Privacy Policy

1. What This Policy Covers

This policy describes how SLP Schedule (“we”, “us”, “our”) collects, uses, and protects information when you use our scheduling application. SLP Schedule is a tool for school-based speech-language pathologists to organize student caseloads and generate therapy schedules.

2. Information We Collect

Account information

When you create an account, we collect your name, email address, and password. Passwords are hashed using bcrypt and are never stored in plaintext.

Student data you enter

You may enter student information including names, grade levels, therapy service types (e.g., articulation, language), session counts and durations, group memberships, and availability schedules. This data is entered and controlled entirely by you.

Waitlist

If you join our waitlist, we collect your email address solely to notify you when the product is available.

3. How We Use Your Information

We use the information you provide to:

• Provide and maintain the scheduling service
• Authenticate your account
• Notify waitlist members about product availability

We do not use student data for advertising, analytics, profiling, or any purpose other than providing the scheduling service to you.

4. Our Role: Data Processor

You (the therapist) or your school/district are the data controller — you decide what student data to enter and are responsible for having the authority to do so. We act as a data processor, storing and processing data solely on your behalf to provide the service.

It is your responsibility to ensure that entering student information into SLP Schedule complies with your school or district’s policies and any applicable laws (including FERPA).

5. Data Isolation and Security

We protect your data with the following measures:

• Row-level security — Each therapist can only access their own data. This is enforced at the database level, not just in application code.
• Encryption in transit — All connections use HTTPS/TLS.
• Encryption at rest — Data is encrypted at rest on our infrastructure provider.
• Secure authentication — Passwords are hashed with bcrypt. Sessions use HTTP-only cookies.

6. Data Storage and Infrastructure

Data is stored on Supabase, a hosted PostgreSQL platform with servers located in the United States. We do not transfer data outside of the US.

7. Third-Party Sharing

We do not sell, rent, or share your data or student data with third parties. The only third party that processes data on our behalf is our infrastructure provider (Supabase), which is subject to its own privacy and security commitments.

8. Data Retention and Deletion

Your data (including all student records) persists for as long as your account is active. You may request deletion of your account and all associated data at any time by contacting us. Upon deletion, all student data, schedules, groups, and labels tied to your account are permanently removed.

Waitlist emails are retained until we launch or you ask to be removed.

9. FERPA

The Family Educational Rights and Privacy Act (FERPA) protects student education records. FERPA obligations fall on schools and districts, not on software vendors. However, we are committed to supporting FERPA compliance:

• We only use student data to provide the scheduling service
• We enforce strict data isolation between users
• We will enter into a Data Processing Agreement (DPA) with schools or districts upon request
• We delete student data when an account is deleted

10. COPPA

SLP Schedule is designed for use by adult professionals (speech-language pathologists). Children do not create accounts or interact with the application directly. We do not knowingly collect personal information from children under 13.

11. HIPAA

School-based speech therapy services are generally governed by FERPA, not HIPAA. SLP Schedule is not a HIPAA-covered entity and does not serve as a business associate under HIPAA. If you require HIPAA compliance for your use case, please contact us to discuss your needs.

12. Changes to This Policy

We may update this policy from time to time. If we make material changes, we will notify you by email or by placing a prominent notice in the application. Your continued use of the service after changes take effect constitutes acceptance of the updated policy.

13. Contact

If you have questions about this privacy policy, want to request data deletion, or need a Data Processing Agreement, contact us at: privacy@slpschedule.com