Data agreement (DPA)

The school, district or agency that opens an account (the "Institution") determines what records are entered into Bright Path and why. Bright Path acts only on the Institution's instructions when it stores and processes those records.

Under FERPA terminology, the Institution intends to designate Bright Path as a party performing an institutional service or function for which the Institution would otherwise use its own employees, operating under the Institution's direct control with respect to the use and maintenance of education records. This designation is made by the Institution in a signed agreement; it is not a determination Bright Path can make on its own.

Bright Path uses the records entered by an Institution solely to provide and support the Service: storing them, displaying them to authorized users, generating reports and exports, and operating the optional AI drafting features when a user requests a draft.

Records are not sold, rented, or used for advertising or profiling, and are not used to train third-party AI models.

Bright Path staff access records only where necessary to provide support the Institution has requested or to investigate a technical fault, and such access is limited to the personnel who need it.

Student identifiers and demographics the user chooses to enter, IEP goals and baselines, session and trial data, prompt levels and session notes, services and service minutes, attendance, accommodations, meeting notes, family communications, and derived progress reports.

Account data: user email address, display name, caseload membership, and authentication metadata.

Institutions can reduce the identifying data they store by using initials or student IDs in place of full names.

Every route requires sign-in; there is no anonymous access to records. Data is scoped to a caseload, and only members explicitly added to that caseload can read or write its records. Removing a member ends their access immediately.

Deletions and restores are recorded in the caseload activity log so the Institution can see who changed what.

Bright Path uses third-party services to host, deliver and support the product. These are listed on the subprocessors page, along with what each one processes and how changes are announced.

Each subprocessor is engaged under terms requiring it to process data only to provide its service.

The Institution can export a full copy of its records at any time from Settings, in JSON and CSV, without contacting support.

The Institution can delete a caseload or an entire account from Settings. Deletion removes the associated students, goals, session data, services, attendance and communications from the live system and cannot be undone.

Backup retention periods and the point at which deleted data is purged from backups are stated on the security page and must be confirmed by the operator before signature.

Security measures, data residency, backup practice and the breach-notification commitment are described on the security page and are incorporated into this agreement by reference.

Bright Path will respond to reasonable written security and privacy questionnaires from an Institution evaluating or renewing the Service.

Bright Path will assist the Institution in responding to a parent's or eligible student's request to inspect, correct, or delete records, by making export and deletion tools available and by providing support where a request cannot be completed through the product.

This page describes the terms Bright Path expects to offer. It is not a signed agreement and does not replace one. Institutions that require an executed DPA, state student-privacy addendum, or district-specific rider should request one before entering real student-identifying information.