Privacy, Security, and Procurement Information

Purpose

To establish consistent and secure standards for iTherapy's computer networks and information systems, applicable to all employees, independent contractors, and third-party vendors, protecting both company and client data in compliance with federal and state education privacy laws including FERPA, COPPA, and state-specific student data privacy statutes.

Policy

iTherapy maintains a comprehensive information security policy that outlines protocols to safeguard data, including requirements for network access, device security, and handling of sensitive information including Student Data as defined under Education Law § 2-d and equivalent state statutes.

Infrastructure Standards

• All production systems operate on AWS infrastructure with FedRAMP authorization
• HIPAA Business Associate Agreement (BAA) in place with AWS for Bedrock services
• Multi-AZ deployment for high availability
• Regular security patching within 30 days of critical vulnerability disclosure
• The workspace uses a 15-minute inactivity window. Recording, processing, and activity in another workspace tab can keep a session active.
• Audit logging of all access to systems containing Student Data or PHI

Purpose

To ensure that all employees and contractors understand their specific responsibilities in maintaining information security within their roles, with particular emphasis on the protection of Student Data and compliance with FERPA, state education privacy laws, and HIPAA where applicable.

Training Topics

Training Requirements

• New employees must complete security training within 7 days of starting employment
• Training required before being granted access to any systems containing Student Data or PHI
• Additional training provided within 30 days of identifying new threats
• All subcontractors must complete equivalent training before access is granted
• Training records maintained for a minimum of 7 years

Purpose

To establish iTherapy's commitment to protecting client, student, and employee personal information and to ensure compliance with legal standards including FERPA (34 CFR Part 99), COPPA (15 U.S.C. § 6501-6506), HIPAA (45 CFR Parts 160 and 164), and state-specific education privacy laws.

EASI app and web workspace

iTherapy, LLC operates the EASI workspace. Account names, email addresses, account identifiers and sign-in information support authentication and access. Case content can include sensitive disability and health information. EASI uses the information you select to provide recordings and transcription, analysis, editable report drafts, caseload tools and saved MySLP conversations. Support requests, security audit records and service diagnostics help us support accounts and operate the service.

Cloud processing and AI

Amazon Web Services hosts EASI's workspace services. Amazon Transcribe processes speech recordings, and Amazon Bedrock runs AI models, including Anthropic Claude, for supported analysis and drafting. Depending on the feature, selected case details, recordings, transcripts, documents, images and instructions are sent to these services to fulfill your request. The iPhone and iPad app asks for permission before opening the cloud workspace. You may decline and use the bundled fictional offline sample instead. Review AI-assisted output before using or sharing it.

Purchases and access

Northern Speech Services handles purchases on its website under its own privacy and purchase terms. EASI receives purchaser identity and order, plan and allowance information needed to activate and manage workspace access. Use the account connected to your purchase when signing in on another device.

Saved information and deletion requests

Saved case records, reports and MySLP conversations remain available across sessions and devices. Closing the app or signing out does not delete them. Saved MySLP conversations are not automatically erased after 24 hours. Removing a conversation from the workspace is not a promise that all underlying records, backups or audit records have been erased.

To initiate account deletion in the iPhone or iPad app, open More, choose Request Account Deletion, sign in if needed, and submit the confirmation. The account team reviews the request and any applicable record-retention requirements. The request receipt provides a reference and completion target; the request itself is not confirmation of deletion. Contact admin@itherapyllc.com about access, correction, deletion, consent or the retention terms applicable to your account. Account deletion and changes to an NSS purchase are separate processes.

Student Data Specific Protections

• Student Data is never sold, rented, leased, or traded to third parties
• Student Data is never used for targeted advertising
• Student Data is never used to develop commercial products beyond our contracted educational services
• Retention depends on the saved record, the applicable service agreement and any legal retention requirements. Saved workspace conversations are not subject to a blanket 24-hour deletion promise.
• Access to Student Data is restricted to employees and subcontractors with legitimate educational interest

Data Classification

Retention Periods

Disposal Procedures

Digital data disposal follows NIST SP 800-88 compliant methods including cryptographic erasure. Physical media undergoes destruction via shredding or degaussing. All disposal activities involving Student Data are logged and verified.

Scope

This plan applies to any security incident that may compromise the confidentiality, integrity, or availability of iTherapy information systems or data, including unauthorized access, malware infections, data breaches, denial of service attacks, physical security breaches, lost devices, and insider threats.

Incident Response Team

Response Process

Notification Requirements

Authentication Requirements

Role-Based Access Control

iTherapy's security program is designed to align with all six core functions of the NIST CSF 2.0 (February 2024): Govern, Identify, Protect, Detect, Respond, and Recover.

iTherapy participates in the Student Data Privacy Consortium's National Data Privacy Agreement (NDPA) framework, supporting standardized data privacy agreements across multiple states.

Supported States

Key NDPA Provisions

• Provider acts as School Official with legitimate educational interest under FERPA
• Student Data remains property of the LEA
• No sale, rental, or trading of Student Data to third parties
• Prohibition on targeted advertising using Student Data
• Data breach notification within 72 hours
• Data disposition within 60-90 days of contract termination
• Annual audits available upon request