Privacy and compliance in plain English

IEPeasyhub works under federal and Florida law on student records. FERPA is the federal law that protects students' education records: it limits who may see a record and who it may be passed on to, and sending an identifiable record to an outside service, an AI provider included, counts as passing it on. IDEA is the federal special-education law. IEPs, evaluations, eligibility decisions and consents are its records, and they carry legal deadlines. IDEA also gives parents the right to inspect any record about their child, and requires records to be destroyed once they are no longer needed. Florida Statutes sections 1002.22 and 1002.222 go further than federal law, so Florida is the floor IEPeasyhub builds on. Florida forbids collecting political affiliation, voting history, religious affiliation or biometric information about students and families, forbids targeted advertising and non-educational profiling, and gives parents the right to inspect, challenge and correct records. Every printed document cites those two Florida sections first. COPPA, the children's online privacy law, applies only narrowly, because students never sign in: staff enter records about a child, and nothing is collected from the child.

In IEPeasyhub, each school or district is its own organization, and the database itself keeps every organization's records apart. The database decides, not the screens, so a page that forgets to check cannot show a record it should not. Inside an organization, a case manager or provider sees a student when they are on that student's IEP team. Administrators and district leads see the students of their own organization. Parents and guardians see only the children linked to their own account, and a parent cannot see another guardian's account or contact details, because some families involve custody disputes or safety concerns. Related service providers, such as speech-language pathologists, can read a student's whole record but cannot change goals, evaluations, the Matrix of Services, eligibility or services, and cannot finalize an IEP. They log service sessions only for students whose team they are on. Students never have an account.

The IEPeasyhub audit trail is a record of changes that can only be added to, never edited or deleted. It covers the legal paperwork and every IEP section, plus student details, progress, behavior entries, service logs, meetings and evaluations. Each entry says whether a change came from the AI or from a person. Every AI draft is recorded, and so is every edit, approval and rejection a person makes, with an edit stored as the before and after. Families can see the audit record about their own child, including AI drafts the team set aside. That is deliberate: the law gives parents access to records about their child, and no exception covers drafts kept in a shared system.

Keeping student records is a duty in both directions. Federal special-education law requires records to be destroyed once they are no longer needed for a student's services, so keeping everything forever is not the safe choice. In IEPeasyhub, every table that holds student information has a recorded answer for how long it is kept, and an automatic check fails if one is missing. A student's record has no countdown clock. It stays under the school's or district's own records schedule and its contract, and it is disposed of as an event: when the district instructs it, when a family's destruction request is granted, or when a contract ends and the data must be returned or destroyed. One complete removal process deletes the student's record everywhere it lives, including signatures and documents that point to the student indirectly, and a standing check confirms nothing is left behind.

Families use the Records area of the IEPeasyhub family portal to exercise their rights. A parent can request a copy of the complete record, and staff review it before release, within the window federal special-education law allows or sooner when an IEP meeting is near. A parent can ask for something in the record to be corrected because it is inaccurate, misleading or harms the child's privacy. The school grants the request, refuses it with a reason, or the question goes to a hearing, and a parent who still disagrees can file a statement of disagreement, which cannot be changed once it is filed. A parent can also ask for the record to be destroyed once it is no longer needed; an administrator or district lead decides, and granting it cannot be undone. The AI transparency page shows what the AI drafted for the child, what the reviewer changed, and when it was approved, and the access history shows who has opened the record.

No product can make itself lawful to hold student records on its own. What makes it lawful is a written designation by the school or district naming IEPeasyhub as a school official acting under its direct control, together with a signed data privacy agreement. The standard form districts look for is the national student data privacy agreement with its Florida exhibit. Real student data waits until a school or district has signed, which is why every self-signup workspace starts with practice students only. At sign-up, a teacher agrees not to enter real student records unless their school or district has authorized IEPeasyhub, and the database refuses to add a real student to a self-signup workspace until an organization-level data authorization exists. The demo districts hold only made-up students for the same reason.