Is this FERPA compliant?
TherapyTrack is designed to support FERPA-aligned data handling and role-based access for school-based teams. Final FERPA compliance depends on how your organization configures, uses, and governs the system in practice.
Privacy & data handling
Privacy Policy
Last updated: February 15, 2026
This page explains how TherapyTrack handles student documentation data, account information, and collaboration workflows. It is intended as operational guidance for therapy teams using the platform in school-based settings.
What we collect
- Account profile details (name, email, role, state).
- Student records, goals, sessions, schedules, and attachments entered by your team.
- Collaboration metadata (invites, access roles, and activity related to shared workspaces).
How data is used
- Provide documentation workflows, progress tracking, and export tools.
- Enable secure collaboration between supervising clinicians and assistants.
- Generate optional AI drafts from documented data when requested by authorized users.
Security overview
- Encrypted transport (HTTPS/TLS) and encrypted storage through managed infrastructure.
- Authenticated access with role-based and per-student permission controls.
- Workspace-level account ownership and collaborator permission governance.
Frequently asked
Is data encrypted?
Yes. Data is encrypted in transit using HTTPS/TLS and encrypted at rest by the underlying managed infrastructure providers.
Where is user data stored?
User data is stored in secure data centers managed by our cloud infrastructure providers.
What happens if I cancel?
You keep access through the end of your active billing period. Before or at cancellation, you can export your records. After the account closes, data handling follows your retention and deletion settings.
Can I export all my data?
You can export key clinical documentation outputs (including student summaries, goal progress, and session logs). If you need a full account-level export workflow, contact support and we can provide one based on your deployment.
Who owns the data?
You (and your organization) remain the data owner. TherapyTrack acts as the service provider/processor for the data you store and manage in your workspace.
How is access controlled?
Access is authenticated and role-scoped. Workspace ownership, collaborator permissions, and per-student access rules limit who can view, edit, export, or generate specific documentation outputs.
How long is data retained?
Retention depends on your organization policy and deployment setup. You should define retention windows that match district/state requirements and internal governance standards.