Last Revised: 5/22/18
Phone: (202) 854-0068
Attn: Privacy Director
2301-D Georgia Ave NW
Washington, DC 20001
Because email communications are not always secure, please do not include sensitive information in your emails to us.
GUIDING PRINCIPLES TO PRIVACY
Here are the guiding principles that help us protect your personal information:
We don’t own the content you provide – you do.
We will never sell or rent user personal information, and we only share personal information with a limited set of partners and service providers necessary to provide our services.
We do NOT use or allow third-party advertisers on our service.
Personal information collected from students is never used or disclosed for third-party advertising on or off our service.
Personal information collected from students is never used for any behaviorally-targeted advertising to students by us or any third parties.
We collect the minimal amount of information from children necessary to use our service.
We use security industry best practices to protect your personal information.
We are transparent about our practices, so that you can make meaningful choices about how your information is used, and will notify you if things change.
Personal Information We May Collect
“Personal Information” is information that identifies you as an individual or relates to an identifiable person, including, for example:
How We May Collect Personal Information
We and our service providers may collect Personal Information in a variety of ways, including:
Through the Service: We may collect Personal Information when you voluntarily provide it to us in connection with our Service, such as during text conversations or when you complete a survey.
Through the Site: We may collect Personal Information when you voluntarily provide it to us through the Site, such as when you request information from us or otherwise contact us.
From Other Sources: We may receive your Personal Information from other sources, such as your school, programs in which you participate, and other third parties.
How We May Use Personal Information
We and our service providers may use Personal Information, to the extent permitted by applicable law and our agreements with schools and other partners:
To provide you with the Service.
To respond to your inquiries and fulfill your requests.
To send administrative information to you, such as information regarding the Service or Site and changes to our terms, conditions, and policies.
For our business purposes, such as data analysis, audits, fraud monitoring and prevention, developing new products, enhancing, improving or modifying our Service, identifying usage trends, determining the effectiveness of our promotional campaigns, and operating and expanding our activities.
To deliver and enhance personalized service to individual students. We use de-identified and aggregated data to improve product functioning and to conduct research.
How Personal Information May Be Disclosed
Your Personal Information may be disclosed, to the extent permitted by applicable law and our agreements with schools and other partners:
To the school or other organization through which you participate in the Service.
To a third party, such as a school counselor, family or child services agency, or crisis services provider, when you request or agree to such disclosure, or when you indicate a risk of harm to yourself or another person.
To a third party, as directed by your school or other organization through which you participate in the Service.
To our third party service providers who provide services such as website hosting, data analysis, information technology and related infrastructure provision, email and text message delivery, auditing, and other services.
To a third party in the event of any reorganization, merger, sale, joint venture, assignment, transfer, or other disposition of all or any portion of our business, assets, or stock (including in connection with any bankruptcy or similar proceedings).
Other Uses and Disclosures
We may also use and disclose your Personal Information as we believe to be necessary or appropriate, and to the extent permitted by applicable law and our agreements with schools and other partners: (a) under applicable law; (b) to respond to requests from courts, law enforcement agencies, regulatory agencies, and other public and government authorities; (d) to enforce our terms and conditions; and (e) to protect our rights, privacy, safety, or property, and/or that of our affiliates, you, or others.
Other Information We May Collect
“Other Information” is information that does not reveal your specific identity or does not directly relate to an identifiable individual, such as:
Browser and device information
Information collected through cookies, pixel tags, and other technologies
Demographic information and other information provided by you
Aggregated or de-identified information
If we are required to treat Other Information as Personal Information under applicable law or under our agreements with schools or other partners, then we may use it for the purposes for which we use and disclose Personal Information as detailed in this Policy.
How We May Collect Other Information
We and our third party service providers may collect Other Information in a variety of ways, including:
Through your browser or device: Certain information is collected by most browsers or automatically through your device, such as your Media Access Control (MAC) address, computer type (Windows or Macintosh), screen resolution, operating system name and version, device manufacturer and model, language, and Internet browser type and version. We use this information to ensure that the Site functions properly.
Using cookies: Cookies are pieces of information stored directly on the computer that you are using. Cookies allow us to collect information such as browser type, time spent on the Site, pages visited, language preferences, and other anonymous traffic data. We and our service providers use the information for security purposes, to facilitate navigation, to display information more effectively, to personalize your experience while using the Site, and to recognize your computer in order to assist your use of the Site. We also gather statistical information about use of the Site in order to continually improve its design and functionality, understand how it is used, and assist us with resolving questions about it. We do not currently respond to browser do-not-track signals.
Using pixel tags and other similar technologies: We may use pixel tags (also known as web beacons and clear GIFs) to, among other things, track the actions of Site users, measure the success of our marketing campaigns, and compile statistics about Site use.
IP Address: Your IP address is a number that is automatically assigned to the computer that you are using by your Internet Service Provider. An IP address may be identified and logged automatically in our server log files whenever a user accesses the Site, along with the time of the visit and the page(s) visited. Collecting IP addresses is standard practice and is done automatically by many websites, applications, and other services. We use IP addresses for purposes such as calculating usage levels, diagnosing server problems, and administering the Site. We may also derive your approximate location from your IP address.
From you: Information such as your age, gender, and school, and information about your family and your background, are collected when you voluntarily provide such information.
By aggregating or de-identifying information: Aggregated or de-identified Personal Information does not personally identify you (for example, we may aggregate Personal Information to calculate the percentage of our users who have a particular area code or we may aggregate what we have learned about students to report to their schools on overall student wellness).
How We May Use and Disclose Other Information
We may use and disclose Other Information for any purpose, except where we are required to do otherwise under applicable law or under our agreements with schools or other partners. In some instances, we may combine Other Information with Personal Information (such as combining your name with your age or school). If we do, we will treat the combined information as Personal Information as long as it is combined.
LINKS TO THIRD PARTY SERVICES
THIRD PARTY SERVICE PROVIDERS
MindRight has agreements in place with third parties service providers detailing our data privacy and security policies and expectations. We receive assurances from third parties that they are able to comply with these policies.
MindRight assesses the privacy and security policies and practices of all third party service providers we use to ensure that they are capable of complying with our guidelines and practices, including those related to ensuring the confidentiality, security, and integrity of student data, as well as transfer of students’ personally identifiable information to a school upon request or termination of an agreement and deletion of such data. We review third party service providers policies and practices relating to privacy and security on an annual basis and anytime our policies and practices change materially.
We seek to use reasonable organizational, technical, and administrative measures designed to protect Personal Information within our organization. Unfortunately, no data transmission or storage system can be guaranteed to be 100% secure. If you have reason to believe that your interaction with us is no longer secure, please immediately notify us in accordance with the “Contacting Us” section above.
Protecting Data Security
The security of your and your child’s personal information is important to us. To prevent unauthorized access, disclosure, or improper use of your information, and to maintain data accuracy, we've established physical, technical, and administrative safeguards to protect the personal information we collect. In particular:
We periodically review our information collection, storage and processing practices to guard against unauthorized access to systems.
MindRight’s database where we store your personal information is encrypted at rest, which converts all personal information stored in the database to an unintelligible form.
As an added measure of security, we ensure passwords are stored and transferred securely using encryption and salted hashing.
We restrict access to personal information to authorized Mindright employees, agents or independent contractors who need to know that information in order to process it for us, and who are subject to strict confidentiality obligations and may be disciplined or terminated if they fail to meet these obligations.
Data Breach Policy
If we learn of a security breach, we will attempt to notify you electronically (subject to any applicable laws) so that you can take appropriate protective steps; for example, we may post a notice on the getmindright Website or elsewhere on the Service, and may may notify you via the email address and/or mobile number you have provided to us. Depending on where you live, you may have a legal right to receive notice of a security breach in writing.
The school remains in direct control of students’ personally identifiable information during the term of a service agreement with the school. When a service agreement ends with a school and the student continues to use MindRight’s texting service, the student is in control of their personally identifiable information. We certify that a student’s records shall not be retained or available to MindRight upon completion of the terms of the Service Agreement unless any individual student wishes to continue using MindRight’s text-messaging service beyond the terms of the Service Agreement. Such certification will be enforced through the following procedure:
Deleting student personal information shared by the school to MindRight from our web app; and
De-identifying text message records to remove personal identifiable information from text-message data.
Student Data Retention Policy
We store your personal information for as long as it is necessary to provide products and Services to you and others, including those described above. Personal information associated with your account will be kept until your account is deleted, unless we no longer need the data to provide products and services.
We only keep a student’s personal information while the student’s account is active, unless we are required by law to retain it, need it to ensure the security of our users or our Service, or to enforce our Terms of Service. Please note that we may have to retain some information after your account is closed, to comply with legal obligations, to protect the safety and security of our users or our Service, or to prevent abuse of our Terms. You can request that your account be deleted at any time.
MindRight considers a student account to be inactive when any of the following conditions are satisfied:
It has been 13 months since MindRight stopped texting the student because the student did not respond to MindRight’s texts for 30 days straight, and the student did not text MindRight to resume coaching within the 13-month period
It has been 13 months since the student requested to stop getting texted or use MindRight’s service, and the student did not text MindRight to resume coaching within the 13-month period.
Once all these conditions are met, MindRight deletes any personal information tied to the student account, including the student's last name, device tokens, device identifiers and IP addresses, and text message records.
The student's age and testimonials about their user experience with MindRight that the student has approved for publication are not considered personal information and will not be removed.
CHOICES AND ACCESS
Your choices regarding our use of your Personal Information
If you are a user of our Service and no longer wish to receive text messages from us, please respond to our message with the word STOP.
How you can access, change or delete your Personal Information
If you would like to review, correct, update, or delete Personal Information that you have provided to us, you may contact us by email at email@example.com or by text message 886-866. In your request, please make clear what Personal Information you would like to have changed, whether you would like to have your Personal Information removed from our database, or otherwise let us know what limitations you would like to put on our use of your Personal Information. For your protection, we may only implement requests with respect to the Personal Information associated with the particular email address or phone number that you use to send us your request, and we may need to verify your identity before implementing your request. We will try to comply with your request as soon as reasonably practicable.
Please note that we may need to retain certain information for recordkeeping purposes. There may also be residual information that will remain within our databases and other records, which will not be removed.
Applicable law may require us to delete your Personal Information upon the request of the school through which you use the Service.
Accessing and managing student information by school partners
Student data obtained from a school partner continue to be the property of and under control of the school partner. The school partner retains full ownership rights to the student data it provides to MindRight.
MindRight will allow for inspection, review and amendment or changes to student data via an authorized request from a school. You may make such requests by contacting us at firstname.lastname@example.org or (202) 854-0068.
A school partner can request access to student personal information we have at any time. Information we will not share without the student’s permission, with the exception of when there is a safety risk to the student, includes the content of text messages sent and received by the student. In our school partnership model, we share with the school:
Real-time email or text alerts to the a designated point of contact (often a school social worker, psychologist, or counselor) when a student’s safety is at risk. In these alerts, we only include the student first initial and last name, and a brief summary of the situation with the student and how we are supporting the student. We inform the student that we are notifying their school.
Weekly data reports that share aggregate and individualized student survey results, summaries of support strategies we share with students, and individual daily moods of students on a standardized scale of 0-3. We do not share the actual contents of text messages students share with us.
USE OF THE SERVICE AND SITE BY MINORS
The Service and Site are not directed to individuals under the age of thirteen (13), and we request that they not provide Personal Information to us through the Service or Site.
The Service and Site are controlled and operated by us from the United States and are not intended to subject us to the laws or jurisdiction of any state, country, or territory other than those of the United States. Your Personal Information may be stored and processed in any country where we have facilities or in which we engage service providers, and, by using the Service or Site, you consent to the transfer of information to countries outside of your country of residence, including the United States, which may have data protection rules that are different from those of your country. In certain circumstances, courts, law enforcement agencies, regulatory agencies, or security authorities in those other countries may be entitled to access your personal information.
If we make material changes impacting the collection, use, disclosure, or retention of personal identifiable information, including protection thereof, we will also provide notice to our customers thirty (30) days in advance of implementing those changes by sending and email notification to the customer.
Last Revised: 5/22/18