Without an integration, almost every coaching session starts the same way:

1. The ninth grade lead runs a report from the SIS.
2. The report is exported to Excel.
3. The lead and coach add formulas to flag which students are failing one or two courses.

That routine eats 20 to 30 minutes of a 60-minute session. Half the hour goes to clerical work instead of kids, and the data is often a full grading period old by the time anyone acts on it.

District staff carry a burden too. Each quarter, CHSS asks a district data specialist to pull a large download and upload it to a secure location. That takes time from your most technical people, and the data is months old by the time it's used. Once your automated feed is running, none of that is manual: no emails, no one running reports for CHSS, no one handling files by hand.

This matters because the protocol depends on it. CHSS's own partner data shows that teams who run the Kid Talk protocol with fidelity are more than 70 percent more likely to hit their on-track goal, and a Kid Talk only works with current data in front of the team.

Student data flows securely from your SIS into CHSS Navigator, where CHSS builds the ninth grade dashboards your team uses. Teams stop building the data and start using it.

• Time back for kids. The 20 to 30 minutes once spent preparing data goes back to talking about students.
• Current data. Friday's data for Tuesday's conversation, not last quarter's.
• Accurate data. No manual exports or formulas means no copy errors or broken spreadsheets.
• Faster action. Teams spot students failing one or two courses and plan support in the same meeting.
• Visible progress. Teams can see whether each intervention is working and adjust before the next grading period.
• A view past ninth grade. As your cohort moves on, Navigator keeps following it: on-track persistence in 10th grade, CTE course sequences, dual credit, graduation. You see whether the ninth grade work held, and so does your board.
• End-of-year answers in June, not October. Automated feeds mean your on-track results are ready when you plan the next year, not after it has started.

Most districts run reports by hand because nobody has had the time to set up the alternative. The integration work we do together changes that:

• It costs your district nothing. The accelerator, the dashboard, and the integration work are fully subsidized for Year 0 and Year 1. The district's cost under the agreement is $0.
• We set it up with you, and stay until it works. CHSS technical staff meet with your data team, map your SIS exports to the Navigator format, and set up the feed. We stay with it until the feed passes acceptance, and we come back when your SIS, grading scale, or term structure changes. Most districts need two to four working sessions over a few weeks; your data person runs the export, we handle the mapping and the monitoring.
• A path to owning your data. If your district doesn't already keep a nightly copy of its SIS data in a place you control, the feed we build together is a first step, and we'll point you at the routes other districts have taken. Once you have it, every future partner, dashboard, and analysis gets easier, not just ours.
• Nothing to remember. Once the feed runs, no one on your staff runs a report for CHSS again. If a transfer fails, our system notices and we follow up.
• Clean records. You get an executed copy of every agreement, indexed, and a reminder before anything expires.

What we ask of your staff, honestly. A technical contact and a privacy contact named in the first two weeks. One onboarding call with both. The hours above to stand up the feed, more if your district needs the scheduled-upload route for a while. Nothing from your teachers beyond the ninth grade team work the accelerator already asks for. Data for your ninth grade cohort starts flowing in August 2027; the months before that are for getting the feed and the agreement in place.

SIS integration is governed by a data sharing agreement with your district and designed to meet FERPA and your state's student privacy requirements. CHSS will sign the National Data Privacy Agreement (NDPA), including your state's version, or provide its own appendix written to the same standard. Your student data remains your district's property, and your district decides who can see it.

• Only the data needed. CHSS receives student ID, name, grade level, course grades and credits, and attendance.
• Used for one purpose. Identifiable student information supports ninth grade success work in your schools and nothing else. CHSS keeps only de-identified and aggregate results to evaluate and improve the program.
• Deleted when you say so. When the partnership ends, or whenever you ask, identifiable data is destroyed and we certify it.

Student names live in Navigator for one reason: so the educators responsible for a student know who needs support and can act. Role-based permissions decide who can see them.

Records are matched using a consistent unique student identifier, so Navigator stays accurate as students change classes, schedules, and schools.

The District and the Center for High School Success ("CHSS"), a program of Stand for Children Leadership Center, Inc. ("Organization"), a nonprofit organization exempt under section 501(c)(3) of the Internal Revenue Code, share student data under this Agreement so that CHSS can provide ninth grade success coaching, the CHSS Navigator platform, and on-track analytics to the District's participating schools (the "Services").

In providing the Services, CHSS and Organization act as a "school official" with a "legitimate educational interest" under the Family Educational Rights and Privacy Act (FERPA), 34 C.F.R. § 99.31(a)(1)(i)(B). CHSS performs an institutional service for which the District would otherwise use its own employees, is under the District's direct control with respect to the use and maintenance of education records, and will not redisclose student data except as this Agreement permits. The District's disclosure of education records to CHSS for the Services does not require parental consent under FERPA when the conditions in this Section are met; notice and consent requirements that apply to the screeners are governed by Section 6.7. The District will confirm that its annual notification of FERPA rights includes, among the criteria for school officials with a legitimate educational interest, contractors and organizations to which the District has outsourced institutional services.

All handling of student data under this Agreement is governed by the CHSS Data Privacy and Security Appendix (Appendix A). At the District's election, the Parties will instead, or in addition, execute the Student Data Privacy Consortium's National Data Privacy Agreement (NDPA) in the version adopted in the District's state. Where the NDPA has been executed, the NDPA and its state exhibits control over Appendix A and over any other provision of this Agreement concerning student data. Where a district in the same state has already executed the NDPA with CHSS, the District may instead accept CHSS's General Offer of Privacy Terms (NDPA Exhibit E) and deliver notice of acceptance, with the same effect. If Appendix A conflicts with the body of this Agreement, Appendix A controls as to student data.

• Student Data means any information from the District's education records that identifies, or could be used to identify, a student, including the elements listed in Exhibit D-1. Student Data is Confidential Information.
• Screening Data means responses and scores from the CHSS Belonging Screener and Skills Screener administered to students at participating schools. Screening Data is Student Data.
• De-identified Data means Student Data or Screening Data from which all personally identifiable information has been removed in accordance with 34 C.F.R. § 99.31(b)(1), such that a reasonable person in the school community who does not have personal knowledge of the relevant circumstances could not identify the student.
• Aggregate Data means statistics computed across groups of students, with any group smaller than ten students suppressed.
• Navigator means the CHSS web platform through which the Services are delivered.
• School Team means the District employees at a participating school who are responsible for ninth grade students, as designated by the District.
• Coach means the CHSS employee assigned to support a participating school.
• Cohort means the ninth grade students enrolled at a participating school in a school year in which the Services are provided.

School Team members designated by the District may view student-level records, including names, for their school, to identify students, plan interventions, and monitor progress.

CHSS program, research, and leadership staff, and Organization staff, may view only De-identified Data and Aggregate Data, except that CHSS technical and security personnel designated under Appendix A.7 may access Student Data on a minimum-necessary basis to administer the platform, resolve data-feed problems, and investigate incidents, with every such access logged.

Coaches. In both options the Coach assigned to a participating school is a CHSS employee acting as a school official under Section 5.1, bound by Appendix A, trained annually in FERPA and privacy, under a confidentiality obligation, and subject to the personnel requirements in Appendix A.7. The District may revoke a Coach's access at any time by written notice. One of the following applies; the District's election is recorded in Exhibit D-3.

Option A (standing access). The Coach holds a Navigator login and may view student-level records, including names, for the schools the Coach supports, with every access logged.

Option B (in-session view; default). The Coach holds no Navigator login and no standing access to student-level records. The Coach views student-level records, including names, only during a coaching session, on the screen of a School Team member who is logged into Navigator, and does not retain, copy, or record them. Outside sessions the Coach works from Aggregate Data. The District may elect by written notice to convert a Coach to Option A for a school.

CHSS and Organization will use Student Data solely to provide the Services to the District. CHSS and Organization will not: (a) sell, rent, or trade Student Data; (b) use Student Data for targeted advertising or marketing to students, parents, or staff; (c) build a profile of a student for any purpose other than the Services; (d) use Student Data in any advocacy, lobbying, political, or fundraising activity of Organization or any affiliated entity, including any entity organized under section 501(c)(4); or (e) disclose Student Data to any third party other than a subprocessor listed in Appendix A, except as required by law.

CHSS may create and retain De-identified Data and Aggregate Data to evaluate and improve the program, including following Cohort outcomes over time. CHSS will not attempt to re-identify any student and will not publish any result that could identify a student or, without the District's written consent, the District.

On the District's written directive at any time, which may be given on the form in Exhibit D-4 or, where the NDPA applies, on NDPA Exhibit D, CHSS and Organization will return or destroy the Student Data specified within sixty days, on a schedule agreed with the District. Within sixty days after this Agreement ends, CHSS and Organization will destroy or return to the District all Student Data and Screening Data, including copies held by subprocessors, and will certify destruction in writing; copies in encrypted backups expire on the documented rotation, not to exceed ninety days, are never restored to production, and are certified as expired when that date passes. De-identified Data and Aggregate Data are not subject to this subsection.

CHSS will provide the District an executed copy of this Agreement and Appendix A within ten business days of signature, and written notice at least ninety days before this Agreement or Appendix A expires.

Successful implementation requires timely access to actionable data that allows School Teams, school leaders, the District, and CHSS to identify students needing support, monitor progress, compare outcomes, and assess the effectiveness of supports.

Within fifteen business days after signature, the District will designate (a) a technical contact responsible for the data feed, (b) a privacy contact (data privacy officer, technology director, or counsel) responsible for Appendix A, and (c) a program contact for each participating school, and will record them in Exhibit D-3. CHSS will schedule an onboarding call that includes the technical and privacy contacts before any Student Data is transferred.

The District will provide the elements marked Required in Exhibit D-1 for each Cohort, and may provide the elements marked Optional at its discretion. The District will provide data as it exists in its student information system; CHSS will report apparent errors to the technical contact and will not alter source data.

Student Data covers all ninth grade students at participating schools. For each Cohort, the District will continue to provide the Required elements for those students in subsequent school years through graduation or exit, for as long as this Agreement is in effect, so that on-track outcomes can be followed over time.

Each record will include the District's student identifier (and the state student identifier where available) so that records can be matched consistently across feeds and years. A District that prefers not to send its student identifier may instead send a stable pseudonymous identifier that it generates and maintains, provided the same identifier is used in every feed. Records carrying a pseudonymous identifier remain Student Data under this Agreement.

The District will choose one of the delivery tiers in Exhibit D-2. The target for every District is Tier 1 (automated feed) by the end of technical onboarding. Tier 2 (scheduled secure upload) is acceptable for a District that cannot yet automate, with CHSS support to move to Tier 1 when ready. Whatever the tier, the District will provide an initial load at onboarding and updates no later than two weeks after the end of each marking period, the school year, and summer school; weekly updates during the school year are strongly preferred so that coaching conversations use current data.

The District will notify CHSS at least thirty days before a change in student information system, grading scale, or term structure that would affect the feed.

The District will review the full content of the CHSS Belonging Screener and the Skills Screener, item by item, before either is administered, and will determine what parent notice, opt-out, or prior written consent is required by District policy, by the Protection of Pupil Rights Amendment (20 U.S.C. § 1232h), and by state law (in Arizona, A.R.S. §§ 15-104 and 15-117). CHSS will not open collection at a participating school until the District has authorized the instruments in writing and certified that any required notice has been given and any required consent is on file. The District administers the screeners through the School Team. CHSS will not add or change questions without the District's written approval and will provide each versioned instrument for that purpose. Screening Data is Student Data for all purposes of this Agreement.

The District will designate which School Team members receive Navigator logins and will notify CHSS within five business days when a user's role changes or ends. District users are responsible for safeguarding their credentials.

CHSS will provide technical assistance to the District's technical contact to establish the data feed, including the file specification and data dictionary, SIS-specific report instructions where CHSS has them, mapping of the District's exports to the specification, a cleanup script where needed, and working sessions until the feed passes the acceptance test in Exhibit D-3. After acceptance, CHSS will provide assistance when the District's student information system, grading scale, or term structure changes. CHSS will monitor the feed, notify the technical contact within one business day when a transfer fails or expected data is missing, and provide a validation report for each load that distinguishes rejected files, rejected rows, and warnings.

No Student Data is transferred before this Agreement and Appendix A (or the NDPA) are executed. During Year 0 the District will name its contacts, elect its delivery tier, and complete the mapping and acceptance test in Exhibit D-3; a test load of current-year data may be made after execution to validate the feed. The feed goes live for the ninth grade Cohort no later than [the first day of Year 1 instruction], and the Parties will complete acceptance by [thirty days before that date].

District Data/IT Liaison: [TO BE COMPLETED] · Privacy contact: [TO BE COMPLETED]

Onboarding milestones (January cohort)

Acceptance test. The feed passes acceptance when a complete load of the Required elements in D-1 for all participating schools is received by the elected tier, validated with no rejected files, with rejected rows and warnings below thresholds agreed in writing, and with on-track indicators reviewed by the District's technical contact against the District's own figures.

To be completed by the District and delivered to CHSS's privacy contact. CHSS will act within sixty days and certify completion in writing.

• Section Three, District agrees: replace "Make grades, attendance, and other agreed-upon key indicators available at least weekly in a user-friendly dashboard or other accessible format" and "Provide CHSS and participating school teams with timely, actionable data ... in accordance with Sections Six and Seven" with a single bullet: "Provide Student Data as described in Section Six and Exhibit D-1, through the delivery tier elected in Exhibit D-3."
• Section Three, CHSS agrees: replace "Protect Confidential Information and use student data only as permitted by this Agreement and applicable law" with "Protect Student Data as provided in Section Five and Appendix A, and provide the integration support described in Section 6.9."
• Section Eight: add after the certificate-of-insurance sentence: "Organization maintains cyber liability insurance of not less than $2,000,000 per claim, as further described in Appendix A." [Limit pending Stand's certificate; Decisions O7.]
• Section Eight, liability: the disclaimer of consequential damages and the cap at "applicable liability insurance proceeds" must be reconciled with Appendix A. Proposed: "The limitations in this Section do not apply to Organization's obligations under Appendix A, Sections A.4, A.8, and A.10, or to either Party's breach of confidentiality, [or: and Organization's liability for those obligations is limited to $[X]]." [Open decision for Jonah and counsel; Decisions O2.]
• Section Nine, Notices: add the privacy contact from Exhibit D-3 as a required notice recipient for matters under Appendix A.

The Center for High School Success (CHSS), a program of Stand for Children Leadership Center, Inc., will execute the Student Data Privacy Consortium's National Data Privacy Agreement (NDPA), including any state-specific version and exhibits adopted in the District's state, on request from any partner district or its privacy consortium. With the first executed NDPA in each state, CHSS will sign the General Offer of Privacy Terms (NDPA Exhibit E) and provide the originating district a standalone copy for the SDPC Resource Registry, so that other districts in that state may subscribe to the same terms by accepting Exhibit E and delivering notice of acceptance.

For purposes of the NDPA: the Provider is Stand for Children Leadership Center, Inc. (CHSS program); the Service is CHSS Navigator and the ninth grade success coaching it supports; Provider staff include CHSS coaches, who are bound by the agreement and trained accordingly. CHSS does not operate a student-facing application other than the Belonging and Skills screeners administered through the District's School Team.

Where a district does not use the NDPA, Appendix A (Part B) applies. Where a district has executed the NDPA, or accepted Exhibit E, the NDPA and its state exhibits control over Appendix A as to any conflict.

Terms defined in Sections Five and Six of the Agreement (Student Data, Screening Data, De-identified Data, Aggregate Data, Navigator, School Team, Coach, Cohort) have the same meaning here. Subprocessor means a third party that hosts or processes Student Data on CHSS's behalf.

CHSS receives Student Data solely to provide the Services described in the Agreement. The District designates CHSS as a school official with a legitimate educational interest under 34 C.F.R. § 99.31(a)(1)(i)(B). CHSS is under the District's direct control with respect to the use and maintenance of education records and is subject to the redisclosure limits of 34 C.F.R. § 99.33. CHSS will comply with FERPA; with the Protection of Pupil Rights Amendment (20 U.S.C. § 1232h) as it applies to screeners; with the Children's Online Privacy Protection Act (15 U.S.C. §§ 6501–6506) to the extent it applies; and with the student privacy laws of the District's state listed in the State Exhibit, as if CHSS were the District.

All Student Data and Screening Data, and all records CHSS creates or receives on the District's behalf, are and remain the property of the District. The District retains exclusive control over its Student Data, including who may access it and for what purposes. CHSS acquires no rights in Student Data other than the limited license to use it to provide the Services.

CHSS will use Student Data only to provide the Services and as instructed by the District. CHSS will not: (a) sell, rent, or trade Student Data; (b) use Student Data for targeted advertising or marketing to students, parents, or staff; (c) build a profile of a student for any purpose other than the Services; (d) use Student Data in any advocacy, lobbying, political, or fundraising activity of Stand for Children Leadership Center, Inc. or any affiliated entity, including any entity organized under section 501(c)(4); (e) disclose Student Data to any third party other than a Subprocessor listed under A.6, except as required by law and, where lawful, with prior notice to the District; or (f) share Student Data with any program partner, evaluator, funder, certifying body, or sponsor unless the recipient and the data shared are named in Exhibit D-3 of the Agreement and approved by the District in writing.

CHSS will collect only the elements listed in Exhibit D-1 of the Agreement and will not require the District to provide more data than is reasonably necessary to deliver the Services. CHSS will not request Social Security numbers, government identification numbers, payment information, or health records, and will receive disability-related status only where the District elects to provide it under Exhibit D-1. Changes to the element list require the District's written agreement.

CHSS uses the following Subprocessors, each bound by written terms at least as protective as this Appendix:

CHSS will give the District at least thirty days' written notice before adding or replacing a Subprocessor that will process Student Data. The District may object in writing, and the Parties will work in good faith to resolve the objection before the change takes effect. If the objection is not resolved before the change takes effect, the District may require CHSS to exclude its Student Data from the new Subprocessor, disable the affected feature for the District, or terminate the data provisions of the Agreement without penalty, and CHSS will return or destroy the District's Student Data under A.10.

CHSS does not share Student Data with any program partner, evaluator, funder, certifying body, or sponsor. Any such recipient must be named in Exhibit D-3 of the Agreement with the data to be shared and approved by the District in writing before any disclosure.

CHSS maintains a written information security program with administrative, technical, and physical safeguards appropriate to the sensitivity of Student Data, including at minimum:

• Encryption. Student Data is encrypted in transit (TLS 1.2 or higher) and at rest (AES-256 or equivalent). File transfers use SFTP or an HTTPS secure upload; email is never used to transfer Student Data.
• Access control. Role-based access on the principle of least privilege. Multi-factor authentication for all CHSS staff and administrator accounts. The identity of every person with access to Student Data is documented, reviewed at least quarterly, and removed within one business day of role change or separation.
• Logging. Access to student-level records is logged, including user, time, and record; logs are protected from alteration and retained for at least twelve months. On written request, CHSS will provide the District with log data for end-user, administrative, and maintenance activity relating to its Student Data.
• Passwords and sign-on. Stored passwords are salted and hashed; passwords are never visible to CHSS staff; single sign-on is supported for District users where the District elects it.
• Infrastructure. Production environments are segregated from the public internet by firewall and network controls; critical security patches are applied within seven days of release; anti-malware is current on all endpoints with access to Student Data; backups are encrypted and tested.
• Secure development. Changes to Navigator and the data platform go through code review and testing; secrets are managed in a vault, never in code.
• Personnel. All CHSS staff with access to Student Data, including Coaches, pass a background check before access is granted, complete privacy and security training at hire and annually, and sign confidentiality obligations. [Subject to CHSS confirmation of current practice; Decisions O5.]
• Authorized technical and security personnel. A small, named set of CHSS technical staff may access Student Data to administer the platform, resolve data-feed problems, and investigate incidents, on a minimum-necessary and time-limited basis, with multi-factor authentication, logging of every access, confidentiality obligations, and quarterly review of the roster. No other CHSS program, research, or leadership staff access identifiable Student Data.
• Independent assessment. CHSS undergoes an independent third-party assessment of its security controls at least annually (SOC 2 Type II or an equivalent independent audit) and an annual penetration test of Navigator and the data platform. Summaries are available to the District under A.13.
• Incident response. CHSS maintains and tests an incident response plan covering assessment, containment, evidence preservation, notification, recovery, documentation, and post-incident review.

If CHSS becomes aware of unauthorized access to, or acquisition, disclosure, or loss of, Student Data, whether or not it meets a statutory definition of breach (a "Breach"), CHSS will notify the District's privacy contact without unreasonable delay and in no event later than seventy-two hours after confirming the Breach, unless notification within that time would disrupt a law-enforcement investigation, by telephone and email, with the information then known: the nature of the Breach, a description of the Student Data involved, the students affected, steps taken to contain it, and a point of contact. CHSS will update the District as the investigation proceeds, cooperate fully, and comply with any breach-notification law applicable to the District's data. The District decides whether and how affected students and parents are notified; CHSS will not notify students, parents, or the public without first consulting the District, except where law requires otherwise. CHSS will bear the reasonable costs attributable to its Breach, including parent notification, credit monitoring where offered, forensic investigation, legal fees, and regulatory fines.

Student Data is stored and processed only in data centers located in the United States. CHSS will not transfer Student Data outside the United States without the District's prior written consent.

• During the term. CHSS retains Student Data only as long as needed to provide the Services.
• On request. On the District's written directive at any time, CHSS will return or destroy the Student Data specified within sixty days, on a schedule agreed with the District. The District may use the NDPA's Directive for Disposition of Data (Exhibit D) for this purpose with no further notice required.
• On termination. Within sixty days after the Agreement ends, CHSS will destroy or return to the District all Student Data and Screening Data, including copies held by Subprocessors, and will certify destruction in writing signed by an officer. Copies in encrypted backups expire on the documented rotation, not to exceed ninety days, are never restored to production, and are certified as expired when that date passes.
• De-identified and Aggregate Data. CHSS may create De-identified Data in accordance with NIST de-identification standards or U.S. Department of Education guidance, by removing direct and indirect identifiers and replacing the student identifier with a random token that is not derived from any student identifier or other personal information, under a key that CHSS destroys with the identifiable data. Aggregate Data is a subset of De-identified Data. CHSS may retain De-identified Data and Aggregate Data after termination to evaluate and improve the program, including following Cohort outcomes over time. CHSS will not attempt to re-identify any student and will not transfer De-identified Data to any third party other than a Subprocessor unless that party agrees in writing not to attempt re-identification and the District has given prior written consent. Aggregate Data will suppress any cell smaller than ten students.
• Research and publication. CHSS may publish findings based on De-identified Data and Aggregate Data. No publication will identify a student. CHSS will not identify the District in any publication without the District's prior written consent and will provide the District a copy of any report that includes the District's aggregate results at least fifteen business days before publication. The District may always see its own data.

Requests by a parent or eligible student to inspect, review, or correct education records are handled by the District. CHSS will support the District by providing, within ten business days of request, the Student Data it holds about the student, and will correct or delete data as the District directs.

CHSS uses automated and machine-learning tools within the data platform to assist with mapping incoming files to a common format, to flag data-quality problems, and to suggest interventions for the School Team's consideration. CHSS commits that: (a) neither CHSS nor any Subprocessor will use Student Data, De-identified Data, or any output derived from them to train, fine-tune, evaluate, or otherwise improve any machine-learning model, or to develop synthetic or inferred data for any purpose other than delivering the Services to the District; (b) the Services may generate student-specific inferences solely to deliver the Services, and such inferences are Student Data for all purposes of this Appendix; (c) each model provider is listed as a Subprocessor with the product tier used, the provider's data-use terms by URL and date, and the country of processing, is contractually prohibited from retaining or training on Student Data, and CHSS will provide the provider's written attestation on request; (d) intervention suggestions are recommendations for educators, who make all decisions about students, and are never the sole basis for any decision with a material effect on a student; (e) no Subprocessor personnel view prompts or outputs containing Student Data except as disclosed to the District in writing; (f) the District may request that AI-generated recommendations be disabled for its schools; (g) CHSS will give thirty days' written notice before adding or changing a model provider, and the District has the remedies in A.6; and (h) CHSS will complete the District's AI questionnaire (for example, Arizona NDPA Exhibit G) on request.

On request, not more than once per year unless a Breach has occurred, CHSS will provide the District with any of the following at the District's election: a completed security self-assessment, responses to the District's security questionnaire within thirty days, its most recent independent assessment report (SOC 2 Type II, SOC 3, or equivalent) and penetration test summary under a confidentiality agreement, a description of its security program, and a certificate of insurance. If the District's state law or policy requires an audit right, CHSS will cooperate with an on-site or remote audit at a mutually agreed time, conducted so as not to compromise other districts' data.

CHSS maintains, and will provide certificates on request for: cyber liability insurance of at least $2,000,000 per claim and in the aggregate, covering security and privacy liability, crisis management, network extortion, and media and content liability, maintained for two years after this Appendix ends; commercial general liability of $1,000,000 per occurrence and $2,000,000 aggregate; and professional errors and omissions liability of $1,000,000 per claim. These requirements may be met through a reasonable self-insurance program.

Screening Data is collected by CHSS only after the District has approved the instruments and provided any required notice under Section 6.7 of the Agreement. Screening Data is subject to every protection in this Appendix. Student-level screening results are visible to the School Team and to the Coach on the terms of the option elected under Section 5.4; CHSS program and research staff see only De-identified and Aggregate Screening Data.

This Appendix is coterminous with the Agreement and continues until all Student Data has been returned or destroyed under A.10. Sections A.3, A.4, A.8, A.10, and A.11 survive termination. The District may suspend data transfers and CHSS's access to its Student Data immediately, by notice to CHSS's privacy contact, when the District reasonably determines that suspension is necessary to protect Student Data, and may terminate the data provisions of the Agreement on thirty days' written notice if CHSS materially breaches this Appendix and does not cure within that period, or immediately for a breach that cannot be cured or that recurs.

This Appendix is governed by the laws of the District's state. The State Exhibit attached for the District's state sets out additional required terms, including: for Ohio, compliance with Ohio Revised Code 3319.321, 3319.325 through 3319.327, and Chapter 1347 (including breach notification under R.C. 1347.12) as if CHSS were the District, whether or not CHSS falls within the statutory definition of a technology provider; for California, the terms required by Education Code § 49073.1 and Business and Professions Code § 22584; for Arizona, Arizona NDPA Exhibit G including the AI questionnaire, and the screener consent requirements of A.R.S. §§ 15-104 and 15-117; and for Missouri, Massachusetts, Utah, and other states, the state NDPA exhibit where one exists.

If this Appendix conflicts with the Agreement, this Appendix controls as to Student Data. If the District has executed the NDPA with CHSS, the NDPA controls as to any conflict with this Appendix.

Readiness: each statement below is confirmed by CHSS's technology office before this page is shared with a district. Statements not yet confirmed carry a completion date in brackets.

Platform. CHSS Navigator is a web application delivered on Salesforce Experience Cloud, backed by a CHSS data platform on Microsoft Azure and Microsoft Fabric. All environments are hosted in United States regions.

How data moves.

1. The District transfers files (CSV, TXT, or Excel) to CHSS by SFTP on a schedule, or uploads them through the CHSS secure portal. Email is never used.
2. Files are virus-scanned and validated on receipt, mapped to a common data model, checked for quality (type, completeness, anomalies), and loaded to the data lake and warehouse with an audit record.
3. Student records are matched by the District's student identifier (and state identifier where provided). Probabilistic matching is used only to flag possible duplicates for human review, never to link records automatically.
4. On-track indicators, course-failure flags, and attendance measures are computed and published to Navigator for the School Team.
5. A separate de-identification step produces tokenized research datasets, which are the only datasets CHSS program and research staff use.

Who can see what. Role-based access in Navigator: school users see their school's students; district users see their district; Coaches hold no login and see student-level data only in sessions on a School Team member's screen (Option B), or hold a logged login to their schools where the District has elected Option A; a small, named set of CHSS technical staff have minimum-necessary, logged access to administer the platform and investigate incidents; CHSS program and research staff see de-identified and aggregate data only. Every access to a student-level record is logged.

Security controls.

• Encryption in transit (TLS 1.2 or higher) and at rest (AES-256).
• Multi-factor authentication for all CHSS accounts; single sign-on available for District users.
• Least-privilege, role-based access; documented access roster reviewed quarterly; access removed within one business day of separation.
• Access and administrative logging retained twelve months and available to the District on request.
• Production segregated from the internet by firewall and network controls; critical patches within seven days; anti-malware on all endpoints; encrypted, tested backups.
• Background checks and annual privacy training for all staff with access, including Coaches.
• Independent security assessment annually (SOC 2 Type II or equivalent) and an annual penetration test; summaries available on request. [First assessment scheduled for completion by: date.]
• Written, tested incident response plan; the District is notified within seventy-two hours of a confirmed breach.

Subprocessors. Microsoft (Azure, Fabric, Power BI), Salesforce (Experience Cloud, CRM Analytics), and [AI model provider]. All U.S.-hosted, all under written terms at least as protective as CHSS's agreement with the District. The District receives thirty days' notice of any change.

Artificial intelligence. Used for file-mapping assistance, data-quality checks, and intervention suggestions presented to educators. District data is never used to train models available to others. Recommendations can be disabled at the District's request.

Retention. Identifiable data is held only for the term of the agreement, destroyed or returned within sixty days of termination or of a written directive, with written certification; backups expire on a documented rotation of no more than ninety days. De-identified and aggregate data may be retained for program evaluation; no re-identification.

Insurance. Cyber liability $2,000,000 per claim and aggregate; general liability $1,000,000 per occurrence and $2,000,000 aggregate; professional errors and omissions $1,000,000. Certificates on request.

Agreements. CHSS signs the National Data Privacy Agreement (any state version) or provides Appendix A to the same standard, and provides an executed copy and a ninety-day expiration notice.

Answer each as true today, true by [date], or no:

1. Microsoft Azure / Fabric, Salesforce Experience Cloud and CRM Analytics, and Power BI are the complete subprocessor list for Student Data, and every tenant is in a U.S. region. (A.6, A.9)
2. The AI model provider: name, product tier or API, the data-use terms by URL and date, country of processing, and whether a zero-retention arrangement is enabled. (A.6, A.12)
3. No Student Data, de-identified data, or outputs are used to train or fine-tune any model, by CHSS or any subprocessor, and the provider will attest to that in writing on request. (A.12)
4. Access to student-level records is logged (user, time, record), logs are tamper-protected and kept twelve months, and a per-district export is possible. (A.7)
5. MFA on every CHSS staff and administrator account; SSO (SAML or OIDC) available to district users. (A.7, Part C)
6. Encryption in transit TLS 1.2 or higher and at rest AES-256 across the data lake, warehouse, Salesforce, Power BI, backups, and the SFTP landing zone. (A.7)
7. Critical security patches within seven days; anti-malware on all endpoints with access; firewall and network segregation of production; encrypted, tested backups. (A.7)
8. A documented access roster reviewed quarterly, with deprovisioning within one business day. (A.7)
9. A written, tested incident response plan that can meet seventy-two-hour district notification. (A.8)
10. Independent security assessment (SOC 2 Type II or equivalent) and annual penetration test: current status and the earliest honest completion date. (A.7, A.13, Part C)
11. A deletion runbook that returns or destroys a district's data within sixty days across every store, with backups expiring on a rotation of ninety days or less and never restored to production, and a certificate template. (5.6, A.10)
12. The de-identification step produces a random token not derived from any student identifier, with the key destroyed alongside identifiable data. (A.10)
13. Deterministic matching on district or state ID is the rule; probabilistic matching only flags duplicates for human review. (6.4, Part C)
14. Cell suppression below ten in every aggregate output and dashboard. (A.10)
15. Whether a Navigator tenant can run without student names, and which features would be off. (O9)
16. The December pilot: which schools, under which agreement, with what data. (O1)
17. Integration support: what "support until the feed passes acceptance" costs in staff time, and who staffs it. (6.9, O11)
18. The [AI model provider] and [First assessment scheduled for completion by: date] brackets in Part C are the only placeholders; everything else in Part C is claimed in the present tense and must be true or re-tensed.

1. Liability carve-out. Section Eight caps liability at insurance proceeds and disclaims consequential damages. Appendix A promises breach costs. Decide whether breach costs, confidentiality, and privacy indemnity sit outside the cap or under a super-cap. (O2)
2. The December pilot and the August 2027 start. Confirm that the January cohort commits to readiness in Year 0 and live data in Year 1, and that the pilot is existing partners on existing agreements. (O1)
3. Integration support through acceptance, not two sessions. It is the honest version of the "support you to do something" offer, and it is a cost line. (O11)
4. Signing any state NDPA and Exhibit E as a standing commitment. (O12)
5. Option B as default (in-session view) with Option A on district election, or the reverse after Tara weighs in. (M1)
6. Row-level de-identified retention for the longitudinal work, with the review process that goes with it. (O10)

1. Every person with access to Student Data, coaches included, passes a background check before access and completes privacy and security training at hire and annually. True today, or by when? (A.7, O5)
2. Cyber liability: current limit, aggregate, and whether a two-year tail is available. Drafted at $2,000,000. CGL $1,000,000 / $2,000,000 and E&O $1,000,000. (A.14, O7)
3. Stand for Children Leadership Center, Inc. is the correct 501(c)(3) signatory, and the no-advocacy clause in A.4(d) is acceptable as written. (O8)
4. Stand will sign the NDPA's standard clauses without redline, in any state. (O12)
5. The Section Eight liability language and the Appendix A promises are reconciled before Columbus sees the package. (O2)

1. The full text of the Belonging Screener and the Skills Screener, versioned, so counsel can classify each item against PPRA's protected areas and § 15-104. (O6)
2. Whether coaches can do the job with in-session view only, or need a standing login. (M1)
3. Which longitudinal analyses need row-level de-identified records rather than aggregate results. (O10)
4. Whether any Navigator feature depends on discipline data. (M3)

1. Change the one-pager's "Who sees what" row to match Option B as now defined: coaches hold no standing login and see student-level data only alongside your team. "Aggregate data only" is no longer accurate.
2. Replace "no emails, no manual pulls, no file transfers" with "no manual file handling once your automated feed is running."
3. Hold the Missouri reply until counsel confirms O12; if it goes sooner, drop the Exhibit E sentence.
4. Ask Columbus for a 45-minute slot Nov 2 to 4 with the CTO and their data-agreement reviewer; send the data summary, the file specification outline, the security page, and the screener instruments ahead of it.
5. Ask San Diego which instrument they use with outside partners that receive student-level data, without guessing the answer.

Thank you for getting this started, and for the clear summary. Your description is correct: the Center for High School Success uses information from your SIS to build the ninth grade dashboards your team uses, with our coach alongside, to identify students who need support and to act on it quickly. That is the purpose, and we operate as a school official under FERPA to deliver it.

One clarification so there are no surprises: like most programs, we evaluate whether our work is helping. We do that with de-identified and aggregate results only (for example, your school's on-track rate), never with identifiable student records, and we delete identifiable data when our partnership ends or whenever you ask.

We are glad to work through TEC and the SDPC process. We will sign the Missouri NDPA. [Pending counsel: and we expect to have a general offer of terms on file so other Missouri districts can use the same agreement.] When TEC reaches out, please have them contact Emily Phan, our Executive Technology Officer, who is copied here. Luke Allpress, who is helping us with agreement language and SIS integration, is also copied.

We will send you a short summary of exactly what data we ask for and how it moves before anyone has to review a document.

Here is what the integration involves, in plain terms. Your district sends us a file for each ninth grade cohort with student ID, name, grade level, course enrollments, course marks and credits by grading period, GPA, and attendance. Most districts set up an automated weekly export to our secure SFTP; if that is not possible yet, a scheduled upload each grading period works and we will help you automate it. Your school team sees student-level dashboards with names. Our coach has no login of their own and sees student-level data only in sessions with your team lead, unless you choose to give them more. Our program and research staff never see identifiable data. We also administer short belonging and skills screeners through your team, with your approval of the questions and whatever parent notice or consent your policy and state law require. Identifiable data is deleted when the partnership ends or whenever you ask; we keep only de-identified and aggregate results to evaluate the program. The full terms are in our data privacy appendix, or we will sign your state's NDPA, whichever you prefer.

1. Forty-five minutes with the CTO and whoever reviews data agreements, between Nov 2 and Nov 4, with Luke on the call.
2. Confirmation that the 3/17/2025 agreement is the current form, and whether the district would also accept the Ohio NDPA.
3. Their read, before the call, on coach access (Option A versus B) and on CHSS keeping de-identified results after termination.
4. Anything the district requires of CHSS coaches beyond the agreement (background checks, onboarding, training).
5. The board timeline from "agreement final" to "approved."
6. Send ahead: the data summary, the file specification outline, the security page, and the screener instruments.

1. Which agreement SDUSD uses with outside partners that receive student-level data.
2. Who signs it, and whether the General Services Agreement and SOW format will be required.
3. The same two substantive points as Columbus.

Because the accelerator includes SIS integration, we will ask you within the first two weeks to name a technical contact and a data privacy contact, and we will schedule a short onboarding call with both before any data moves. We will sign your state's National Data Privacy Agreement or provide our own privacy appendix written to the same standard, whichever your district prefers. Data for your ninth grade cohort begins flowing in August 2027; the months before that are for getting the feed and the agreement in place.

Why it is first. The new cohort is not sharing student data in December. It is committing to be ready by August 2027. If the drafts or the pitch imply otherwise, every district counsel will stop at the calendar. Exhibit D-3 now says: contacts named in January, agreement routed and signed in Year 0, test load after signature, live feed before Year 1 instruction. What has to be decided, before the Summit: the December pilot runs on which schools, under which agreement, with what data. The safe answer is existing partners, existing agreements, de-identified uploads as today.

Recommendation. Carve breach costs under A.8, confidentiality, and privacy indemnity out of the Section Eight cap, or give them a super-cap of not less than the cyber limit. Add a mutual indemnity for each party's own acts in the data provisions. This is Jonah's call because it is money, and counsel's because it is drafting.

Recommendation. Emily returns the subprocessor table filled in, and a line-by-line "true today / true by date" against Part C. Part C is published in present tense only for lines marked true today.

Recommendation. Demian confirms current practice for coaches and technical staff. If not current, the clause becomes "by [date]" and Option A is withheld until then.

Recommendation. Tara supplies the instruments and the program purpose; Stand counsel classifies each against PPRA's protected areas and § 15-104; the agreement makes collection contingent on the district's written authorization and certification that any required consent is on file.

Recommendation. Emily answers whether a tenant can operate without names and which Navigator features would be off. If yes, Exhibit D-3 gets a pseudonymous election and the agreement says what the district loses. If no, the fallback is removed from the pitch.

Recommendation. Keep row-level de-identified retention, because the longitudinal cohort work needs it, and pair it with the reasonable-determination review now in A.10. Tara and Jonah confirm the analyses so the clause can describe them.

Recommendation. Counsel confirms Stand will sign any state NDPA as drafted (standard clauses cannot be redlined) and will sign Exhibit E. Until then, the Missouri reply omits the Exhibit E sentence.

What would reverse it: Tara saying coaches cannot do the job without their own login, in which case Option A becomes the default and Option B the fallback. The clause supports either.