Without an integration, almost every coaching session starts the same way:

1. The ninth grade lead runs a report from the SIS.
2. The report is exported to Excel.
3. The lead and coach add formulas to flag which students are failing one or two courses.

That routine eats 20 to 30 minutes of a 60-minute session. Half the hour goes to clerical work instead of kids, and the data is often a full grading period old by the time anyone acts on it.

District staff carry a burden too. Each quarter, CHSS asks a district data specialist to pull a large download and upload it to a secure location. That takes time from your most technical people, and the data is months old by the time it's used. SIS integration makes all of it automatic: no emails, no manual pulls, no file transfers.

Student data flows securely from your SIS into CHSS Navigator, where CHSS builds the ninth grade dashboards your team uses. Teams stop building the data and start using it.

• Time back for kids. The 20 to 30 minutes once spent preparing data goes back to talking about students.
• Current data. Friday's data for Tuesday's conversation, not last quarter's.
• Accurate data. No manual exports or formulas means no copy errors or broken spreadsheets.
• Faster action. Teams spot students failing one or two courses and plan support in the same meeting.
• Visible progress. Teams can see whether each intervention is working and adjust before the next grading period.
• A view past ninth grade. As your cohort moves on, Navigator keeps following it: on-track persistence in 10th grade, CTE course sequences, dual credit, graduation. You see whether the ninth grade work held, and so does your board.
• End-of-year answers in June, not October. Automated feeds mean your on-track results are ready when you plan the next year, not after it has started.

Most districts run reports by hand because nobody has had the time to set up the alternative. The integration work we do together changes that:

• We set it up with you. CHSS technical staff meet with your data team, map your SIS exports to the Navigator format, and set up the automated feed. For most districts this is two working sessions.
• You own your data. If your district doesn't already keep a nightly copy of its SIS data in a place you control, we'll help you get there. Once you have it, every future partner, dashboard, and analysis gets easier, not just ours.
• Nothing to remember. Once the feed runs, no one on your staff runs a report for CHSS again. If a transfer fails, our system notices and we follow up.
• Clean records. You get an executed copy of every agreement, indexed, and a reminder before anything expires.

SIS integration is governed by a data sharing agreement with your district and designed to meet FERPA and your state's student privacy requirements. CHSS will sign the National Data Privacy Agreement (NDPA), including your state's version, or provide its own appendix written to the same standard. Your student data remains your district's property, and your district decides who can see it.

• Only the data needed. CHSS receives student ID, name, grade level, course grades and credits, and attendance.
• Used for one purpose. Identifiable student information supports ninth grade success work in your schools and nothing else. CHSS keeps only de-identified and aggregate results to evaluate and improve the program.
• Deleted when you say so. When the partnership ends, or whenever you ask, identifiable data is destroyed and we certify it.

Student names live in Navigator for one reason: so the educators responsible for a student know who needs support and can act. Role-based permissions decide who can see them.

Records are matched using a consistent unique student identifier, so Navigator stays accurate as students change classes, schedules, and schools.

The District and the Center for High School Success ("CHSS"), a program of Stand for Children Leadership Center, Inc. ("Organization"), a nonprofit organization exempt under section 501(c)(3) of the Internal Revenue Code, share student data under this Agreement so that CHSS can provide ninth grade success coaching, the CHSS Navigator platform, and on-track analytics to the District's participating schools (the "Services").

In providing the Services, CHSS and Organization act as a "school official" with a "legitimate educational interest" under the Family Educational Rights and Privacy Act (FERPA), 34 C.F.R. § 99.31(a)(1)(i)(B). CHSS performs an institutional service for which the District would otherwise use its own employees, is under the District's direct control with respect to the use and maintenance of education records, and will not redisclose student data except as this Agreement permits. The Services do not require parental consent under FERPA. The District will confirm that its annual notification of FERPA rights includes, among the criteria for school officials with a legitimate educational interest, contractors and organizations to which the District has outsourced institutional services.

All handling of student data under this Agreement is governed by the CHSS Data Privacy and Security Appendix (Appendix A). At the District's election, the Parties will instead, or in addition, execute the Student Data Privacy Consortium's National Data Privacy Agreement (NDPA) in the version adopted in the District's state, in which case the NDPA controls as to any conflict with Appendix A. If Appendix A conflicts with the body of this Agreement, Appendix A controls as to student data.

• Student Data means any information from the District's education records that identifies, or could be used to identify, a student, including the elements listed in Exhibit D-1. Student Data is Confidential Information.
• Screening Data means responses and scores from the CHSS Belonging Screener and Skills Screener administered to students at participating schools. Screening Data is Student Data.
• De-identified Data means Student Data or Screening Data from which all personally identifiable information has been removed in accordance with 34 C.F.R. § 99.31(b)(1), such that a reasonable person in the school community who does not have personal knowledge of the relevant circumstances could not identify the student.
• Aggregate Data means statistics computed across groups of students, with any group smaller than ten students suppressed.
• Navigator means the CHSS web platform through which the Services are delivered.
• School Team means the District employees at a participating school who are responsible for ninth grade students, as designated by the District.
• Coach means the CHSS employee assigned to support a participating school.
• Cohort means the ninth grade students enrolled at a participating school in a school year in which the Services are provided.

School Team members designated by the District may view student-level records, including names, for their school, to identify students, plan interventions, and monitor progress.

CHSS program, research, and leadership staff, and Organization staff, may view only De-identified Data and Aggregate Data.

Coaches. One of the following applies; the District's election is recorded in Exhibit D-3.

Option A (coach has student-level access). The Coach assigned to a participating school may view student-level records, including names, for that school only, to support the School Team. Coaches are CHSS employees bound by Appendix A, complete annual FERPA and privacy training, have passed a background check, and are subject to the same access logging as District users. The District may revoke a Coach's access at any time by written notice.

Option B (coach has aggregate access; default). Coaches view Aggregate Data for the schools they support. During coaching sessions, a School Team member logged into Navigator shares the student-level view. Coaches do not hold student-level logins. The District may elect by written notice to grant a Coach student-level access for a school, in which case the conditions in Option A apply.

CHSS and Organization will use Student Data solely to provide the Services to the District. CHSS and Organization will not: (a) sell, rent, or trade Student Data; (b) use Student Data for targeted advertising or marketing to students, parents, or staff; (c) build a profile of a student for any purpose other than the Services; (d) use Student Data in any advocacy, lobbying, political, or fundraising activity of Organization or any affiliated entity, including any entity organized under section 501(c)(4); or (e) disclose Student Data to any third party other than a subprocessor listed in Appendix A, except as required by law.

CHSS may create and retain De-identified Data and Aggregate Data to evaluate and improve the program, including following Cohort outcomes over time. CHSS will not attempt to re-identify any student and will not publish any result that could identify a student or, without the District's written consent, the District.

On the District's written directive at any time, CHSS and Organization will return or destroy the Student Data specified within sixty days, on a schedule agreed with the District. Within sixty days after this Agreement ends, CHSS and Organization will destroy or return to the District all Student Data and Screening Data, including copies held by subprocessors, and will certify destruction in writing; copies in encrypted backups expire on the documented rotation, not to exceed ninety days, are never restored to production, and are certified as expired when that date passes. De-identified Data and Aggregate Data are not subject to this subsection.

CHSS will provide the District an executed copy of this Agreement and Appendix A within ten business days of signature, and written notice at least ninety days before this Agreement or Appendix A expires.

Successful implementation requires timely access to actionable data that allows School Teams, school leaders, the District, and CHSS to identify students needing support, monitor progress, compare outcomes, and assess the effectiveness of supports.

Within fifteen business days after signature, the District will designate (a) a technical contact responsible for the data feed, (b) a privacy contact (data privacy officer, technology director, or counsel) responsible for Appendix A, and (c) a program contact for each participating school, and will record them in Exhibit D-3. CHSS will schedule an onboarding call that includes the technical and privacy contacts before any Student Data is transferred.

The District will provide the elements marked Required in Exhibit D-1 for each Cohort, and may provide the elements marked Optional at its discretion. The District will provide data as it exists in its student information system; CHSS will report apparent errors to the technical contact and will not alter source data.

Student Data covers all ninth grade students at participating schools. For each Cohort, the District will continue to provide the Required elements for those students in subsequent school years through graduation or exit, for as long as this Agreement is in effect, so that on-track outcomes can be followed over time.

Each record will include the District's student identifier (and the state student identifier where available) so that records can be matched consistently across feeds and years. A District that prefers not to send its student identifier may instead send a stable pseudonymous identifier that it generates and maintains, provided the same identifier is used in every feed. Records carrying a pseudonymous identifier remain Student Data under this Agreement.

The District will choose one of the delivery tiers in Exhibit D-2. The target for every District is Tier 1 (automated feed) by the end of technical onboarding. Tier 2 (scheduled secure upload) is acceptable for a District that cannot yet automate, with CHSS support to move to Tier 1 when ready. Whatever the tier, the District will provide an initial load at onboarding and updates no later than two weeks after the end of each marking period, the school year, and summer school; weekly updates during the school year are strongly preferred so that coaching conversations use current data.

The District will notify CHSS at least thirty days before a change in student information system, grading scale, or term structure that would affect the feed.

The District will review and approve the CHSS Belonging Screener and Skills Screener before they are administered; will provide any parent notice, opt-out, or written consent required by District policy, by the Protection of Pupil Rights Amendment (20 U.S.C. § 1232h), or by state law; and will administer the screeners through the School Team. CHSS will provide the full content of each screener to the District for that review and will not add questions without the District's approval. Screening Data is Student Data for all purposes of this Agreement.

The District will designate which School Team members receive Navigator logins and will notify CHSS within five business days when a user's role changes or ends. District users are responsible for safeguarding their credentials.

CHSS will provide technical assistance to the District's technical contact to establish the data feed, including documentation of the file specification, mapping of the District's exports to it, a cleanup script where needed, and up to two working sessions. CHSS will monitor the feed and notify the technical contact when a transfer fails or expected data is missing.

The District will complete technical onboarding, including a successful initial load, by [end of Year 0 month 2], so that the Services are fully operational before [the first day of Year 1 instruction].

District Data/IT Liaison: [TO BE COMPLETED] · Privacy contact: [TO BE COMPLETED]

• Section Three, District agrees: replace "Make grades, attendance, and other agreed-upon key indicators available at least weekly in a user-friendly dashboard or other accessible format" and "Provide CHSS and participating school teams with timely, actionable data ... in accordance with Sections Six and Seven" with a single bullet: "Provide Student Data as described in Section Six and Exhibit D-1, through the delivery tier elected in Exhibit D-3."
• Section Three, CHSS agrees: replace "Protect Confidential Information and use student data only as permitted by this Agreement and applicable law" with "Protect Student Data as provided in Section Five and Appendix A, and provide the integration support described in Section 6.9."
• Section Eight: add after the certificate-of-insurance sentence: "Organization maintains cyber liability insurance of not less than $2,000,000 per claim, as further described in Appendix A."
• Section Nine, Notices: add the privacy contact from Exhibit D-3 as a required notice recipient for matters under Appendix A.

The Center for High School Success (CHSS), a program of Stand for Children Leadership Center, Inc., will execute the Student Data Privacy Consortium's National Data Privacy Agreement (NDPA), including any state-specific version and exhibits adopted in the District's state, on request from any partner district or its privacy consortium. With the first executed NDPA in each state, CHSS will sign the General Offer of Privacy Terms (NDPA Exhibit E) and provide the originating district a standalone copy for the SDPC Resource Registry, so that other districts in that state may subscribe to the same terms by accepting Exhibit E and delivering notice of acceptance.

For purposes of the NDPA: the Provider is Stand for Children Leadership Center, Inc. (CHSS program); the Service is CHSS Navigator and the ninth grade success coaching it supports; Provider staff include CHSS coaches, who are bound by the agreement and trained accordingly. CHSS does not operate a student-facing application other than the Belonging and Skills screeners administered through the District's School Team.

Where a district does not use the NDPA, Appendix A (Part B) applies. Where a district uses both, the document the district signed controls.

Terms defined in Sections Five and Six of the Agreement (Student Data, Screening Data, De-identified Data, Aggregate Data, Navigator, School Team, Coach, Cohort) have the same meaning here. Subprocessor means a third party that hosts or processes Student Data on CHSS's behalf.

CHSS receives Student Data solely to provide the Services described in the Agreement. The District designates CHSS as a school official with a legitimate educational interest under 34 C.F.R. § 99.31(a)(1)(i)(B). CHSS is under the District's direct control with respect to the use and maintenance of education records and is subject to the redisclosure limits of 34 C.F.R. § 99.33. CHSS will comply with FERPA; with the Protection of Pupil Rights Amendment (20 U.S.C. § 1232h) as it applies to screeners; with the Children's Online Privacy Protection Act (15 U.S.C. §§ 6501–6506) to the extent it applies; and with the student privacy laws of the District's state listed in the State Exhibit, as if CHSS were the District.

All Student Data and Screening Data, and all records CHSS creates or receives on the District's behalf, are and remain the property of the District. The District retains exclusive control over its Student Data, including who may access it and for what purposes. CHSS acquires no rights in Student Data other than the limited license to use it to provide the Services.

CHSS will use Student Data only to provide the Services and as instructed by the District. CHSS will not: (a) sell, rent, or trade Student Data; (b) use Student Data for targeted advertising or marketing to students, parents, or staff; (c) build a profile of a student for any purpose other than the Services; (d) use Student Data in any advocacy, lobbying, political, or fundraising activity of Stand for Children Leadership Center, Inc. or any affiliated entity, including any entity organized under section 501(c)(4); (e) disclose Student Data to any third party other than a Subprocessor listed under A.6, except as required by law and, where lawful, with prior notice to the District; or (f) share Student Data with any program partner, evaluator, funder, certifying body, or sponsor unless the recipient and the data shared are named in Exhibit D-3 of the Agreement and approved by the District in writing.

CHSS will collect only the elements listed in Exhibit D-1 of the Agreement and will not require the District to provide more data than is reasonably necessary to deliver the Services. CHSS will not request Social Security numbers, government identification numbers, payment information, or health records, and will receive disability-related status only where the District elects to provide it under Exhibit D-1. Changes to the element list require the District's written agreement.

CHSS uses the following Subprocessors, each bound by written terms at least as protective as this Appendix:

CHSS will give the District at least thirty days' written notice before adding or replacing a Subprocessor that will process Student Data. The District may object in writing, and the Parties will work in good faith to resolve the objection before the change takes effect.

CHSS maintains a written information security program with administrative, technical, and physical safeguards appropriate to the sensitivity of Student Data, including at minimum:

• Encryption. Student Data is encrypted in transit (TLS 1.2 or higher) and at rest (AES-256 or equivalent). File transfers use SFTP or an HTTPS secure upload; email is never used to transfer Student Data.
• Access control. Role-based access on the principle of least privilege. Multi-factor authentication for all CHSS staff and administrator accounts. The identity of every person with access to Student Data is documented, reviewed at least quarterly, and removed within one business day of role change or separation.
• Logging. Access to student-level records is logged, including user, time, and record; logs are protected from alteration and retained for at least twelve months. On written request, CHSS will provide the District with log data for end-user, administrative, and maintenance activity relating to its Student Data.
• Passwords and sign-on. Stored passwords are salted and hashed; passwords are never visible to CHSS staff; single sign-on is supported for District users where the District elects it.
• Infrastructure. Production environments are segregated from the public internet by firewall and network controls; critical security patches are applied within seven days of release; anti-malware is current on all endpoints with access to Student Data; backups are encrypted and tested.
• Secure development. Changes to Navigator and the data platform go through code review and testing; secrets are managed in a vault, never in code.
• Personnel. All CHSS staff with access to Student Data, including Coaches, pass a background check before access is granted, complete privacy and security training at hire and annually, and sign confidentiality obligations.
• Independent assessment. CHSS undergoes an independent third-party assessment of its security controls at least annually (SOC 2 Type II or an equivalent independent audit) and an annual penetration test of Navigator and the data platform. Summaries are available to the District under A.13.
• Incident response. CHSS maintains and tests an incident response plan covering assessment, containment, evidence preservation, notification, recovery, documentation, and post-incident review.

If CHSS becomes aware of unauthorized access to, or acquisition, disclosure, or loss of, Student Data, whether or not it meets a statutory definition of breach (a "Breach"), CHSS will notify the District's privacy contact without unreasonable delay and in no event later than seventy-two hours after confirming the Breach, unless notification within that time would disrupt a law-enforcement investigation, by telephone and email, with the information then known: the nature of the Breach, a description of the Student Data involved, the students affected, steps taken to contain it, and a point of contact. CHSS will update the District as the investigation proceeds, cooperate fully, and comply with any breach-notification law applicable to the District's data. The District decides whether and how affected students and parents are notified; CHSS will not notify students, parents, or the public without first consulting the District, except where law requires otherwise. CHSS will bear the reasonable costs attributable to its Breach, including parent notification, credit monitoring where offered, forensic investigation, legal fees, and regulatory fines.

Student Data is stored and processed only in data centers located in the United States. CHSS will not transfer Student Data outside the United States without the District's prior written consent.

• During the term. CHSS retains Student Data only as long as needed to provide the Services.
• On request. On the District's written directive at any time, CHSS will return or destroy the Student Data specified within sixty days, on a schedule agreed with the District. The District may use the NDPA's Directive for Disposition of Data (Exhibit D) for this purpose with no further notice required.
• On termination. Within sixty days after the Agreement ends, CHSS will destroy or return to the District all Student Data and Screening Data, including copies held by Subprocessors, and will certify destruction in writing signed by an officer. Copies in encrypted backups expire on the documented rotation, not to exceed ninety days, are never restored to production, and are certified as expired when that date passes.
• De-identified and Aggregate Data. CHSS may create De-identified Data in accordance with NIST de-identification standards or U.S. Department of Education guidance, by removing direct and indirect identifiers and replacing the student identifier with a random token that is not derived from any student identifier or other personal information, under a key that CHSS destroys with the identifiable data. Aggregate Data is a subset of De-identified Data. CHSS may retain De-identified Data and Aggregate Data after termination to evaluate and improve the program, including following Cohort outcomes over time. CHSS will not attempt to re-identify any student and will not transfer De-identified Data to any third party other than a Subprocessor unless that party agrees in writing not to attempt re-identification and the District has given prior written consent. Aggregate Data will suppress any cell smaller than ten students.
• Research and publication. CHSS may publish findings based on De-identified Data and Aggregate Data. No publication will identify a student. CHSS will not identify the District in any publication without the District's prior written consent and will provide the District a copy of any report that includes the District's aggregate results at least fifteen business days before publication. The District may always see its own data.

Requests by a parent or eligible student to inspect, review, or correct education records are handled by the District. CHSS will support the District by providing, within ten business days of request, the Student Data it holds about the student, and will correct or delete data as the District directs.

CHSS uses automated and machine-learning tools within the data platform to assist with mapping incoming files to a common format, to flag data-quality problems, and to suggest interventions for the School Team's consideration. CHSS commits that: (a) Student Data, De-identified Data, and any outputs derived from them will not be used for training purposes or to develop synthetic or inferred data, by CHSS or by any Subprocessor, except a model used solely to deliver the Services and identified in A.6; (b) each model provider is listed as a Subprocessor with the product tier used, the provider's data-use terms by URL and date, and the country of processing, and is contractually prohibited from retaining or training on Student Data, with CHSS providing the provider's written attestation on request; (c) outputs that describe an identifiable student are Student Data for all purposes of this Appendix; (d) intervention suggestions are recommendations for educators, who make all decisions about students, and are never the sole basis for any decision with a material effect on a student; (e) no Subprocessor personnel view prompts or outputs containing Student Data except as disclosed to the District in writing; (f) the District may request that AI-generated recommendations be disabled for its schools; (g) CHSS will give thirty days' written notice before adding or changing a model provider, and the District may object under A.6; and (h) CHSS will complete the District's AI questionnaire (for example, Arizona NDPA Exhibit G) on request.

On request, not more than once per year unless a Breach has occurred, CHSS will provide the District with any of the following at the District's election: a completed security self-assessment, responses to the District's security questionnaire within thirty days, its most recent independent assessment report (SOC 2 Type II, SOC 3, or equivalent) and penetration test summary under a confidentiality agreement, a description of its security program, and a certificate of insurance. If the District's state law or policy requires an audit right, CHSS will cooperate with an on-site or remote audit at a mutually agreed time, conducted so as not to compromise other districts' data.

CHSS maintains, and will provide certificates on request for: cyber liability insurance of at least $2,000,000 per claim and in the aggregate, covering security and privacy liability, crisis management, network extortion, and media and content liability, maintained for two years after this Appendix ends; commercial general liability of $1,000,000 per occurrence and $2,000,000 aggregate; and professional errors and omissions liability of $1,000,000 per claim. These requirements may be met through a reasonable self-insurance program.

Screening Data is collected by CHSS only after the District has approved the instruments and provided any required notice under Section 6.7 of the Agreement. Screening Data is subject to every protection in this Appendix. Student-level screening results are visible to the School Team and, under Option A of Section 5.4, to the Coach; CHSS program and research staff see only De-identified and Aggregate Screening Data.

This Appendix is coterminous with the Agreement and continues until all Student Data has been returned or destroyed under A.10. Sections A.3, A.4, A.8, A.10, and A.11 survive termination. The District may terminate the data provisions of the Agreement on thirty days' written notice if CHSS materially breaches this Appendix and does not cure within that period.

This Appendix is governed by the laws of the District's state. The State Exhibit attached for the District's state sets out additional required terms, including: for Ohio, compliance with Ohio Revised Code 3319.321, 3319.325 through 3319.327, and Chapter 1347 (including breach notification under R.C. 1347.12) as if CHSS were the District; for California, the terms required by Education Code § 49073.1 and Business and Professions Code § 22584; for Arizona, Arizona NDPA Exhibit G including the AI questionnaire; and for Missouri, Massachusetts, Utah, and other states, the state NDPA exhibit where one exists.

If this Appendix conflicts with the Agreement, this Appendix controls as to Student Data. If the District has executed the NDPA with CHSS, the NDPA controls as to any conflict with this Appendix.

Platform. CHSS Navigator is a web application delivered on Salesforce Experience Cloud, backed by a CHSS data platform on Microsoft Azure and Microsoft Fabric. All environments are hosted in United States regions.

How data moves.

1. The District transfers files (CSV, TXT, or Excel) to CHSS by SFTP on a schedule, or uploads them through the CHSS secure portal. Email is never used.
2. Files are virus-scanned and validated on receipt, mapped to a common data model, checked for quality (type, completeness, anomalies), and loaded to the data lake and warehouse with an audit record.
3. Student records are matched by the District's student identifier (and state identifier where provided). Probabilistic matching is used only to flag possible duplicates for human review, never to link records automatically.
4. On-track indicators, course-failure flags, and attendance measures are computed and published to Navigator for the School Team.
5. A separate de-identification step produces tokenized research datasets, which are the only datasets CHSS program and research staff use.

Who can see what. Role-based access in Navigator: school users see their school's students; district users see their district; Coaches see aggregate views, or student-level views for their schools where the District has elected Option A; CHSS program and research staff see de-identified and aggregate data only. Every access to a student-level record is logged.

Security controls.

• Encryption in transit (TLS 1.2 or higher) and at rest (AES-256).
• Multi-factor authentication for all CHSS accounts; single sign-on available for District users.
• Least-privilege, role-based access; documented access roster reviewed quarterly; access removed within one business day of separation.
• Access and administrative logging retained twelve months and available to the District on request.
• Production segregated from the internet by firewall and network controls; critical patches within seven days; anti-malware on all endpoints; encrypted, tested backups.
• Background checks and annual privacy training for all staff with access, including Coaches.
• Independent security assessment annually (SOC 2 Type II or equivalent) and an annual penetration test; summaries available on request. [First assessment scheduled for completion by: date.]
• Written, tested incident response plan; the District is notified within seventy-two hours of a confirmed breach.

Subprocessors. Microsoft (Azure, Fabric, Power BI), Salesforce (Experience Cloud, CRM Analytics), and [AI model provider]. All U.S.-hosted, all under written terms at least as protective as CHSS's agreement with the District. The District receives thirty days' notice of any change.

Artificial intelligence. Used for file-mapping assistance, data-quality checks, and intervention suggestions presented to educators. District data is never used to train models available to others. Recommendations can be disabled at the District's request.

Retention. Identifiable data is held only for the term of the agreement, destroyed or returned within sixty days of termination or of a written directive, with written certification; backups expire on a documented rotation of no more than ninety days. De-identified and aggregate data may be retained for program evaluation; no re-identification.

Insurance. Cyber liability $2,000,000 per claim and aggregate; general liability $1,000,000 per occurrence and $2,000,000 aggregate; professional errors and omissions $1,000,000. Certificates on request.

Agreements. CHSS signs the National Data Privacy Agreement (any state version) or provides Appendix A to the same standard, and provides an executed copy and a ninety-day expiration notice.

Thank you for getting this started, and for the clear summary. Your description is correct: the Center for High School Success uses information from your SIS to build the ninth grade dashboards your team and our coach use to identify students who need support and to act on it quickly. That is the purpose, and we operate as a school official under FERPA to deliver it.

One clarification so there are no surprises: like most programs, we evaluate whether our work is helping. We do that with de-identified and aggregate results only (for example, your school's on-track rate), never with identifiable student records, and we delete identifiable data when our partnership ends or whenever you ask.

We are glad to work through TEC and the SDPC process. We will sign the Missouri NDPA, and we expect to have a general offer of terms on file so other Missouri districts can use the same agreement. When TEC reaches out, please have them contact Emily Phan, our Executive Technology Officer, who is copied here. Luke Allpress, who is helping us with agreement language and SIS integration, is also copied.

We will send you a short summary of exactly what data we ask for and how it moves before anyone has to review a document.

Here is what the integration involves, in plain terms. Your district sends us a file for each ninth grade cohort with student ID, name, grade level, course enrollments, course marks and credits by grading period, GPA, and attendance. Most districts set up an automated weekly export to our secure SFTP; if that is not possible yet, a scheduled upload each grading period works and we will help you automate it later. Your school team sees student-level dashboards with names. Our coaches see aggregate views unless you choose to give them more. Our program and research staff never see identifiable data. Identifiable data is deleted when the partnership ends or whenever you ask; we keep only de-identified and aggregate results to evaluate the program. The full terms are in our data privacy appendix, or we will sign your state's NDPA, whichever you prefer.

Ask for, in order:

1. Forty-five minutes with the CTO and whoever reviews data agreements for the district (privacy officer or counsel), between Nov 2 and Nov 4, with Luke on the call.
2. Confirmation that the Student Data Sharing Agreement dated 3/17/2025 is the current form, and whether the district would also accept the Ohio NDPA.
3. Their read on two specific points before the call: coach access to student-level data (Option A) versus aggregate only (Option B), and CHSS keeping de-identified results after termination for program evaluation.
4. Whether the district requires anything of CHSS coaches beyond the agreement (background checks, district onboarding, training).
5. Their board timeline from "agreement final" to "approved," so CHSS can work backward from the January start.

Ask for:

1. The student data privacy agreement template SDUSD uses with outside partners that receive student-level data, since the CCAP agreement is the wrong instrument for this.
2. Whether SDUSD prefers the California NDPA or its own form, and who in the district signs it.
3. Whether the district's General Services Agreement and SOW format will be required for the accelerator, so CHSS can structure its "District responsibilities / CHSS responsibilities" sections to match.
4. The same two substantive points as Columbus: coach access and de-identified retention.

Because the accelerator includes SIS integration, we will ask you within the first two weeks to name a technical contact and a data privacy contact, and we will schedule a short onboarding call with both before any data moves. We will sign your state's National Data Privacy Agreement or provide our own privacy appendix written to the same standard, whichever your district prefers.

Status: Open. Drafted as Option B (aggregate only, team lead screen-shares) by default, with a one-sentence district opt-in to Option A (coach has student-level access for their schools, logged, background-checked, trained). Why: B matches the collateral already in circulation, keeps one protocol across the network, and costs little in coaching effectiveness since the team lead is in the room. A is defensible under FERPA and some districts will grant it. What would change it: Tara saying coaches cannot do the job without names, or Columbus and San Diego both saying A is fine.

Status: Recommended. The feed is identifiable, because the product requires it for school teams. The draft contains the exposure by role (Section 5.4), use (5.5), and retention (5.6). What would change it: a district that will only send de-identified data, in which case the fallback is a ninth-grade-only, pseudonymous feed and a Navigator without names for that district.

Status: Recommended. Optional, not required. Why: not needed for the on-track calculation, and the single element most likely to stall a privacy review. What would change it: Tara identifying a Navigator feature that depends on it.

Status: Recommended. Identifiable data destroyed within sixty days of termination or directive, with backups expiring within ninety; de-identified and aggregate data retained for evaluation under NDPA-style limits. Why: sixty days satisfies NDPA v2, Columbus, and the stricter districts; the carve-out is the NDPA's own. The three-year clause in the current draft would be struck by every district on the list. What would change it: nothing on the district side; Emily confirms the deletion runbook can meet sixty days across Salesforce, Azure, and Power BI.

Status: Recommended. CHSS commits to sign any state NDPA on request, signs Exhibit E with the first district in each state, and keeps Appendix A as the instrument for districts that do not use the NDPA. Why: the NDPA will arrive regardless; fighting it costs months, and Exhibit E turns the first signature in each state into a template for the rest. What would change it: Stand's counsel objecting to the NDPA's standard clauses, which cannot be redlined.

Status: Needs confirmation (Demian or counsel). Drafted with Stand for Children Leadership Center, Inc. as the party and an express clause barring any advocacy, lobbying, political, or fundraising use of student data by any affiliate, including any (c)(4). Why: answers the question before a board member asks it. What would change it: confirmation that the Leadership Center is the correct (c)(3) signatory, which the current MOU implies.

Status: Needs confirmation (Tara). The District approves screener content and runs notice or consent; CHSS provides the full instrument for review and adds no questions without approval. Why: the belonging screener can reach PPRA's protected areas, and the obligation legally sits with the district. What would change it: Tara confirming the instruments avoid the protected categories, in which case notice alone may suffice.

Status: Needs confirmation (Demian). Drafted at $2M per claim and aggregate with a two-year tail, plus CGL $1M/$2M and E&O $1M. Why: SIS-level data is the $2M tier in district practice, and $2M satisfies Columbus. What would change it: Stand's current policy limit; if it is $1M, the draft says $1M and the gap goes on Emily's list.

Status: Recommended. Three tiers: automated feed (target), scheduled upload (floor), vendor connection (where available). Why: matches what the platform ingests today and leaves the best privacy route on the menu. What would change it: Emily adding API ingestion, which would promote Tier 3.

Status: Recommended. Require the district or state ID in every feed; allow a district-generated stable pseudonym; treat both as Student Data; use probabilistic matching only to flag duplicates for human review. Why: deterministic matching is what privacy officers trust, and it keeps pseudonymous feeds inside the agreement. What would change it: nothing; this is the safe default.

Status: Recommended. Required: ID, name, grade level and enrollment, course enrollments, marks and credits by term, GPA, attendance. Optional: summer school, demographics, discipline, assessments, date of birth. Why: the required set is exactly what the on-track calculation and the dashboards need; everything else is a district election. What would change it: Tara or Emily naming a Navigator feature that needs an optional element.

Status: Recommended. Seventy-two hours from confirmation, broad trigger, district controls family notification, CHSS bears costs attributable to its breach. Why: it is the NDPA's own number. What would change it: a state exhibit with a shorter window, which would control.

Status: Open (Jonah and Emily). The pilot runs before any new agreement exists. Either it runs on de-identified data under the existing agreements, or pilot districts sign the new Sections Five and Six first. The drafts do not decide this; it has to be decided before the Summit.

Status: Recommended. De-identified findings may be published; no student identifiable; district not named without consent; district receives any report with its aggregate results fifteen business days ahead; cells under ten suppressed. Why: it is what the longitudinal evaluation needs and what districts already accept in the NDPA. What would change it: a district wanting approval rights over all publication, which the clause can accommodate per district.

Status: Needs confirmation (Emily). CHSS commits to an annual independent assessment and penetration test, and offers districts a menu of evidence once a year. Why: it is the Columbus bar and the shape most CTOs accept. What would change it: timing; if the first SOC 2 cannot complete before the 2027–28 school year, the spec page says so with a date rather than claiming it.

Status: Recommended. Implementation profiles are "Tier 1, 2, 3"; coach access is "Option A / B." Why: two A/B schemes in one agreement will be confused in a board packet.