Student Data Privacy & Security Compliance

Let's C.R.E.A.T.E., Inc. (“we” or “the organization”) operates a community-based therapeutic arts and youth-wellness platform for participants ages 12–21. When a New York State school district, BOCES, or other educational agency provides or directs students to use this platform as part of programming, the platform functions as a third-party contractor within the meaning of 8 NYCRR Part 121.

This compliance page supplements our Privacy Policy and applies specifically to student and teacher data shared with or generated within the platform in a school-use context. Where this page and the Privacy Policy differ, this page controls for school use.

When the platform is used by a NYS school or BOCES, we certify that we:

• Do not sell student personally identifiable information (PII).
• Do not use or disclose student PII for any commercial purpose, including targeted advertising, marketing, or amassing a profile about a student for non-educational purposes.
• Do not use student PII for any secondary purpose beyond the authorized educational/program services a school requests.
• Do not disclose student PII to any other person or entity except as required to deliver the authorized program or as permitted by law.
• Restrict access to student PII to authorized personnel with a legitimate educational/program need.
• Encrypt student PII in transit and at rest.
• Retain student PII only as long as needed to provide the requested program, and delete or return it upon contract termination or request, consistent with law.
• Certify that subcontractors with access to student PII are bound to the same protections.

Consistent with New York Education Law 2-d, parents, legal guardians, and eligible students (age 18 or emancipated) have the following rights regarding student data:

• A student's PII is confidential and cannot be released without consent, except to authorized parties as permitted by law.
• The right to inspect and review the contents of the student's education records, consistent with FERPA.
• The right to inspect the list of third-party contractors with access to student PII (provided in Section 4 below), and to receive a copy of any supplemental information shared with those contractors.
• The right to have student PII protected with safeguards that are industry-recognized as technically and administratively reasonable (Section 5).
• The right to file a complaint with the U.S. Department of Education regarding a possible FERPA violation, or with the NYS Education Department regarding an Education Law 2-d / Part 121 concern.

These rights are in addition to, and do not replace, the rights described in our general Privacy Policy.

Some platform features use AI/LLM processing to respond to content a participant submits (for example, AI Art Coach feedback, journaling prompt suggestions, and wellness insights). For school-use accounts under NY Education Law 2-d, the following applies:

• Default opt-out: School-use accounts default to opting out of AI processing of their submitted content. Each student may choose to opt in during activation and can change their preference at any time in their profile.
• No training on student PII: AI providers used by the platform certify they do not train models on student PII for school-use accounts.
• No commercial profiling: AI-processed content is used only to generate a response returned to the student or authorized staff — never to build commercial profiles or for advertising.
• Minimum necessary: Only the prompt text and content the user submits to an AI feature is sent for processing; broader account data is not shared with AI providers for school-use accounts.
• Auditable: AI opt-out choices are recorded with a timestamp and appear in the access audit trail.

A student, parent/guardian, or school administrator may submit an AI opt-out or deletion request at any time via our Data Rights Request form.

No online system can be guaranteed 100% secure, but we apply industry-recognized, technically and administratively reasonable safeguards consistent with Part 121.

• Student PII is accessed only by staff with a legitimate program need, and only to deliver or evaluate the authorized program.
• Student PII is never used for targeted advertising or commercial profiling.
• Student PII is never sold or licensed to any third party.
• Any AI features that process student-submitted content are used to generate a response returned to the student/staff only — not to build commercial profiles.
• Aggregated, de-identified data used for reporting cannot reasonably identify an individual student.

Student PII is retained only for as long as needed to provide the program requested by the school, or as required by law. Upon request by a parent/guardian, eligible student, or the school district, or upon termination of the school agreement, we will:

• Delete the student's PII from the active platform; and
• Return or delete copies held by subprocessors, subject to any legal retention the school specifies in the DPA.

Parents and eligible students may request access to, correction of, or deletion of their data at any time (see contact below). We respond to verified requests within 30 days.

In the event of an unauthorized disclosure of student PII, we will notify the affected school district and/or parents in the most expedient time possible and without unreasonable delay, consistent with the requirements of Education Law 2-d, Part 121, and the terms of the executed Data Privacy Agreement. Our breach response includes containment, investigation, mitigation, and documentation of the incident.

To support a Westchester or NYS school district or BOCES review, we will execute a Data Privacy Agreement that memorializes the commitments on this page, including:

• The specific data elements shared with the platform by or for the school;
• The authorized educational/program purposes;
• Subcontractor list and certifications;
• Security safeguards and breach notification timelines;
• Retention and deletion/return of data upon termination;
• Compliance with FERPA, COPPA, and NY Education Law 2-d / Part 121.

A template DPA and supplemental documentation package can be provided to your technology department on request. Submit a request through our secure intake form and our compliance lead will follow up:

Parents, legal guardians, eligible students (18+), and school administrators may request access to, correction of, deletion of, or opt-out from processing of student data at any time under FERPA and NY Education Law 2-d. We verify identity before acting and respond to verified requests within 30 days.

School administrators enrolling a cohort should use the School Program Registration path.

• FERPA: When a school directs use of the platform, we support the school's role as the FERPA “school official” controller and handle student education records under the school's direction with appropriate safeguards.
• COPPA: For participants under 13, we obtain verifiable parental consent before collecting personal information and provide parents access and control consistent with COPPA.
• Accessibility (ADA / Section 508): We design the platform to be usable with assistive technology; the platform is continually improved for WCAG 2.1 alignment.
• Non-clinical program: The platform is a community-based creative wellness program, not a clinical mental health provider — see our Parent & Guardian Info.