Privacy Policy

Last updated: June 8, 2026

1. Who We Are

CalmIQ Pro is operated by CalmIQ Pro LLC, a Washington State limited liability company. We provide a behavioral observation and communication platform for special education classrooms, designed to support neurodivergent students.

Contact: privacy@calmiqpro.com

2. Information We Collect

School Staff (Teachers, BCBAs, Administrators)

Name, email address, school affiliation, role, and behavioral observation data entered through the app.

Parents and Guardians

Email address, morning check-in submissions, and communications related to their linked child.

Student Data

Behavioral observations, emotional check-ins, meal logs, bathroom logs, and ABC data. Student data is entered by school staff and is associated with the school's account — not collected directly from students.

3. How We Use Your Information

  • To provide the CalmIQ Pro service — logging observations, generating AI reports, and facilitating school-to-family communication.
  • To send push notifications and email reports to parents regarding their child's school day.
  • To generate AI-powered daily summaries using anonymized observation data.
  • To authenticate users and maintain account security.
  • We do not sell your data to third parties. We do not use student data for advertising purposes.

4. Student Privacy (FERPA & COPPA)

CalmIQ Pro complies with the Family Educational Rights and Privacy Act (FERPA, 34 CFR Part 99). Student data entered into the platform is treated as education records owned and controlled by the school. CalmIQ Pro accesses this data solely as a "school official" with a legitimate educational interest, under the direct control of the school, and uses it only to provide the platform.

We commit that we will never sell student data, use it for targeted advertising, or build a commercial profile of a student. Personally identifiable student information is never used to train third-party AI models — student names and identifiers are removed before any data is sent for AI report generation.

Parental rights: FERPA gives parents the right to inspect, review, and request correction of their child's education records. We support schools in fulfilling these requests by providing exportable records within 30 days and enabling authorized staff to correct entries. Requests received directly by CalmIQ Pro are directed to the school, which remains responsible for responding.

Schools are responsible for obtaining any parental consent required under FERPA or applicable state law before recording information about students. We do not knowingly collect personal information directly from children under 13; all student data is entered by authorized school personnel. Upon termination or school request, we return or securely destroy all education records.

5. Data Storage & Security

Data is stored securely using Google Firebase (Firestore) and AWS Cognito, both of which maintain SOC 2 compliance. Data is encrypted in transit (TLS) and at rest. Access is restricted by role-based security rules — teachers can only access their school's data, parents can only access their linked child's data.

The following technical safeguards are in place in compliance with HIPAA §164.312:

  • Automatic logoff: The web dashboard automatically signs out users after 30 minutes of inactivity, with a 5-minute warning before logout.
  • Role-based access control: Teachers are assigned to specific classrooms by administrators and can only access data for students in their classroom. Parents can only view their linked child's data.
  • Multi-factor authentication: All accounts — teachers, administrators, and parents — require MFA (authenticator app or passkey) on every sign-in.
  • Audit controls: All observations, reports, and data access are timestamped and associated with the authenticated user.
  • Encryption: All data is encrypted in transit using TLS 1.2+ and encrypted at rest.

6. Data Sharing

We share data only with the following service providers necessary to operate CalmIQ Pro:

  • Google Firebase (Firestore) — database, under a signed Business Associate Agreement
  • AWS Cognito — authentication with required MFA, under a signed Business Associate Agreement
  • Anthropic (Claude API) — AI report generation. Student names and identifiers are removed before any data is sent; the de-identified data is not stored or used for training
  • Expo — push notification delivery
  • Vercel — web application hosting (no student records stored)

7. Data Retention

Observation data and daily reports are retained for the duration of the school's active account. Upon account deletion, data is permanently removed within 30 days. Parents may request deletion of their linked data at any time by contacting us.

8. Your Rights

You have the right to access, correct, or request deletion of your personal information. To exercise these rights, contact us at privacy@calmiqpro.com. Schools may also manage student data directly through the CalmIQ Pro dashboard.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify users of material changes via email or in-app notification. Continued use of the service after changes constitutes acceptance of the updated policy.

10. Contact Us

CalmIQ Pro LLC
Washington State, United States
privacy@calmiqpro.com