How PULSE handles
student data.
Built for FERPA: a signed data agreement with every district. Student data is never sold, never used to train language models, and never used beyond what your district has authorized.
A signed data agreement with every district
Every district signs a Data Access and Protection Agreement with The Inclusive Practice, LLC. Under it, your district designates us a school official with a legitimate educational interest (34 C.F.R. § 99.31(a)(1)(i)(B)), and we act under your district's direction. Your district remains the responsible educational agency.
Stored in the United States
PULSE's database, sign-in and file storage are with Supabase, which maintains SOC 2 Type II and ISO 27001; scheduled data feeds from your district are received and stored with Amazon Web Services. Both are in the United States. Every company that receives district data is named on our subprocessor list, with what it receives.
What we do, and what we won't ever do.
What we store.
The student data your district sends us to plan and schedule services: names, date of birth, state and local student IDs, grade, school, disability category, IEP status and dates, placement setting, IEP services and minutes, transportation and extended-year eligibility, and the delivery records your providers confirm. PULSE does not ask for Social Security numbers, medical records or evaluation reports.
Your district owns your data.
Student data entered into PULSE is owned by the district, not by The Inclusive Practice, LLC. Districts may request deletion of all student data at any time.
We never sell your data.
We don't share student data with third parties except as required by law or as directed by the district. We don't use student data for advertising. We don't build student profiles for any non-educational purpose.
We never train models on your data.
Student data is never used to train language models. Some documents a district uploads, such as budget documents, bargaining agreements, bell schedules and uploaded provider schedules, are read by our language-model provider to extract their contents. That provider is named on our subprocessor list.
Encryption in transit and at rest.
TLS encryption in transit. AES-256 encryption at rest via Supabase. Each user's access is scoped to their own organization, by row-level security in the database and by checks in the application. We notify affected users promptly in the event of a data breach.
Uploaded files, and how long we keep things.
Files your district uploads, such as rosters, service lists, budget documents and files shared in Teams, are stored in encrypted file storage with Supabase in the United States. Once an import's data is loaded, an administrator can remove its source file, after which PULSE keeps only a fingerprint of it (file name, size, checksum and row count), never its contents. Everything else is kept while your district's agreement is active. Deletion requests are processed within 30 days.
DPAs available on request.
Districts in states with specific edtech privacy requirements (including California, New York, Colorado, Virginia, Texas, and Connecticut) may request a Data Processing Agreement. Contact us below.
Questions about how we handle student data?
If you're a parent, district administrator, or compliance officer, we're happy to answer specific questions about our data practices, share copies of our DPA, or walk through our security setup.
See also: Privacy Policy · Terms of Service