FERPA Data Use Agreement

FERPA DATA USE AGREEMENT

This Data Use Agreement ("Agreement") is entered into between:

1. Purpose

Institution desires to use the CNA-Ready platform to support CNA training and exam preparation for its students. In connection with this use, Institution may share student education records with CNA-Ready as defined under the Family Educational Rights and Privacy Act (FERPA), 20 U.S.C. § 1232g, and its implementing regulations at 34 C.F.R. Part 99. This Agreement governs CNA-Ready's access to, use of, and obligations with respect to those records.

2. FERPA School Official Designation

Institution hereby designates CNA-Ready as a "school official" under FERPA (34 C.F.R. § 99.31(a)(1)(i)(B)) with a legitimate educational interest in accessing student education records solely for the purpose of providing the CNA-Ready educational platform and related services to Institution's students. CNA-Ready's legitimate educational interest is limited to:

• Providing, operating, and maintaining the CNA-Ready study platform
• Tracking student progress, quiz scores, and module completion within the platform
• Enabling instructors to monitor cohort progress through the Instructor Dashboard
• Providing AI-assisted tutoring and personalized study recommendations
• Sending transactional emails related to the student's use of the platform
• Maintaining platform security, troubleshooting, and technical support

3. Education Records Covered

The education records subject to this Agreement include:

• Student name and email address
• Cohort enrollment and class assignment
• Quiz attempt history, scores, and answer data
• Module and skill completion records
• Skill checklist evaluation records
• Platform login and activity timestamps

The following information is expressly excluded from this Agreement: financial aid records, disciplinary records, Social Security numbers, health records, or any data not generated through the CNA-Ready platform.

4. Permitted Uses

CNA-Ready may use student education records only as follows:

• To provide the educational services described in Section 2 above
• To generate aggregated, de-identified analytics for platform improvement (no individual student may be identified)
• To comply with applicable law or a valid court order (Institution will be notified to the extent legally permissible)

5. Prohibited Uses

CNA-Ready shall not:

• Sell, rent, or transfer student education records to any third party for any commercial purpose
• Use student education records for behavioral targeting, advertising, or marketing to students
• Use student education records to build personal profiles for purposes other than delivering the educational service
• Disclose student education records to any party other than as specified in Section 4 or with written consent of Institution
• Combine student education records with data from other sources to create a profile for non-educational use

6. Sub-Processors

Institution consents to CNA-Ready's use of the following sub-processors, each of which has executed a data processing agreement with CNA-Ready:

CNA-Ready will notify Institution of any material changes to sub-processors at least 30 days in advance.

7. Security Obligations

CNA-Ready agrees to implement and maintain reasonable and appropriate technical and organizational security measures to protect student education records, including:

• Encryption of all data in transit using TLS
• Encryption of data at rest
• Role-based access controls limiting access to authorized personnel
• Audit logging of administrative access to student records
• Employee training on data privacy obligations

8. Breach Notification

CNA-Ready shall notify Institution within 72 hours of discovering any actual or reasonably suspected unauthorized access to, use, or disclosure of student education records. The notification will include, to the extent known at the time: the nature of the breach, the categories and approximate number of students affected, the likely consequences, and the measures CNA-Ready is taking or proposes to take to address the breach.

9. Data Return and Destruction

Upon written request by Institution, or upon termination of the institutional relationship, CNA-Ready shall, at Institution's option:

• Return all student education records to Institution in a standard exportable format (CSV), or
• Securely destroy all student education records and provide written certification of destruction within 30 days

Aggregated, de-identified data may be retained after destruction. CNA-Ready will not retain any copies of personally identifiable student records beyond what is required by applicable law.

10. Student Rights

Institution remains responsible for complying with FERPA student rights obligations, including providing students with access to their education records and the ability to request correction. CNA-Ready will cooperate with Institution to facilitate the exercise of student FERPA rights for records held within the CNA-Ready platform. Requests should be directed to Institution's FERPA officer, who will coordinate with CNA-Ready as needed.

11. California SOPIPA

For institutions serving California students, CNA-Ready additionally represents that it complies with the California Student Online Personal Information Protection Act (SOPIPA), Cal. Bus. & Prof. Code § 22584, including prohibitions on targeted advertising, the sale of student personal information, and the use of student information to build non-educational profiles.

12. Institution's Obligations

Institution agrees to:

• Provide students with notice that CNA-Ready is used as part of their training program
• Obtain any necessary student consents required by applicable law
• Ensure that student information provided to CNA-Ready is accurate and lawfully shared
• Promptly notify CNA-Ready if a student's FERPA rights are invoked with respect to records held by CNA-Ready
• Use the CNA-Ready platform only for legitimate educational purposes for enrolled students

13. Term and Termination

This Agreement is effective upon the date of execution by both parties and remains in effect for the duration of Institution's use of the CNA-Ready platform. Either party may terminate this Agreement with 30 days' written notice. Upon termination, the data return/destruction provisions of Section 9 apply.

14. Governing Law

This Agreement is governed by the laws of the State of California, without regard to conflict of law principles. Any dispute arising under this Agreement shall be resolved in the courts of Los Angeles County, California.