Student Data Practices and FERPA

FERPA obligations depend on the institution’s use of a service, the information exchanged, and the governing agreement. Course Orbit does not use the phrase “FERPA compliant” as a blanket product certification. This summary helps institutions evaluate the applicable workflow.

Public website

The public marketing site does not require student accounts and does not collect student education records through its forms. Instructor-copy forms collect instructor business contact and teaching-context information. Aggregate marketing analytics do not store form values or persistent visitor identifiers.

Course delivery

When a course is delivered through an institutional LMS, the institution controls its LMS credentials, rosters, gradebook, policies, and instructor permissions. Course Orbit provides licensed course materials and implementation support. When Course Orbit hosts a course, the specific operational data, permitted uses, access controls, retention, and deletion process must be documented with the institution before launch.

Data principles

• Collect only information needed to deliver, support, and secure the selected course workflow.
• Do not sell student education data or use it for behavioral advertising.
• Limit operational access to personnel who need it for delivery or support.
• Use the institution’s agreed escalation and deletion process.

Institutional review

Institutions should request a workflow-specific data review before adoption, especially for hosted delivery. The review should identify data fields, system locations, subprocessors, retention, incident contacts, and contract terms. Contact [email protected].