Privacy and Security Policy

Scope

We're a small team doing this work with the resources we have. We haven't gotten everything perfect, and some parts of the site are still catching up to our standards. We're always improving, one step at a time, the same way we ask everyone else to learn.

If something here doesn't work for you, that's important for us to know. It isn't your fault, and it isn't a bother. It helps us do better.

Definitions

Personal Information:

Any information that can be used to identify an individual, including but not limited to name, ASHA account number, address, email, phone number, date of birth, certification/licensure information, and course participation records.

Sensitive Personal Information:

Information that requires enhanced protection, including financial information, health information, demographic data, and government-issued identification numbers.

Collection of Personal Information

Types of Personal Information Collected:

Engaging AAC Learning Studio collects the following types of personal information:

• Full name
• ASHA account number (when applicable)
• Contact information (email, phone, address)
• Professional credentials and licensure information
• Course registration and completion data
• Payment information (when applicable)
• Demographic information (as required by ASHA for reporting purposes)
• Accessibility needs and accommodations requests
• Course evaluation responses
• Learning assessment results
• Professional credentials and licensure information

Methods of Collection:

Personal information is collected through:

• Online registration forms
• Paper registration forms
• Course evaluations
• Learning assessments
• Email communications
• Telephone or Video Call communications
• ASHA CE Registry reporting systems

Consent:

We obtain explicit consent from individuals for the collection, use, and sharing of their personal information. Consent is obtained through:

• Clear privacy notices at the point of collection
• Opt-in mechanisms for data sharing beyond ASHA CE reporting requirements
• Clear explanation of how personal information will be used
• Option to withdraw consent (with understanding that this may impact CE  credit reporting)

Use of Personal Information

Engaging AAC Learning Studio uses personal information for the following purposes:

• Processing course registrations and payments
• Reporting course completion to the ASHA CE Registry
• Providing course materials and resources
• Issuing certificates of completion
• Conducting program evaluations
• Communicating about current and future CE opportunities
• Improving our CE programs based on participant feedback
• Meeting legal and regulatory obligations

Data Security Measures

To protect personal information from unauthorized access, disclosure, alteration, or destruction, Engaging AAC Learning Studio implements the following security measures:

• Processing course registrations and payments
• Reporting course completion to the ASHA CE Registry
• Providing course materials and resources
• Issuing certificates of completion
• Conducting program evaluations
• Communicating about current and future CE opportunities
• Improving our CE programs based on participant feedback
• Meeting legal and regulatory obligations

Technical Safeguards:

• Encryption of personal information during transmission and at rest
• Secure, password-protected database systems
• Multi-factor authentication for staff accessing participant data
• Regular security updates and patch management
• Firewalls and intrusion detection systems
• Regular security assessments and vulnerability testing
• Backup systems and disaster recovery protocols

Administrative Safeguards:

• Staff training on privacy and security procedures
• Background checks for employees with access to personal information
• Written policies and procedures for data handling
• Access controls based on job responsibilities
• Regular privacy and security compliance audits
• Incident response procedures
• Vendor management program for third-party service providers

Physical Safeguards:

• Secure facility with controlled access
• Locked storage for physical documents containing personal information
• Secure disposal of physical and electronic records

Data Retention and Disposal

To protect personal information from unauthorized access, disclosure, alteration, or destruction, Engaging AAC Learning Studio implements the following security measures:

• Processing course registrations and payments
• Reporting course completion to the ASHA CE Registry
• Providing course materials and resources
• Issuing certificates of completion
• Conducting program evaluations
• Communicating about current and future CE opportunities
• Improving our CE programs based on participant feedback
• Meeting legal and regulatory obligations

Technical Safeguards:

• Encryption of personal information during transmission and at rest
• Secure, password-protected database systems
• Multi-factor authentication for staff accessing participant data
• Regular security updates and patch management
• Firewalls and intrusion detection systems
• Regular security assessments and vulnerability testing
• Backup systems and disaster recovery protocols

Administrative Safeguards:

• Staff training on privacy and security procedures
• Background checks for employees with access to personal information
• Written policies and procedures for data handling
• Access controls based on job responsibilities
• Regular privacy and security compliance audits
• Incident response procedures
• Vendor management program for third-party service providers

Physical Safeguards:

• Secure facility with controlled access
• Locked storage for physical documents containing personal information
• Secure disposal of physical and electronic records

Data Sharing and Disclosure

ASHA CE Registry

• Course completion information is reported to the ASHA CE Registry for participants who provide their ASHA account number
• Information shared includes: participant name, ASHA account number, course information, completion date, and number of CEUs earned
• Backup systems and disaster recovery protocols

Third-Party Service Providers

We may share personal information with third-party service providers who help us deliver CE programs, including:

• Learning management system providers
• Payment processors
• Email communication platforms
• Survey and evaluation tools

All third-party service providers are contractually required to:

• Use personal information only for the purpose of providing the contracted service
• Implement appropriate security measures
• Comply with applicable privacy laws and regulations
• Not share or sell personal information to other parties

Legal Requirements:

• We may disclose personal information when required by law, regulation, or legal process
• We will notify individuals of such disclosures unless prohibited by law