Student data deserves deliberate safeguards.
Last updated August 7, 2026
TherapyTrack is designed around authenticated workspaces, scoped student access, and responsible data use for school-based therapy teams.
How TherapyTrack protects access
- Authenticated accounts use secure session handling and one-time-code or supported identity-provider sign-in.
- Workspace membership, clinician role, student assignment, and explicit edit or export permissions limit access.
- Supervising OTs control collaborator invitations and student assignments and can revoke workspace access.
- IEP Assist is limited to the student’s primary OT for final-documentation oversight.
How data is protected
- Network traffic is encrypted using HTTPS/TLS.
- Application data and files are encrypted at rest by managed infrastructure providers.
- Server-side credentials and provider keys are not exposed in browser code.
- Exports require the user to have export permission for the relevant student.
Our controls are designed to support FERPA-aligned use. Compliance also depends on district approval, direct-control terms, access configuration, staff practices, and applicable state law. We support district DPA review.
Responsible data practices
We do not sell student data, use it for targeted advertising, or allow unauthorized re-disclosure. AI processing happens only after an authorized user makes a request and is described in our AI Use Policy. Customers can request return or deletion of data as described in our Privacy Policy.
District and agency reviews
We can review a district DPA and respond to reasonable vendor-security questions. Contract terms can address permitted use, data ownership, return or deletion, incident notice, subcontractors, and state-specific student privacy requirements.
To request a DPA or report a suspected security issue, email security@usetherapytrack.com. Please do not include student information in the initial email.