Client Data Privacy & FERPA

Student education records in Better Answers belong to the school or district. We hold them as a school official with a legitimate educational interest under 34 CFR § 99.31(a)(1)(i)(B). That means we:

• Perform a function the school would otherwise perform with its own employees.
• Are under the school's direct control regarding the use and maintenance of records.
• Use records only for the authorized purpose and never redisclose them improperly.
• Do not sell client data or use it for advertising.

• Better Answers provides: encrypted storage, role-based access controls, audit logging, mandatory staff MFA, export tooling, and deletion on request.
• The school is responsible for: deciding which students and staff are in the system, who gets access, what data is entered, obtaining any required parental consent or annual notification, and honoring records requests.
• Parents and guardians: see only reports an evaluator or administrator has shared with them, for students they are linked to.

Parents and eligible students (18 or older) may inspect and review their education records. Because the school is the record owner, requests go to the school. Schools can fulfill a request directly in the platform:

• Open the client's record and use the report and CSV/PDF export actions.
• Share the report with the parent account, which is logged in the audit trail.
• FERPA requires the school to respond within 45 days of the request.

If a request comes to us directly, we forward it to the school and help the school produce the records.

A parent or eligible student who believes a record is inaccurate or misleading may ask the school to amend it. School staff can correct student details, evaluator notes, and report narratives in the platform; every edit is written to the audit log with the actor, timestamp, and record affected. If the school declines to amend, FERPA entitles the requester to a hearing and to place a statement in the record — that process is run by the school.

Every view, export, and share of a student record is recorded in the access log with the user, action, and timestamp. Administrators can search and export this log to satisfy FERPA's record-of-disclosure requirement (34 CFR § 99.32) and to review who has seen a record.

We do not designate or publish any directory information. Nothing in the platform is publicly visible; all student data sits behind authenticated, role-scoped access.

The school owns its data and may export or delete it at any time. FERPA sets no fixed retention period, so we follow the school's schedule: records are retained while the account is active and deleted on request within 30 days. After termination, records are held 90 days for export, then deleted or de-identified unless the school directs otherwise.

• TLS in transit; encryption at rest.
• Row-level security policies enforced in the database, not just the interface.
• Mandatory multi-factor authentication for all staff roles.
• Idle session timeout and revocable trusted devices.
• Expiring launch tokens for iPad kiosk sessions, with live proctor oversight.
• Immutable audit logging of access, sharing, and administrative changes.

These are the controls we operate. This page is not a certification, audit report, or legal advice.

Report a suspected security issue or possible unauthorized disclosure to info@betteranswersinc.com. We investigate promptly and notify affected schools without unreasonable delay so they can meet their own notification duties.

Depending on your state, additional requirements may apply (for example California AB 1584/SOPIPA, New York Ed Law 2-d, Illinois SOPPA, or Texas HB 1063). We sign district data privacy agreements and state addenda on request — email us to start one.