This Data Processing Agreement (“DPA”) is part of the Terms of Service between JV Clinical Technologies LLC (“JV Clinical Technologies,” “we”) and the center, program or educator that holds the account (“you”). It applies to the records you enter about children and families in Smart Behavior Plans (“Center Records”). If this DPA and the Terms conflict about Center Records, this DPA controls. Centers that need a signed copy can request one at support@jvclinical.com.
1. Roles
You control Center Records and decide what is entered, who on your staff can see it, and how long it is kept. We process Center Records only on your behalf, to provide the Service, and on your documented instructions, which are these Terms, this DPA and your use of the Service's features. We will tell you if we believe an instruction breaks the law.
2. What we will not do
- Sell, rent or share Center Records for advertising or marketing.
- Use Center Records to build profiles of children or families, or for any purpose other than providing the Service to you.
- Send Center Records to artificial intelligence (AI) providers or use them to train AI models.
- Combine Center Records with information from other sources, except as needed to provide the Service to you.
3. Your responsibilities
- Enter only what you need, identify children by initials or a center-assigned ID, and avoid medical records and diagnoses.
- Give families any notice, and obtain any consent, that your licensing rules, policies or applicable law require.
- Manage your staff's access: assign classrooms, and remove staff who leave.
- Keep sign-in details confidential and tell us promptly if you suspect an account is compromised.
4. Confidentiality and access
Center Records are separated by center in our database. Teachers see only their assigned classrooms; owners and directors see their whole center. Our own administrator roles do not include access to Center Records. Our personnel may access Center Records only when needed to provide support you request, resolve a technical problem, or meet a legal obligation, and are bound by confidentiality.
5. Security
We maintain reasonable administrative, technical and physical safeguards appropriate to the nature of Center Records, including encrypted connections, managed sign-in with email confirmation, database-level access rules, logs kept free of record content, and restricted secret keys. We review and improve these safeguards over time. No system is perfectly secure.
6. Security incidents
If we confirm unauthorized access to, or disclosure of, your Center Records, we will notify your account owner without undue delay and in any event within 72 hours of confirming it. We will describe what happened and what information was involved, as far as we know it, take reasonable steps to contain it, and cooperate with you so you can meet any obligations you have to families or regulators.
7. Subprocessors
We use these companies to provide the Service. Each is bound by written terms that protect the information it processes.
- Vercel: Website and application hosting. Data involved: All Service data in transit; no long-term storage of center records.
- Supabase: Sign-in and the application database. Data involved: Account details and all center records.
- Stripe: Payments, subscriptions and the billing portal. Data involved: Billing contact and payment details (never child records).
- Resend: Account emails (confirmation, invitations, password resets). Data involved: Recipient email address and name (never child records).
- Google Workspace: Support email. Data involved: Whatever you choose to send to support.
We will give account owners at least 30 days' notice by email before adding a subprocessor that will process Center Records. If you object on reasonable grounds, you may cancel and receive a prorated refund of any prepaid fees for the remaining period.
8. Requests from families and authorities
If a parent, guardian or other person asks us about Center Records, we will direct them to you and will not respond ourselves unless you ask us to or the law requires it. We will help you respond to requests to access, correct or delete Center Records. If a government authority requests Center Records, we will tell you before responding unless the law prohibits it, and will disclose only what is legally required.
9. Deletion and return
You can print your documents or save them as PDFs at any time. When your account closes, or when your account owner asks in writing, we will delete Center Records within 30 days, except where the law requires us to keep them. Backup copies are overwritten on our providers' regular schedule and are not used in the meantime. We will confirm deletion in writing on request.
10. Schools and public programs
If you are an educational agency or institution subject to the Family Educational Rights and Privacy Act (FERPA), or to a state student privacy law, we will act as a “school official” with a legitimate educational interest under your direct control regarding the use and maintenance of education records, use them only for the purposes you authorize, and not re-disclose them except as those laws allow. Contact us if your program needs additional contract terms.
11. Changes and contact
We may update this DPA as described in the Terms; changes will not reduce the protection of Center Records already collected without your agreement. Questions: support@jvclinical.com.