Online Privacy Policy
Terrace Metrics, is committed to keeping any and all information collected of those individuals that make use of our online facilities and services accurate, confidential, secure and private. Our privacy policy has been designed and created to ensure those partnered with Terrace Metrics of our commitment and realization of our obligation not only to meet but to exceed most existing privacy standards.
THEREFORE, this Privacy Policy Plan shall apply to Terrace Metrics, Inc. and thus it shall govern any and all data collection and usage thereof.
Collection of Information
Terrace Metrics shall only collect personal information that you knowingly and willingly provide by way of its assessment tools and products. Terrace Metrics uses personal information only for the purpose of delivering our products and services (e.g., personalizing individual reports).
Specific personal information consists of the following: first and last name, date of birth, sex, race/cultural background. This data is stored separately from assessment results, on secured servers.
Personal information will only be collected after securing your written consent.
Use of Information Collected
Terrace Metrics does not now, nor will it in the future, sell, rent or lease any personally identifiable or de-identified information to third parties.
Security
Terrace Metrics shall endeavor and shall take every precaution to maintain adequate physical, procedural and technical security with respect to our information storage facilities so as to prevent any loss, misuse, unauthorized access, disclosure or modification of the user’s personal information under our control.
The Terrace Metrics assessment platform fully aligns with the 5 essential components of the NIST Cybersecurity Framework -1.0 (Identity, Protect, Detect, Discover, and Respond). Please see accompanying self-report file demonstrating how Terrace Metrics meets each component. Further, Terrace Metrics utilizes the AWS Cloud services, which itself fully complies with the Framework.
In addition to FERPA and the Protection of Pupil Rights Amendment (and it does not rely on any of the exceptions available under FERPA or the PPRA), Terrace Metrics maintains compliance with other federal-level legislative or regulatory schemes that govern the collection and use of data in its business. These policies include:
- Children’s Online Privacy Protection Rule (COPPA)
- Protection of Pupil’s Rights Amendment (PPRA)
- Student Data Privacy, Accessibility, and Transparency Act
- New York State’s Educational Law Section 2-d
Terrace Metrics has administrative, operational, and technical safeguards and practices these diligently to protect Protected Information. Only select school members (i.e., “response teams”) have access to individual data. These are typically counselors, social workers, school psychologists, nurses, and targeted members of a school and district administration. Teachers do not have access to individual data. Response team members are chosen by district administrators under consultation with Terrace Metrics. Further, Terrace Metrics staff do not have access to individual student data unless expressively permitted by the district. TM has access to anonymized data, which is used to generate district reports, for research purposes, and product development (e.g., algorithm enhancements).
The Terrace Metrics system is fully encrypted, uses CSRF security when logging in, has a same-origin policy, contains session-expiry for the user (it automatically logs the user out after 5 minutes of non-activity), and all deidentified data is stored on secure AWS servers and updated nightly. AWS Cognito is used for application authentication/authorization. AWS IAM user/roles/permissions used to manage system admin access.
All data is encrypted at storage and in transit. Any identifiable information is behind a firewall and separate from the administration site; students access their administration link through an encrypted code and do not enter personal information.
Parents must provide consent to allow their child to complete the assessment; whether this is passive or active consent is of the choice of the district. Consent form templates are provided by Terrace Metrics, which can be modified to conform with district privacy and operational policies.
In addition to this document, districts sign a Terrace Metrics software agreement and order form; collectively, these documents detail (a) the exclusive purposes for which student data is used; (b) how Terrace Metrics abides by all applicable data protection and security requirements; (c) the duration of the contract; (d) how the accuracy of student data may be challenged; (e) how the data is stored and protected, and (f) how data is protected using encryption while in motion and at rest.
Response teams are trained extensively by Terrace Metrics personnel, both prior to the use of the system as well as during data collection and post-data collection. Districts and schools have access to Terrace Metrics University®, an online library tutorial that walks all personnel through the entire Terrace Metrics process. The entire video library is 60 minutes. Pre-administration training is also given (90 minutes and conducted on-site). School response team members learn the process as well as the platform, including knowledge of all federal and state laws governing confidentiality of protected information. Only personnel who have been granted permission by the district have access to the Terrace Metrics assessment platform. In addition to steps listed above, Terrace Metrics monitors the system for possible security breaches and documents any privacy indicates that may compromise protected information. Should an incident occur, Terrace Metrics takes immediate steps to remediate and correct and will promptly notify the district/school.
Finally, the districts own their personal information. Should they wish to terminate its partnership with Terrace Metrics, districts are given the opportunity to retrieve all data collected since the partnership (typically within 30 days of notification), after which time the data is completely removed from the Terrace Metrics database and all servers.
Removal of Personal Data
Any personal information collected by Terrace Metrics is stored and maintained on its secured servers for as long as the organization has an open account. Should the organization discontinue its partnership with Terrace Metrics, all personal data is deleted.
How to Contact Us
If you have any questions or concerns regarding the Privacy Policy Agreement, please feel free to contact us at the following email, telephone number or mailing address.
Email: info@terracemetrics.org
Telephone Number: 1-800-470-4401
Mailing Address:
9130 Ambercreek Drive
Cincinnati, Ohio 45237