Who this notice is for
Impact Suite provides school safety, student wellness, and case-management software to school districts and educational agencies. This notice explains how we handle personal information about:
Students enrolled at a school that uses Impact Suite
Parents and guardians of those students
School and district staff who use the platform
If your school or district uses Impact Suite, this notice tells you what we do with that information, and just as importantly, what we do not do with it.
The most important thing to understand: your school directs us
We are a service provider to your school district, not an independent collector of your information. Under the Family Educational Rights and Privacy Act (FERPA), we act as an outsourced school official with a legitimate educational interest. Your district decides what information we receive, what we do with it, and how long we keep it. We act only on the district's documented instructions.
For students under 13, the Children's Online Privacy Protection Act (COPPA) permits a school to provide consent on a parent's behalf when a service is used solely for a school-authorized educational purpose. Impact Suite operates under that model. Students under 13 are expressly within scope, and their information is handled under the protections described here.
Where information is health-related, we handle it as Protected Health Information under HIPAA, as a Business Associate of the district.
Because your district directs the processing, requests about your information should go to your school or district first. See "Your rights" below.
What we collect
We collect only what the contracted educational and safety purpose requires.
About students
Name, date of birth, grade level, school, and the student identifier from your district's student information system. Depending on what your district enables: contact information, optional demographic fields (gender, race, ethnicity), attendance, academic performance, class enrollment, safety status, and assigned staff.
About parents and guardians
Name, relationship to the student, email address, and phone number, so the school can reach you. Where your district provides it, home address. If your district uses the Parent Portal or wellness screening, we also hold your account details and any consent responses you give.
About school staff
Name, work email, role, school and district assignment, and team memberships, so the platform knows what each person is permitted to see.
Records your school creates in the platform
Safety concerns and tips, behavioral records, threat and suicide-risk assessments, wellness screening responses, intervention and safety plans, case notes, staff training completions, and policy acknowledgements. Some of these are authored as free text by school staff and may contain whatever the author writes.
Automatically, for security
Sign-in and access logs, IP address, session tokens, failed sign-in attempts, and records of administrative access. We use these to protect accounts and to maintain an audit trail.
What we do not collect
We think this list matters as much as the one above. We do not collect:
Social Security numbers
Financial or payment information
Biometric data (no facial recognition, no fingerprints)
Location or GPS data beyond which school a student attends
Browsing history
Social media content
Religious affiliation
Political views
Family income
Immigration status
Why we collect it
To deliver the services your district has contracted for: identifying and responding to safety concerns, conducting structured threat and suicide-risk assessment, coordinating interventions and case management, communicating with families, delivering staff training, and reporting to your district on its own operations and compliance obligations.
We do not use this information for any other purpose.
Artificial intelligence
The platform includes an AI assistant, AskImpact, which helps staff draft and understand safety and wellness documentation. Four commitments govern it:
Student information is never used to train AI models. Not by us, and not by the AI services we use. Inputs and outputs are not used to train the underlying models.
A person is always responsible. AskImpact produces drafts for a qualified staff member to review, edit, or discard. It makes no autonomous decision about any student, and it does not act on a student's record, placement, discipline, or services.
It stays inside our environment. All AI processing happens within our own Amazon Web Services environment in the United States. No outside AI provider receives student information.
It cannot see more than the person using it. AskImpact only draws on records the staff member is already authorized to access.
A detailed Privacy Impact Assessment covering AskImpact is available to districts on request.
What we never do
We never sell or rent student, guardian, or staff information.
We never use it for advertising, marketing to students, or behavioral profiling.
We never use it to train AI models.
We never share one district's information with another.
Who else handles the information
We use a limited set of service providers to deliver the platform: cloud hosting and storage, student information system synchronization, text message and email delivery, address mapping, data import, and product analytics. Every one of them is based in the United States, operates under a written data protection agreement (or a HIPAA Business Associate Agreement where health information is involved), and may use the information only to provide their service to us.
A current, itemized list of these providers, showing what each one does and what it receives, is published in our Trust Center at trust.impactsuite.com. We give districts advance notice of changes to it.
We disclose information to anyone else only where your district instructs us to, or where we are legally required to. We do not hand information to law enforcement without valid legal process, and where we receive such a request we notify the district first unless legally prohibited from doing so.
Where information is kept
Entirely within the United States, in Amazon Web Services' Oregon region. Information is encrypted both in transit and while stored, access is restricted by role, and access is logged.
How long we keep it
Your district sets retention, and its agreement with us governs. In general, records are kept while they serve the educational and regulatory purpose they were created for, security and audit logs are kept for six years, and operational system logs are kept for 30 days.
When a district's contract ends, its data is exported back to the district if requested and then securely destroyed following the NIST SP 800-88 media-sanitization standard, with a certificate of destruction provided. A district can also request deletion at any time during the contract.
Your rights
Because your district directs how this information is used, please contact your school or district first. They can access, correct, or request deletion of records, and we support them in doing so.
If you contact us directly, we will promptly notify your district and act on their instructions. We will not act unilaterally on records that belong to them.
Depending on where you live, you may have additional rights under state privacy law. Those rights are exercised through your district as the responsible party, and we will assist.
Keeping information secure
Encryption in transit and at rest, role-based access limited to those with a legitimate need, logging of access and administrative activity, staff training on privacy and security before anyone is granted access to student data and repeated annually, background checks on personnel with access to student data, and a documented incident response plan. If a security incident affects a district's information, we notify that district within 72 hours of confirming it.
Our full security documentation is published at trust.impactsuite.com.
Changes to this notice
If we make a material change, we will update the effective date above and notify districts through their agreement. Earlier versions are available on request.
Contact us
Privacy Officer
Clay Olsen, clay@impactsuite.com
Security Officer
Zach Johnson, VP of Product and Safety Officer, zach@impactsuite.com
Accessibility
accessibility@impactsuite.com
General
support@impactsuite.com
Impact Suite, LLC