PRIVACY NOTICE

1. Introduction

This Privacy Notice (“Notice”) describes how the Rethink Ed division of Rethink Autism, Inc. (“Rethink”, “we”, “us”, “our”) collects, uses, discloses, secures, and eventually disposes of (collectively “processes”) your personal information. Personal information is any information that does, or could, identify you.

This Notice applies to personal information collected on our website (rethinked.com), mobile app (Rethink Ed), and in the course of any offline contact with you (collectively the “services”). Our website has public and subscription-only sections. Our mobile app is part of our subscription-only services.

Our services may contain links to external websites. This Notice does not cover these sites.

In this Notice, “you” refers to anyone about whom we collect and use personal information. You will usually be a school employee or contractor (for example, a teacher or administrator), a parent of a K-12 student, a caregiver to a student, or a visitor to our public website. For parents and legal guardians, “your personal information” includes your student’s personal information.

Rethink Ed provides online tools and content that assist schools in the development of their students' social and emotional skills and behaviors. These schools are, in nearly all cases, the customer for the subscription-only sections of our website. They exercise significant control over what personal information is collected and how it is used. This Notice does not cover the schools’ processing of your information.

Rethink Ed is part of the Rethink group of businesses. This Privacy Notice applies only to Rethink Ed.

2. Changes to this Notice

We will update this Notice from time to time and will communicate material changes to you through an appropriate channel (for example, via a notice in our services). The Notice was last updated on August 1st, 2020.

3. Personal information we collect

3.1 Categories collected

We collect the following categories of personal information:

  • Identifiers such as your name, email address, username, and IP address.
  • Additional personal information defined by certain applicable state laws: address, telephone number, payment card number.
  • Protected classification characteristics, such as ethnicity, gender, and medical condition.
  • Commercial information, such as your purchases from us.
  • Internet activity/usage on our websites and applications.
  • Employment-related information, such as your school job role.
  • Education information—student education records.

3.2 Categories of sources

We collect the categories of personal information listed above from the following categories of sources:

  • Directly from you, for example when you complete an online form or take part in a Rethink video conference.
  • From other users of the subscription-only parts of the services, for example when a teacher records your child’s progress in acquiring a skill.
  • From observing your activity on our services, for example via cookies and other standard online technologies.

3.3 Items of personal information collected

When we collect personal information directly from you, you will know, or have the ability to know, the details of that information. It may include:

  • Name and contact information.
  • Payment card information.
  • Login credentials (username and password).
  • Any details about yourself that you reveal as you use free-form features of the subscription-only service, for example you might mention your favorite pastime or the name of a relative.
  • Information from tests and assessments you take in the subscription-only service, for example educator professional development test scores, student input to social and emotional learning (SEL) self-assessments, and student performance levels at assigned tasks in the Student Center.
  • Testimonials for the Rethink Ed service that you may provide.
  • Your responses to polls and surveys that we may conduct.

Our subscription services facilitate the utilization of personal information for the purpose of assisting schools in their efforts to develop students' social and emotional skills and behaviors. When we collect personal information about you or your child from other users of the subscription-only parts of the services, we do so solely for this purpose. Which users can access the personal information of which other users is determined and configured by school administrators. The personal information collected in this way may include:

  • Information provided by schools (administration, educators, and specialists) about students:

    • Login credentials.
    • Name, date of birth, gender, ethnicity, photograph.
    • Educational classification (for example, autism, Asperger’s syndrome).
    • Behaviors and associated learning strategies, targets, lessons, and progress.
    • VB-MAPP scores and educator assessments of student skills.
    • Details of any incidents involving a student, for example tardiness or bullying.
    • Any information contained in free-form documents or fields, for example educator comments in a student progress report. Many free-form document types, including video, may be uploaded by educators to a student’s “File Cabinet”. We may in future develop other free-form capabilities, such as messaging and student journaling.

Note: Our service does not require all of this information. For example, ethnicity, photograph, and educational classification are collected at the school’s discretion.

  • Information provided by schools about their employees, for example teachers’ names and which classes and students they teach.

We collect personal information from observing your activity on our services in two ways:

  • We track your use of the subscription-only parts of our services, for example we record when you log in and which areas of the service you visit and what you do there. This information is available to your school administration.
  • We use cookies and other standard online technologies in our public and subscription-only services. Cookies allow us to recognize your device. We use them to collect information about your device and how you use our services, for example which pages you visit and how long you stay on them. Cookies also facilitate, for example, logging into and navigating our services.

3.4 Collection of children’s personal information

As described in this Notice, we process personal information about children, including children under the age of 13. This personal information is collected from schools, parents, and caregivers, and also through a child’s use of the Student Center area of the subscription services. A child can only access the Student Center with school-provided credentials.

The Student Center is the only part of our services intended for use by children. When logged in to the Student Center, children may complete assigned games, quizzes, and other activities and tasks. We will never require or encourage children to reveal personal information beyond that revealed by the activity itself (for example, quiz scores or progress in mastering skills). Access to the Student Center by children or others is controlled solely by the school.

The Children’s Online Privacy Protection Act (COPPA) requires that parents consent to the collection, use, and disclosure of their child’s information when the child is under 13 years of age. Under COPPA, schools may act as the parents’ agent, consenting on their behalf to personal information processing in the educational context. As the operator of a website providing services to schools, Rethink Ed obtains consent through the child’s school. We will only ever use children’s information for the benefit of the student and school, and never for our own commercial purposes.

Section 8 of this Notice describes how you can exercise parental rights, for example to access your child’s information, request its deletion, or opt out of future collection.

4. How we use your personal information

This section describes how Rethink Ed uses your personal information. Remember that the school (our customer) has a high degree of control over the personal information processed in our subscription-only services. This Privacy Notice does not cover how schools use your data, which will be determined by their own policies and legal obligations.

Rethink Ed will never sell your personal information.

When we receive your personal information under contract with our customers, we use the information only as specified or permitted by the contract. In particular, we will never:

  • Use student personal information for marketing or advertising purposes.
  • Disclose student personal information except as described in Section 5.

Rethink Ed may use your personal information for the following purposes:

  • To provide our subscription-only services, for example to manage log-ins and maintain the security and confidentiality of data contained in the services; to communicate essential service information to you; to provide customer support; to monitor compliance with our Terms of Use; and to report service usage data to our customers.
  • We may send non-student users of our services marketing messages for Rethink products that we think may interest them (see Section 8 for information about opting out of such messages).
  • To respond to your requests or questions, including through website forms and chat features.
  • To help us improve our services and user experience, for example by identifying which parts of our services you find useful or difficult to use. Usually, the information used for this purpose does not directly identify you as an individual.

5. Disclosure of your personal information

Who we disclose your personal information to depends on the specific items of information and the purposes we use them for. Your personal information may be disclosed to the following categories of recipients:

  • Other users of the subscription-only services: As described above, our subscription services facilitate the utilization of personal information for the purpose of assisting schools in their efforts to develop students' social and emotional skills and behaviors. As such, your information is disclosed to other authorized users of the service. Which users can access the personal information of which other users is determined and configured by school administrators.
  • Employees and contractors of Rethink: These personnel have roles that require access to your information (a “need to know”). They are bound by employment terms that cover their obligation to keep personal information confidential and secure and have been trained in federal and state law governing confidentiality of student and educator data.
  • Service providers: We use service providers to perform certain tasks for us, for example hosting our services on a Cloud computing platform or operating our online user support chat feature. Service providers process your data on our behalf and according to our instructions. They are contractually bound to protect your data and are prohibited from using it for their own purposes.
  • Other third parties: We may disclose de-identified information to third parties, for example business partners or research organizations. “De-identified” information is stripped of attributes that tie it to a particular individual and which cannot reasonably be reconnected to that individual.
  • Schools’ service providers: We may transfer your information, or facilitate its transfer, to a service provider of your school. For example, student information may be transferred to an Individualized Education Program (IEP) software provider. We make these transfers only when instructed to do so by a school.

We have in the preceding 12 months disclosed the following categories of personal information to service providers:

  • Identifiers such as your name, email address, username, and IP address.
  • Additional personal information defined by certain applicable state laws: address, telephone number, payment card number.
  • Internet activity/usage on our websites and applications.

We will also disclose your personal information in the following exceptional circumstances:

  • Corporate event: Your data may be transferred to third parties as a result of a merger, acquisition, or similar corporate event involving Rethink.
  • Legal necessity: We will disclose your information to government agencies, law enforcement, courts, and other authorities and parties if required to by applicable law.
  • Individual’s vital interests: If we reasonably believe based on information posted on or provided in relation to our services that the safety or vital interests of an individual are at risk, we will disclose personal information to relevant parties as necessary to assist the individual.
  • Protection of Rethink’s interests: Where permitted by applicable law, we may disclose personal information to our professional advisors and other qualified parties when we reasonably believe it to be necessary to protect our essential business interests.

Nondisclosure of Student Information: Any personal information received under contract with our customers will only be disclosed as specified or permitted by the contract. More specifically, we do not disclose identifiable student data to our service providers or other third parties.

6. Information security

We employ technical, physical, and administrative security measures appropriate to the categories of personal information processed in our services. These measures include, for example: encryption at rest and in transit, roles-based access, firewalls, and anti-virus software. For more details of our practices, please consult our Information Security Standards statement.

We protect information about student’s diagnoses, treatments, and outcomes with particular care. Rethink is HITRUST CSF certified. HITRUST CSF is a security and privacy framework that covers, among others, HIPAA and National Institute for Standards and Technology (NIST) standards.

Your personal information is stored on systems in the United States and is not transferred to other jurisdictions.

No matter how carefully we safeguard your information, it is unfortunately not possible to guarantee that it will never be accidentally or illegally breached.

7. Data retention

When we receive your personal information under contract with our customers, we will retain it for the duration of the contract and then, according to our customer’s instructions, return it to them, delete it, or transfer it to another service provider.

When we receive your personal information on our own account (that is, outside a contract with our customers), we will retain it as long as necessary to fulfil the purposes for which it was collected, and to satisfy legal, accounting, and reporting obligations, or to resolve disputes or enforce our Terms of Use.

Section 8 of this Notice below describes your right to request deletion of your data outside of our normal data retention schedule.

8. Your rights

US and state laws give you various rights over your personal information and that of your child. These may include the right to:

  • Access personal information held about you
  • Correct inaccurate or out-of-date personal information
  • Request deletion of your personal information
  • Opt out of disclosure of your child’s information to third-parties (COPPA)

In most cases relating to our subscription-only services, you should contact your school with any request to exercise privacy rights. This would include, for example, a request to access the information about your child that the school processes in our service. If necessary, however, please contact Rethink Ed using the contact information in Section 9 of this Notice, and we will endeavor to facilitate your request.

Rights requests concerning personal information collected or used outside our subscription-only services (for example, on our public website or in our marketing communications) should be addressed to Rethink Ed using the contact information in Section 9 below.

8.1 Marketing

You can opt out of our marketing communications at any time using, for example, the “unsubscribe” in an e-mail message or similar functionality in other communication formats.

Please note that, if you are a user of our subscription-only services, you may continue to receive service communications even after you have opted out of marketing communications. “Service” communications contain important information about the service for which you are a current user.

9. Contact us

privacy@rethinkfirst.com

Rethink Ed
49 West 27th Street, 8th Floor
New York, NY 10001
USA