Scope

This policy applies to:

– risehi.com and any RiseHI-operated web pages

– ʻOihana Career Explorations and Make IT Happen, our education programs delivered to schools, districts, and organizations (“Schools”)

– Communications with educators, program partners, donors, and applicants

It does not apply to third-party websites we link to, or to a School’s own systems and policies.

Student Information

What we collect

We collect only the student information reasonably needed to operate a program:

– Student first and last name

– School-issued email address

– School name and grade level or expected graduation year

– Course enrollment and progress data generated as a student moves through program content

What we do not collect

We do not collect or request Social Security numbers, financial account information, payment card data, health information, government identification numbers, biometric data, precise geolocation, or student disciplinary records. We do not build advertising or behavioral profiles of students.

Our legal role

RiseHI acts as a “school official” with a legitimate educational interest under the Family Educational Rights and Privacy Act (FERPA), 34 C.F.R. § 99.31(a)(1). We use student education records only under the direction and control of the School, and only to provide the program the School has licensed.

For students under 13, we rely on consent obtained through the School, as permitted under the Children’s Online Privacy Protection Act (COPPA) when an operator collects information solely for the use and benefit of the school and for no other commercial purpose. Schools remain responsible for any parental notice or consent their own policies require.

We comply with applicable Hawaiʻi student privacy law and with the terms of any data privacy agreement we have signed with a School or with the Hawaiʻi State Department of Education.

How we use it

Student information is used solely to:
– Create and manage student accounts so students can access program content

– Track course progress and completion so educators can support their students

– Provide technical support to students and educators

– Produce aggregated, de-identified reporting on program usage and outcomes

What we never do

We do not:

– Sell student information, or rent, trade, or otherwise disclose it for consideration

– Use student information for targeted advertising, or allow anyone else to

– Use student information to build a profile of a student for any purpose other than supporting the educational program

– Disclose student information to third parties except to the service providers described in Section 4, or as required by law

Other information we collect

Educators and school staff. Name, work email address, school, and role; this is used to provision access, provide support, and communicate about the program.

Website visitors. Our website may collect standard technical information such as IP address, browser type, and pages visited, for security and to understand general traffic patterns.

People who contact us or subscribe. Name, email address, and the content of your message; this is used to respond and, where you have asked, to send updates you may unsubscribe from at any time.

Donors and grant partners. Contact and transaction information needed to acknowledge gifts and meet reporting obligations. Payment processing, where applicable, is handled by third-party processors; we do not store payment card numbers.

service providers

We share personal information only with service providers who need it to help us deliver our programs, and only under written obligations of confidentiality and data protection.

Our principal service provider is Thinkific, which hosts our online learning platform and stores student account and progress data. Thinkific holds a SOC 2 Type II certification and is bound by a data processing addendum. Thinkific maintains a published list of its own subprocessors.

We do not permit any service provider to use student information for its own purposes, including advertising or product development unrelated to serving us.

Where a School’s data privacy agreement requires us to identify subprocessors or obtain approval before adding one, we follow that agreement.

security

We maintain administrative, technical, and physical safeguards appropriate to the sensitivity of the information we handle:

– Student data is encrypted in transit and at rest by our platform provider

– RiseHI does not store student data on local devices or local servers

– Access to student data is limited to authorized staff with a need to know; this is currently our Executive Director and Program Coordinator

– All staff access requires unique credentials with multi-factor authentication enabled

– Multi-factor authentication is enforced on email and on all remote access

– Access is revoked promptly when a staff member’s role ends

No system is perfectly secure, and we do not claim otherwise. We work to reduce risk and to respond quickly when something goes wrong.

breach notification

If we confirm a security incident affecting student information, we will notify the affected School without unreasonable delay and in any event within seventy-two (72) hours of becoming aware of the incident. Notification will describe what we know, what information was involved, what we are doing, and what we recommend. We will cooperate reasonably with the School and with any regulator as required by law and by our agreements.

retention and deletion

We retain student information only as long as needed to provide the program, and then:

– We delete or return student information within ninety (90) days after the end of the license term, upon written request from the School

– Absent a request, we delete student accounts and associated progress data no later than twelve (12) months after the end of the license term

– Aggregated, de-identified usage data that cannot reasonably be re-associated with a student may be retained for program evaluation and reporting

Non-student information is retained as long as needed for the purpose it was collected, or as required by law, grant obligations, or our records-retention practices.

access, correction, and deletion

Because we act as a school official, requests from students or parents about student records should go to the School in the first instance. The School controls the record, and we will support any request it directs us to fulfill including access, correction, or deletion.

For non-student information, contact us at the address below and we will respond within a reasonable period.

children

Our programs are designed for middle and high school students and are delivered through schools. We do not knowingly collect personal information directly from children under 13 outside the school-consent framework described in Section 2. If you believe we have collected information from a child in error, contact us and we will delete it.

changes to this policy

We may update this policy. When we do, we will change the effective date at the top and post the new version here. If a change materially reduces the protections that apply to student information already collected, we will notify affected Schools before the change takes effect.

contact us

RiseHI Foundation
547 Halekauwila Street #203
Honolulu, HI 96813

For privacy and program inquiries: aloha@risehi.com