Privacy Policy

Texas Council of Administrators of Special Education ("us," "we," "our", "TCASE") is committed to protecting the information entrusted to us by the schools, school districts, and educational organizations (collectively "schools") that use our products. This privacy policy explains what information is collected by Empower, when we collect it, how we use it, how we protect it, and your rights concerning the information you provide to us.

Empower (also known as "empoWEr") is a service offered to schools for creating and monitoring education plans to achieve the best possible outcomes for all students.

TCASE functions as a Third-Party Service Provider or School Official for schools. Consequently, this privacy policy may be superseded by contracts and other agreements between TCASE and the schools that use our products, in addition to our obligations under the Family Educational Rights and Privacy Act (FERPA) and other applicable laws.

Access to Student Data

Collection, use, and disclosure of student data is governed by the terms of contracts and other agreements between the schools and TCASE, as well as applicable laws such as FERPA. Ownership of student data remains with the schools, and schools control access to student data within Empower.

Parents, guardians, and legal custodians of students should contact their schools for questions about exercising their legal rights to access or modify your child's student data under FERPA.

What information do we collect?

School Data

In order to provide services to a school, Empower must collect information about the school organization. This can include school names, location, contact information, schedules, calendars, district structure, and the grade levels served by the school. Empower must collect email addresses, names, titles, and security roles of users that will access the system, as well as those of non-user staff members added to the system at the school's discretion.

Student Data

Empower will collect personally-identifiable information (PII) student data provided by schools through the course of using our services. This information is part of the student's educational record and may be sourced from the school's information system (SIS) or other school records as authorized by the school. This information is collected only for the purpose of providing contracted services to the school. Empower collects the following types of student data, at the school's discretion:

• Name
• Date of birth
• Identification numbers
• Enrollment information
• Demographic information such as race, ethnicity, and gender
• Address
• Email address
• Phone number
• Education records
• Health information, which may be used for Medicaid reimbursement
• Parent, guardian, or other contacts (including name, address, phone number, and email address)

The health information collected by Empower is part of the student's education record, and whether it is protected under FERPA or the Health Insurance Portability and Accountability Act (HIPAA) depends on the school's status as a covered entity under HIPAA.

User Data

Empower collects user data to provide services to schools. This information includes:

• Email address
• Name
• Time zone
• Likeness of a user's signature
• IP Address and other security auditing metadata
• Unique identifiers provided by identity providers

Cookies

Empower uses essential cookies to:

• Authenticate users
• Track user preferences
• Provide support through the integrated chat feature
• Track system performance metrics

All of the information above is required for the correct functioning of the product, and may not be turned off. This information is provided by the user’s browser settings or provided voluntarily by the user. We are not required to collect this information by a law, court order, nor by a tribunal order.

When you sign in, we will link the identifying information provided to an authorized user account. This allows schools to control user authentication methods, such as single sign-on (SSO), and to allow users uninterrupted access their account when their email address changes.

When do we collect information?

We collect information when you access the application, fill out a form, enter information in the application, communicate with us inside the application, or interact with the application. We may also collect information provided by schools exclusively for their benefit.

How do we use information?

We use the information collected by Empower for one or more of the following business processes:

• Establish the identity of users
• Allow management of student education records
• Create a likeness of a user’s signature
• Provide authentication metadata in digital and electronic signatures
• Represent the likeness of the user’s signature on printed documents
• Perform services on behalf of the school
• Provide customer service
• Satisfy our contractual obligations to the schools that own the data

We treat this information as confidential, and it is only used to deliver our contracted services to schools.

How do we protect information?

We use both industry-standard and NIST-recommended practices and technologies to safeguard all data entrusted to us. Empower is scanned periodically for security vulnerabilities and known exploits, and we apply a number of security measures to prevent accidental or malicious disclosure of data. These measures include:

• Encrypting data in transit. We use Transport Layer Security (TLS) -- commonly known as "https" or "SSL" -- to protect data sent between the user's browser and our servers. We also use TLS or Secure File Transfer Protocol (SFTP) to protect data sent between our servers and other systems
• Encrypting data at rest. We use industry-standard encryption algorithms (such as AES-256) to protect data stored in our infrastructure
• Limiting access to stored information to personnel with a need-to-know and a duty to keep confidential
• Requiring multiple authentication factors to gain access to our systems
• Limiting the personal information we collect to strictly-necessary
• Destroying personal information no longer required to provide our contracted services
• Screening all employees with access to personal information
• Training employees on data security and privacy best practices
• Requiring our employees to sign confidentiality agreements
• Encrypting storage media for portable devices
• Maintaining up-to-date software and safeguards

Do we share your information?

We share this information with our business partners only in the course of delivering our contracted services. Most information we collect is the property of schools, which may be disclosed to them to fulfill our services.

We do not sell, trade, or otherwise transfer this information to outside parties. However, we may release your information when we believe release is appropriate to comply with the law, enforce our site policies, or protect ours or others' rights, property, or safety. In addition, we may share or transfer your information in connection with, or during negotiations of, a merger, sale of company assets, financing, or acquisition of all or a portion of our business to another company.

How can you update or delete your information?

Requests to update or delete your information should be directed to the school that owns the data.

If you do not know which school owns the data, or if you believe your information is not owned by any school, you may contact us at help@support.empoweriep.com with your inquiry for assistance.

How long do we keep your information?

We retain all of the information that we collect until the school that owns the data is no longer a customer or otherwise requests its destruction.

Children Online Privacy Protection Act

We do not knowingly collect any information from children under the age of 18 unless and until the school has obtained appropriate parental consent for the student to use the Service. Because Empower collects and uses Student Data at the direction of and under the control of a school, Empower relies on each school to provide appropriate notice to parents of the school's use of third party service providers such as Empower, and for the schools to provide consent, if necessary, and authorization for Empower to collect Student Data, as permitted by the Children’s Online Privacy Protection Act (COPPA) and other applicable data protection laws. Please contact your school directly if you believe we have inadvertently collected personal information of a child without proper consent.

Your Rights

All users of Empower have the following rights with regard to their personal information:

• The right to access the personal information that we have collected about you
• The right to say no to the sale of your personal information. We do not sell your personal information
• The right to request that we delete all or some of the personal information that we have collected on you
• The right to ask us to transmit your personal information that we have collected on you to another provider (where technically feasible)
• The right to request that we amend any of the information that we have collected about you
• The right to withdraw your consent to the processing of your data
• The right to request that we restrict the processing of your data
• The right to lodge a complaint regarding our collection, sharing and processing of data with competent authorities in the proper jurisdiction
• The right to not have to identify yourself, or of using a pseudonym in certain circumstances
• The right to stop receiving unwanted direct marketing

You may have additional rights based on your school's privacy policy

Exercising Your Rights

You may exercise the rights specified above by contacting your school directly, or by submitting a consumer request to help@support.empoweriep.com.

We will need to verify your identity prior to effectuating your request. To verify your identity, you will need to provide us with the following information with your request:

• Name
• Email address

Please note that we may be unable to process your request if you do not provide us with the above information.

We will respond to most consumer requests within 30 to 45 days of receipt, depending upon where you reside. However, some requests may take longer. We will notify you in writing if we need more time to respond. We have the ability to deny your request(s) if certain exceptions in the law apply. If we do deny your request, we will provide you with the reasons for such denial.

Location of Data Processing

We process all data within the United States.

Do Not Track

Do Not Track is a preference you can set on your browser to inform websites that you do not want to be tracked. Empower's behavior does not change when it receives a Do Not Track request.

Transferring Data (Canadian Residents Only)

We plan to transfer data to the United States. This means that your information may be processed in a country outside of Canada and it may be accessible to law enforcement authorities and national security authorities of that country and jurisdiction.

Changes to Privacy Policy

We reserve the right to amend this Privacy Policy at any time. We will notify you of any changes to this Privacy Policy by posting the updated Privacy Policy to this website.

How can you contact us?

If there are any questions regarding this privacy policy, you may contact us at help@support.empoweriep.com.

You have the right to lodge a complaint regarding our collection, use and sharing of your personal information by contacting us at help@support.empoweriep.com.