School & Institutional Data Privacy Policy

1. About This Policy

This policy governs how CNA-Ready collects, uses, stores, and protects student data when CNA-Ready is used by a school, training program, nursing facility, or other institution ("Institution") to support its students or employees. It supplements our general Privacy Policy and is addressed to institutional administrators, instructors, and compliance officers. Individual students should also review our general Privacy Policy.

2. What Student Data We Collect on Behalf of Schools

When a school deploys CNA-Ready to its students, we collect and process the following categories of student information solely on behalf of and at the direction of the Institution:

• Student name and email address (used to create accounts via Clerk)
• Cohort enrollment (which class, program, or cohort the student is assigned to)
• Quiz attempt history, scores, and answer selections
• Module and skill completion progress
• Skill checklist evaluations (student self-assessments and evaluator sign-offs)
• Flashcard study activity
• Clinical scenario attempt history
• AI Tutor conversation logs (if used) — not stored long-term; used only to generate responses
• Login timestamps and session activity (for audit and compliance purposes)

We do not collect financial aid data, grades from other systems, Social Security numbers, biometric data, immigration status, or Protected Health Information (PHI). All clinical scenarios and charting exercises use entirely fictional patient data.

3. FERPA Compliance

When an Institution uses CNA-Ready to manage or track its students, CNA-Ready acts as a 'school official' as defined under the Family Educational Rights and Privacy Act (FERPA), 20 U.S.C. § 1232g, with a 'legitimate educational interest' in accessing student education records solely for the purpose of providing the platform's educational services.

• CNA-Ready will not disclose student education records to any third party except as permitted under FERPA or as directed by the Institution.
• We will not use student education records for advertising, marketing, or any purpose unrelated to delivering educational services.
• Schools retain ownership and control of student education records. CNA-Ready processes them only as directed.
• Students retain their FERPA rights, including the right to inspect and request correction of their education records. Contact your school's registrar to exercise these rights.
• CNA-Ready will notify the Institution within 72 hours of discovering any security breach that affects student education records.
• Upon termination of the institution relationship, we will return or destroy student education records as requested.

Schools are responsible for ensuring their own FERPA compliance, including providing appropriate notice to students about the use of CNA-Ready as an educational tool and obtaining any required consents.

4. California SOPIPA Compliance

CNA-Ready complies with the California Student Online Personal Information Protection Act (SOPIPA) and similar state student privacy laws. Specifically:

• We do not use student data to engage in targeted advertising.
• We do not sell or rent student personal information to third parties.
• We do not build personal profiles of students for purposes other than providing the educational service.
• We do not use student data to amass a profile about a student to be used outside of the educational purpose.

5. Sub-Processors

CNA-Ready uses the following third-party sub-processors to deliver institutional services. All sub-processors are bound by data processing agreements:

6. Data Security

CNA-Ready implements the following technical and organizational security measures to protect institutional student data:

• All data transmitted between users and CNA-Ready servers is encrypted using TLS (HTTPS).
• Data at rest is encrypted by our infrastructure provider (Neon/Replit).
• Access to student data is role-based: students see only their own records; instructors see only their cohort's records; platform administrators have access controls and audit logging.
• All administrative access to the database is logged via our audit trail system.
• Account access is managed through Clerk with support for multi-factor authentication.

7. Data Retention & Deletion

Student data collected on behalf of an Institution is retained for as long as the institutional relationship is active. Institutions may request deletion of all student records associated with their account at any time.

To request deletion of all student data associated with your institution:

1. Email us at support@cna-ready.com with subject line: 'Institutional Data Deletion Request'
2. Include your institution name and the email address on file for your institutional account.
3. We will confirm receipt within 2 business days and complete deletion within 30 days.
4. We will provide written confirmation when deletion is complete.

Some aggregated, non-identifiable analytics (e.g., total quiz attempts) may be retained after deletion to improve the platform, but no personally identifiable student information will be retained.

8. School Responsibilities

As a condition of using CNA-Ready in an institutional context, the Institution agrees to:

• Provide appropriate notice to students that CNA-Ready is being used as part of their training program.
• Obtain any required student consents under applicable law before sharing student information with CNA-Ready.
• Sign a FERPA-compliant Data Use Agreement (DUA) with CNA-Ready prior to deploying the platform to students.
• Ensure that student email addresses and personal information provided to CNA-Ready are accurate and up to date.
• Notify CNA-Ready promptly if your institution's FERPA officer or privacy administrator changes.
• Notify CNA-Ready if a student requests deletion or correction of their records held by CNA-Ready.

9. Student Rights

Students enrolled through institutional accounts retain the following rights:

• FERPA rights — access and correction of education records held by the Institution (contact your school's registrar).
• CCPA/state privacy rights — access, correction, and deletion of personal data held by CNA-Ready (contact us directly).
• The right to request a copy of all data CNA-Ready holds about you.
• The right to opt out of any communications not essential to the educational service.

10. Contact & DUA

For institutional privacy questions, data deletion requests, or to obtain and sign our FERPA Data Use Agreement, contact:

CNA-Ready (The Nurse Code, LLC) · support@cna-ready.com · +1 (888) 913-6640

We recommend that all institutions using CNA-Ready sign our FERPA Data Use Agreement before deploying the platform to students.