Privacy Policy for Tutoring Clients

B.2 What we collect

• From the Client: name, email address, phone number, mailing address, relationship to the Student, emergency contacts, authorized pickup persons, and the card token and last four digits provided by Stripe. We do not collect or keep government-issued identification; staff may ask to see, but do not copy, photo identification of a pickup person or of a parent giving consent in person.

• About the Student (entered by the Client): name, date of birth or age and grade, school, subjects, learning goals, accommodations, allergies or medical information you choose to share, scholarship account identifiers, and the consents and authorizations in the Client Services Agreement.

• Created during tutoring: session schedules and attendance, instructor notes and progress reports, in-session assessment results, homework and billing records.

• Collected online from the Student, with consent where required (Section B.8): for a student portal login, the login email or username, sign-in records (IP address, device and browser details) and anything the Student enters or uploads in the portal; notes and work the Student writes on the in-session tablets, saved under the Student’s name; and, only if you opt in, audio recordings of sessions.

• Security video: video only, with no audio, of the center’s common areas and study cubicles.

• Communications: emails, texts, call records and voicemails with us. We record or transcribe a phone call only if we tell you at the start of the call and you agree, as Florida law requires (Fla. Stat. ch. 934).

We do not create voiceprints, face templates or other biometric identifiers.

B.4 Who we share it with

We do not sell personal information. We share it only as follows:

• Service providers that process it only for us, under contracts that limit their use: TutorCruncher (scheduling, portal, invoicing); Stripe (payments); the cloud services that store tablet notes and session recordings; Microsoft 365 (email and documents); Slack (internal notifications); Quo (phone and text); HubSpot (client relationship records); and, if the Student uses our online practice platform, Vercel, Supabase and Microsoft under that platform’s own notices.

• Advertising measurement: when you send a request through our website, we send your email address and phone number to Google and Meta in hashed form, scrambled one way (to Meta, also your first name in hashed form, and your device’s IP address and browser details, which are not hashed), with the ad’s click identifier if you came from one of their ads, so they can match the request to advertising activity they already recorded; we may report your enrollment the same way. When the form shows that a student filled it in, we do none of this, and no advertising tag records the request. We never send information about a Student under eighteen (18) to an advertising platform.

• Step Up For Students, the SFO and EMA, when you pay with scholarship funds: the Student’s name, scholarship identifiers, and the instructor, dates, hours and amounts needed to invoice.

• Instructors, who see what they need to teach the Student and are bound by confidentiality obligations.

• Legal and safety: when required by law, subpoena or court order; to report suspected child abuse, abandonment or neglect (Fla. Stat. § 39.201); in a medical emergency; or to protect the safety of students, staff and the public.

• Coral Gables Psychological Services, an independent psychology practice: we do not send it your contact details. If you ask about its free consultation, we give you its public phone number and website so you can contact it directly. We share a Student’s records or results with it only with your written permission for that specific disclosure, and we never share information collected online from a child under 13 with it. Neither business is obliged to refer anyone to the other, and neither pays or receives anything for referrals.

• Business transfer: if U Tutors is sold or merged, records transfer to a buyer that keeps this Policy’s promises.

Instructors and staff may not use client information for their own purposes or solicit clients outside U Tutors.

B.6 How long we keep it (retention policy)

“The relationship ends” when you close your account or twelve (12) months after the Student’s last session, whichever comes first.

• Client account, billing, invoice and scholarship-invoice records (kept because tax, accounting and scholarship-audit rules require them): seven (7) years after the relationship ends, then deleted.

• Signed agreements and consent records, including records of parental consent (kept as evidence of the authorizations and consents given): seven (7) years after the relationship ends.

• Student profile, session history, instructor progress notes and in-session assessment results (kept to plan and continue instruction): twelve (12) months after the relationship ends, then deleted.

• A child’s portal login, sign-in records and anything the child entered or uploaded in the portal (under 13) (kept so the child can sign in and use the portal and so the portal stays secure): deleted within thirty (30) days after the login is closed, whether on revocation of consent, on request, or when the relationship ends.

• Tablet notes saved under a child’s name (under 13) (kept so instruction can continue between sessions): deleted twelve (12) months after the child’s last session, or within thirty (30) days after consent is revoked or deletion is requested, if sooner.

• Audio recordings of sessions, for any Student (opt-in only; kept so the Client can hear how a session was taught): deleted sixty (60) days after the session, or sooner on request, unless needed to investigate a complaint or legal claim, in which case kept until it is resolved.

• Security video (kept for the security of students, staff and the premises): ninety (90) days on a rolling basis, longer only if an incident is flagged for review.

• Emergency, medical and pickup information held in the portal (kept to respond to emergencies and release Students safely): deleted within ninety (90) days after the relationship ends. The copy inside the signed Client Services Agreement is kept with that agreement for seven (7) years as evidence and is not used after the relationship ends.

• Emails, texts, call records, voicemails and client relationship (CRM) records (kept to answer questions and resolve disputes): two (2) years after the relationship ends, except where they form part of billing records.

• Images, video or testimonials used under a publicity opt-in: until the opt-in is revoked; new uses stop within ten (10) business days, and materials already printed or published are not recalled.

• Practice-platform data follows that platform’s retention policy at practice.ututorsacademy.com/retention.

B.8 Children's Privacy Notice (tutoring tools)

Section B.8 is published as its own page: Children's Privacy Notice (tutoring tools).

B.10 Your rights and choices

At any time you may review and correct your and your Student’s information in the portal or by asking us; ask us to delete information we are not required to keep (we keep records the law requires, such as invoices and signed consents); opt out of marketing; revoke the Audio Recording Consent or the Publicity Opt-In; or close your account. We respond to requests within ten (10) business days and do not discriminate against anyone for exercising a privacy right.