Book a demo
DATA HANDLING AND CODING PRACTICES POLICY
Last updated November 15, 2024
1. DATA ACQUISITION, PROCESSING, AND STORAGE

Objective: Ensure data is acquired, processed, and stored securely and efficiently while maintaining compliance with legal and ethical standards.

DATA ACQUISITION
  • Sources. Identify all data sources, including user interaction data, learning analytics, educational materials, usage statistics, feedback, and system performance data. Demographic data is not collected in compliance with the Family Educational Rights and Privacy Act (FERPA).
  • Collection Methods. Use secure, encrypted channels (TLS/SSL) for data collection. Ensure compliance with standards like Learning Tools Interoperability (LTI) when integrating with LMS platforms.

DATA PROCESSING
  • Processing Activities. Define clear procedures for processing each type of data. Include steps for anonymizing and pseudonymizing data where necessary.
  • Data Minimization. Collect only the data necessary for the specified purposes, adhering to the principle of data minimization.
  • Data Analytics. Utilize data to enhance educational programs, personalize learning experiences, optimize platform functionality, and improve user satisfaction.

DATA STORAGE
  • Storage Solutions. Store data in secure, access-controlled environments using encrypted databases. Implement a microservices architecture for data management, ensuring scalability and orchestration through platforms like Docker Compose or Kubernetes.
  • Access Control. Implement strict role-based access controls (RBAC) and multi-factor authentication (MFA). Log and monitor all data access to detect unauthorized attempts.
  • Encryption. Ensure all data is encrypted at rest and in transit using industry-standard algorithms (e.g., AES-256, TLS 1.2 or higher).
2. ETHICAL COMMITMENT

Objective: Uphold the highest standards of data privacy, security, and ethical practices in all data handling activities.

DATA PRIVACY
  • Anonymization and Pseudonymization. Anonymize personal data wherever possible. Use dedicated anonymization services for LTI-integrated data to ensure compliance with privacy standards.
  • Consent and Rights. Obtain informed consent from individuals where required by law. Facilitate data subject rights, including access, correction, deletion, and objection to data processing, in accordance with GDPR and CCPA.

COMPLIANCE
  • Regulatory Compliance. Adhere to all relevant laws and regulations, including FERPA, GDPR, and CCPA. Conduct regular audits to ensure ongoing compliance.
  • Ethical Considerations. Ensure transparency, fairness, and accountability in data handling practices. Provide ethical guidelines and training for all personnel involved in data processing.

DATA USE RESTRICTION
  • No Use for Neural Network Training. Explicitly prohibit the use of collected data for training neural networks. Ensure all stakeholders comply with this restriction.
3. CODING PRACTICES

Objective: Develop and maintain code that ensures data security, integrity, and compliance with ethical and legal standards.

SECURE CODING
  • Standards. Follow secure coding standards to prevent vulnerabilities. Use secure, minimal base images for containers and keep them updated.
  • Code Review. Implement a robust code review process to identify and address security issues early in the development cycle.
  • Automated Testing. Use automated testing to ensure code quality and security, including tests for vulnerability scanning and penetration testing.

INCIDENT RESPONSE
  • Breach Protocol. Establish a comprehensive incident response plan to quickly identify, contain, and remediate security incidents. Notify affected individuals and regulatory authorities as required by law.
  • Post-Incident Review. Conduct post-incident reviews to evaluate response effectiveness and implement improvements.

CONTINUOUS IMPROVEMENT
  • Training and Awareness. Provide regular training on data protection laws, ethical standards, and secure coding practices. Ensure all personnel are aware of their responsibilities.
  • Innovation. Encourage continuous innovation in data handling and coding practices to enhance security, efficiency, and compliance.
4. DOCUMENTATION AND REPORTING

Objective: Maintain clear and comprehensive documentation of all data handling, ethical commitments, and coding practices.

DOCUMENTATION
  • Policies and Procedures. Document all policies and procedures related to data acquisition, processing, storage, and security. Ensure documentation is accessible to relevant personnel.
  • Incident Reports. Maintain detailed incident reports for any data breaches, including the nature of the breach, response actions taken, and measures implemented to prevent future incidents.

REPORTING
  • Internal Reports. Prepare regular internal reports on data handling practices, compliance status, and security measures. Share these reports with relevant stakeholders.
  • External Reports. Provide aggregated and anonymized data reports to partner institutions and authorized stakeholders, as specified in agreements.
Made on
Tilda