BehaviorFlow is designed to protect student data with secure infrastructure and role-based access controls, and we minimize the identifying student information stored in it. The statements below about the app come from our published privacy policy and terms; nothing is claimed beyond them.
Hosting
The BehaviorFlow app is implemented on the Google Cloud Platform and uses Cloud Firestore and Cloud Storage to store user data. Both products are HIPAA compliant and are scanned regularly. BehaviorFlow, Inc. has executed a Business Associate Agreement (BAA) with Google as part of its overall security strategy. No student or app data is stored on this website.
Encryption
All information is encrypted in transit using Transport Layer Security (TLS), including information sent to Google Cloud from the app and communication with the website. Personal and sensitive information such as passwords and documents are encrypted at rest. BehaviorFlow does not store credit card information.
Access and sharing
Administrators organize students and staff by classroom and location and control who has access to what, so staff only see the students and information relevant to their work.
BehaviorFlow may disclose personal information to third parties, including a school district, a specific school, a classroom, or another user circle, when the account holder authorizes it. Personal information sits behind secured networks and is accessible only to a limited number of people with special access rights who are required to keep it confidential.
Users can log into their account to correct, amend, or delete certain information associated with it.
What the app collects
| Who | What |
|---|---|
| Students | First name and last name initial, email address, password, summary statistics about sessions completed, comments about performance during a method, and, for educational programs, performance trends across sessions |
| Teachers and staff | First and last name, email address, password, and summary statistics about the methods created and used |
| All users | The location where the service is used, which can be combined with a user’s profile at the user’s option to connect with nearby organizations; and camera access, for capturing information needed for the service |
The app is not suitable for storing Social Security numbers, financial account numbers, driver’s license numbers, or other sensitive personal information as defined in the terms, and users agree not to upload them. Data in the app may be discoverable in litigation and may have to be provided to others when the law requires it.
Incident notification
In the event of a data breach, BehaviorFlow will email notification to users within 7 business days via the email address associated with their account. BehaviorFlow also agrees to the Individual Redress Principle, so that individuals have enforceable rights against data collectors and processors who fail to adhere to the law.
This website
This website is separate from the app and holds no student data. It is served over HTTPS, sets no cookies of its own and runs no advertising. It counts visits with anonymous statistics from its hosting provider, and the only personal information it collects is what you send through the “Get more info” form. The details are in Part 1 of the privacy policy.
For your review
Districts typically ask for a data privacy agreement alongside the vendor’s policies. Send your district’s agreement, your student data privacy questionnaire, or your vendor checklist to info@behaviorflow.org and we will work through it with you.