| Kentucky | "Cloud computing service" giving an educational institution account-based access | None found | Different architecture entirely — the AZ analysis does not transfer. Bans processing student data "for any commercial purpose," not merely sale. The broadest substantive prohibition of the set. |
New York sets it. If student data flows to us from a school under any written agreement — arguably including a click-through the school accepts — we are a third-party contractor there no matter how the product is positioned. Kentucky is second, because it bans all commercial processing rather than sale. Any national model has to work in those two, or be switched off in those two.
The free / Ambassador / Academy structure is a better answer than anything in §2a, because the tiers do not sit on a single legal theory with more or less risk. They sit on three different legal theories. That is what makes it robust.
| Tier | Why it is lawful | The one thing that could break it | |
|---|---|---|---|
| 1 | Free · school URL · no accounts Aggregate LEARN / LIVE / SHARE coins to a school leaderboard. No individual student record exists. |
There is no covered information. FERPA needs an education record. COPPA needs personal information. State student privacy law needs "covered information" about an identified student. None of them have anything to attach to. This tier does not rely on the general-audience escape at all — it does not need it, and it works in New York. | Persistent identifiers COPPA counts a cookie or device ID as personal information when it is used to track a child. Aggregate counting must be done without a per-device identifier, or inside the narrow "support for internal operations" exception. Drop a standard analytics tag on that subdomain and the tier silently stops being anonymous. |
| 2 | Ambassador · consumer edition Student keeps their own coins and badges, eligible for prizes. |
Direct consumer relationship under the general-audience escape (§2a) plus verifiable parental consent for under-13s. The school is a place the child heard about it, not a party to it. | Roster drift The moment a teacher bulk-enrols, or a class list passes, or the school signs anything, this collapses into Tier 3 — and in New York it collapses regardless of marketing. |
| 3 | Academy · LIVE It Trackers on Granular metric toggles — steps only, or nothing. |
Operator status assumed and governed: district agreement, data protection addendum, excluded from the commercial product, deletion on termination. | Contamination If Tier 3 data is ever aggregated into the county product, the restriction travels with it (§2). The provenance tag in §4 is what prevents this. |
Tier 1 is not a risk-mitigated version of Tier 3. It is a different product with no regulated data in it. That means it can be offered to every school in the country — including New York and Kentucky — with no contract, no DPA, no consent machinery and no age gate, because there is nothing to consent to. It is the widest possible distribution at the lowest possible legal cost, and it feeds the activation map at exactly the granularity a county actually wants: which communities are playing, not which children.
Extracurricular competition is a category schools already understand and already fund through boosters and parents rather than through instructional budgets. Parent-paid or sponsor-paid STEAM TEAMS put the paying relationship where we want it — with the family, not the district — which is condition 3 of the general-audience test in §2a. The positioning and the compliance structure point the same way, which is rare.
Supportable, with one line held firmly: the school is a distribution channel, never the customer. Colorado, Virginia and Washington bless this expressly. The risk is not the flyer in the backpack — it is the moment marketing produces a district-facing price list, a "for Schools" landing page, or a K-12 SKU. The test is not where the message travels. It is who signs and who pays.
Keep one asset discipline: no page, deck or rate card that reads as a school product. Materials speak to families and clubs, even when a principal is the one handing them out.
Not an edtech vendor. A mixed-media company delivering information and incentives to families, sustained by payers, counties and states buying access for their populations. This is a better position than the school model, and it moves the compliance burden rather than removing it.
If the school is neither the customer nor the contracting party, and revenue comes from a funder buying access rather than from data, then:
During COVID, New York made Headspace and Calm free to "New Yorkers across the state", with no enrolment procedure and no eligibility test. That is the shape to copy, and the reason it worked is structural rather than commercial:
The funder bought access for a population. It never received a list of who used it, and the vendor never received a list of who was entitled to it.
No roster passed in either direction. That single fact is what kept a consumer app a consumer app. The Discovery Education grant model in Arizona has the same shape: a funder pays so that a whole category of people has access.
The moment a health plan hands us a member list so we can verify who is covered, we are holding PHI. Enrolment in a health plan is health information about an identified person — it does not need a diagnosis attached. That single file converts us from a consumer app into a business associate, triggers the BAA, the HIPAA-eligible infrastructure and the security questionnaire, and it does so before a single health metric has been collected.
Population license, not member license. Everyone in the county, the ZIP range, the plan's service area — verified by geography or by a code the funder distributes, never by a roster we hold. If a payer insists on member-level eligibility, that is a Step 4 conversation (§6), priced accordingly, and not something to agree to in a first meeting.
This is the part of the reframe that has not been priced. None of it is a blocker; all of it is a gate that appears at procurement rather than at launch.
| Requirement | Our state | What it means |
|---|---|---|
| Accessibility Section 508 / WCAG 2.1 AA |
Unassessed | Usually a hard contractual requirement in state and county procurement, and the one most often failed by consumer-grade products. Games, animation, colour-coded coins and timed challenges are exactly where WCAG conformance breaks. Audit this before an RFP, not during one. |
| Security attestation StateRAMP, SOC 2, state questionnaires |
None | Increasingly required by states for hosted services. Overlaps with Step 4 of the staircase, so the work is not duplicated — but the trigger arrives earlier in a govtech pipeline than in a clinical one. |
| Public records law | Unconsidered | Data and reports held under a government contract may be disclosable under state FOIA. This cuts both ways: it is a reason to hold aggregates rather than records, and a reason the suppression threshold (§5) must be real — a public records request could put a dashboard export into a newspaper. |
| Procurement mechanics | Partial | RFP response capability, insurance certificates, W-9 and registration, sole-source justification where there is no competitive bid. Unglamorous and routinely the thing that loses a funded deal. |
| Medicare Advantage marketing rules | Not yet relevant | If this ever runs as an MA supplemental benefit, CMS marketing and communications rules apply to the materials themselves — review, disclaimers, restrictions on inducements. Prize and giveaway mechanics are precisely the area CMS scrutinises. Do not design a rewards programme for an MA population without this reviewed first. |
A county or state buying population access out of general or grant funds is procurement — the analysis above. A health plan paying for a member benefit is a different regime: plan oversight of vendors, state Medicaid contracting terms, likely a BAA, and for Medicare Advantage a regulated benefit design with reviewable marketing. Sequence counties and states first. They are the faster sale and they do not pull us inside HIPAA — and a track record with them is the credential that makes the payer conversation winnable later.
A general-audience family media and incentives platform, free to the public, funded by the institutions that benefit when a community gets healthier. Schools and clubs are distribution. Counties and states are customers. Payers are a later tier that requires real infrastructure. The de-identified activation map is the reporting a funder receives for their money, not a data product sold onward — which is a materially easier thing to defend, and a materially easier thing to say out loud.
"Private label it for them" sounds like one product with a different logo. It is three distinct legal postures, and the differences are not cosmetic.
| School / district | Non-profit / community / foundation | Healthcare payer or system | |
|---|---|---|---|
| Who consents | The school, under the COPPA school exception — but only for school-authorised educational purposes. Parent consent still needed beyond that. | The parent or adult member, directly. Cleanest consent story we have. | The member, plus the covered entity's own authorisation and notice-of-privacy-practices machinery. |
| Governing law | COPPA + state student privacy + FERPA if we touch the education record. | COPPA for under-13s + state consumer health and comprehensive privacy law. | HIPAA. Plus 42 CFR Part 2 if any substance-use data. Plus state Medicaid rules for AHCCCS. |
| Can its data feed the county product? | No Not even de-identified. This is §2. | Yes With proper notice, de-identification and a published no-reidentification commitment. | No Only under the covered entity's own de-identification and their data use agreement — their call, not ours. |
| Environment | Shared platform is fine. Logical separation and a signed district data agreement. | Shared platform is fine. | Separate tenant, separate database, separate consent. Dr. Rob's "Wall" — built as a new service, never as a migration of this one. |
| What they will ask for | Signed district data privacy agreement, often on a state or consortium template. Deletion on contract end. Sub-processor list. | Impact reporting, grant metrics, an annual data summary. | BAA, security questionnaire, SOC 2 or equivalent, pen test, incident response plan, breach notification terms, right to audit. |
| Our readiness | Partial No template DPA drafted. | Partial No published de-identification commitment yet. | Not ready No BAA anywhere in the stack, no SOC 2, no pen test. |
A school is a channel that restricts what we may do with the data. A payer is a counterparty that makes us a business associate and pulls us inside HIPAA. A community non-profit is neither — it is a funder and a distribution partner, and it is the only one of the three whose data can lawfully feed the commercial product. Treating all three as "partners" in one pipeline is how this goes wrong.
The FHIR brief's two zones — de-identified analytics and a HIPAA-grade personal health zone — are correct and well drawn. They are also not sufficient, because they divide by sensitivity and the law also divides by origin.
Every engagement record needs a third axis recorded at write time: which channel it came in through, and whether the member was a minor at the time of collection. Not derived later. Not inferred from a group membership. Written with the row.
channel_origin 'school' | 'community' | 'direct' | 'payer' sponsor_id the district, foundation or plan that activated this member minor_at_collect boolean, frozen at write time — never recomputed from age consent_basis 'school_official' | 'parent_vpc' | 'adult_self' | 'covered_entity' rules_version which consent text and rate card were in force
Why frozen: a member who was twelve when the row was written does not become fair game on their thirteenth birthday. Recomputing minor status from current age silently relicenses historical data, which is the kind of thing that is discovered in an audit rather than in a code review.
The commercial analytics product is then a query with a WHERE clause —
channel_origin IN ('community','direct') AND minor_at_collect = false — rather than a
policy promise that someone has to remember. Make the boundary a join condition and it cannot
be forgotten. That is also the sentence that satisfies a district's counsel, because it is
inspectable.
Retrofitting provenance onto rows already written is guesswork, and guesswork is not a defence. Every day we run without this tag produces records we will later be unable to classify — which in practice means excluding them all from the commercial product. This is the cheapest thing on this page today and the most expensive thing on it in six months.
The regionalised PHIT positioning is good and the seat model is better than you may realise. Here is what makes it defensible rather than merely popular.
Selling access to a dashboard is categorically safer than selling a data file. A file leaves our control, can be joined against other datasets, and is a "sale" under every consumer health statute. A seat means the data never leaves, suppression is enforced by the product rather than promised in a contract, every view is logged, and access dies with the subscription. Bloomberg's model is, accidentally, the privacy-preserving one. Say that out loud to a county — it is a differentiator against the competitor.
| # | Condition | Why, and what "done" looks like |
|---|---|---|
| 1 | Real de-identification, to the statutory test | MHMD's carve-out requires data that cannot reasonably be linked to or used to infer information about a consumer. Inference is the hard half — a single-school, single-week, single-metric tile can identify a child. Safe Harbor stripping is the floor, not the finish. |
| 2 | A published no-reidentification commitment | The statute asks for reasonable measures and a public commitment and the same commitment in every relevant contract. All three, or the carve-out does not apply. This is a page on our own site plus a clause in every seat agreement — a week of work, and it is currently not done. |
| 3 | Cell suppression, enforced in the product | The FHIR brief commits to no threshold at all. Adopt n < 11 — the CMS convention — and enforce it in the query layer so a seat holder cannot render a small cell, rather than in a policy a user could ignore. Also suppress complements, or a reader subtracts their way back. |
| 4 | Channel exclusion at the source | §4's WHERE clause. School-origin and minor-at-collection rows never enter the commercial view. Demonstrable on request. |
"What are people asking about" is the competitor's hook and it is the most exposed thing in this market. Health-topic inquiry is named consumer health data under MHMD, it is the kind of signal that is trivially re-identifying in a small county, and it is the one a journalist writes about. Sell activation and engagement — what people did — not curiosity. Behaviour is defensible in a way that interest never is, and it is also the better product for a county trying to measure whether a programme worked.
Ordered so that each step is worth doing on its own, and none of them is wasted if the next one is delayed.
Coins, engagement, no medical records. Defensible now. Two live gaps: the coin ledger permits a member to edit their own totals, and counsel has never reviewed the consumer-health-statute position.
Channel tag on every row (§4). Written retention and deletion policy — COPPA now requires one. Publish the no-reidentification commitment and add the clause to the seat agreement template. Close the coin-integrity hole. None of this needs Rahul, Banner, or a budget.
Separate consent for third-party disclosure, per the amended COPPA rule. An age gate that actually gates. A district DPA template counsel is happy with. A sub-processor list we can hand over without assembling it first.
n < 11 with complement suppression, in code. The county dashboard built only on community-origin adult rows. An expert-determination memo if we want to claim more than Safe Harbor — that is a named statistician and a written opinion, not an assertion.
Signed BAAs across the stack — Supabase (~$599/mo on Team), Vercel Pro, Terra. SOC 2 Type I at minimum, Type II if Banner asks and they usually do. Third-party penetration test. Written incident response plan with named owners. Access review and audit logging.
Dr. Rob's recommendation, and the right one: a distinct opt-in module on HIPAA-eligible infrastructure, firewalled from both the education record and the de-identified product. Built as a new service, never as a migration. Adults first. Per-member consent with audit.
Steps 1–3 are worth doing whether or not Banner ever signs — they make the consumer business defensible and the county product sellable. Step 4 is the one that costs real money and it should be triggered by a signed letter of intent, not by optimism. Do not buy HIPAA infrastructure to look credible in a meeting. Buy it when someone has asked for something that needs it.
| Say this | Not this |
|---|---|
| "We are a consumer wellness platform. We hold no medical records, and we are built so that we cannot." | "We're HIPAA compliant." We are not, we do not need to be at this tier, and the claim invites a question we would fail. |
| "There is no column in our engagement ledger that could hold a heart rate or a blood pressure." Schema-level, inspectable, and true today. | "The data is encrypted and secure." True of everyone, proves nothing, and reads as deflection to a privacy office. |
| "School-origin data never enters our commercial product — it is excluded by a query condition, not a promise." | "It's all de-identified so it's fine." Not true for student data, and a district's counsel will know that. |
| "Counties buy seats to a dashboard. The underlying data never leaves us." | "We can provide the dataset." That converts a seat into a sale, and a sale needs a signed authorisation per consumer. |
| "The clinical module is a separate service with separate consent. It is not built yet, and we will not migrate this one into it." | "We can turn that on for you." Step 5 is a compliance-grade release, not a toggle. |
| "Counsel review is booked for [date]." | Silence on the legal question. They will assume the worst, and on this one they would be right. |
Not "we are compliant." It is: "we know exactly which regime we are under today, we know what changes when we work with you, and we have the sequence written down." A privacy office has never once been reassured by confidence. They are reassured by someone who has already found the gaps and can name them — which, after this page, you can.