Data Processing Agreement

This Data Processing Agreement (“DPA”) is entered into between Digital Mundo, LLC, a Delaware limited liability company doing business as “SpeechTherapyMagic” (“Provider”), and the schools, clinics, and educational institutions (“School” or “LEA”) using the Service to process student data. By using the Service with student profiles, the School agrees to this DPA.

1. Definitions

For purposes of this DPA, the following terms have the meanings set out below:

• “Student Data” means any personally identifiable information about a student that is collected, generated, or maintained through the use of the Service, including but not limited to student name or nickname, age or grade level, target speech sounds, session scores, and practice history.
• “School” or “LEA” means the educational institution, school district, local education agency, or licensed practitioner that has agreed to this DPA and is using the Service to provide speech therapy practice to students.
• “Provider” means SpeechTherapyMagic, the operator of the Service.
• “Authorized User” means a speech-language pathologist (SLP), teacher, or educator employed by or contracted with the School who holds a verified account and has been granted access to the Service for legitimate educational and therapeutic purposes.

2. School Official Designation (FERPA)

The School hereby designates the Provider as a “School Official” under the Family Educational Rights and Privacy Act (FERPA), 20 U.S.C. § 1232g, with a legitimate educational interest in Student Data as necessary to perform the services described in this DPA. The Provider will operate under the direct control of the School with respect to the use and maintenance of Student Data.

Provider will use Student Data to operate, personalize, secure, support, troubleshoot, and improve the educational practice Service as described in this DPA and the Privacy Policy. Provider will not use Student Data for behavioral advertising or sell it to data brokers. Provider may disclose Student Data to service providers that support these functions (including providers listed at /subprocessors), at the School’s direction, in a business transaction, or as otherwise permitted or required by applicable law.

3. Scope of Data Processing

What we collect: Provider may collect and process the following categories of Student Data on behalf of the School: student first name or nickname; age or grade level; target speech sounds, goals, group, and assignment information; activity responses, scores, accuracy, duration, completion, and practice history; pronunciation practice recordings sent to a scoring provider and derived feedback; generated content and downloads; adult notes or free text; and technical data such as IP address, browser and device details, cookies, session identifiers, and other persistent identifiers. Existing or voluntarily completed profiles may also contain legacy fields for diagnosis types, severity, sound positions, therapy level, reading level, languages, hearing status, and related conditions. These clinical profile fields are not required for ordinary practice, and users should avoid entering unnecessary identifying clinical information. Provider does not promise that raw recordings are always transient or subject to a fixed retention period; processing and retention depend on the feature, provider configuration, legal obligations, and the Privacy Policy.

Collection limits: The Service does not require a student last name, social security number, government-issued identifier, student financial information, or precise geolocation for ordinary practice. Users must not enter protected health information or identifying clinical records and should provide only information reasonably necessary for the feature used. Provider does not build behavioral advertising profiles on students.

Purpose of processing: Student Data is processed to deliver and personalize practice activities; record responses, scores, and progress; generate requested content; enable Authorized Users to review performance; authenticate users; maintain security; provide support; troubleshoot; measure performance and product reliability; comply with law; and operate and improve the Service as described in the Privacy Policy.

4. COPPA Consent

This DPA does not itself provide notice to a parent or constitute verifiable parental consent under the Children’s Online Privacy Protection Act (COPPA). A School that relies on authority to consent for collection from a child under applicable law represents that it has determined that authority applies, has provided all required notices, and has obtained any separate parental or guardian permission required for its use of the Service.

Private practitioners, sole-practitioner SLPs, families, and other non-FERPA users may not rely on the School Official designation. They must evaluate whether COPPA or another privacy law applies to their use and obtain any required direct notice, consent, or other authorization before enabling a child to use voice, activity tracking, persistent identifiers, or other collection features. A practitioner’s representation or agreement to this DPA is not Digital Mundo, LLC’s parental-consent mechanism.

The Service does not claim COPPA certification. Information an adult enters about a child is collected from that adult, while a child’s later use may result in collection of voice, activity, and persistent identifiers. Digital Mundo, LLC remains responsible for the duties that apply to it as operator of the Service. Schools remain responsible for duties that apply to them, including required disclosures and evidence of any consent or authority on which they rely. This allocation does not waive or transfer the operator’s duties.

6. Subprocessors

Provider may engage third-party subprocessors to assist in delivering the Service (for example, cloud hosting, pronunciation scoring engines, and AI content generation services). An up-to-date list of subprocessors that may process Student Data is maintained at speechtherapymagic.com/subprocessors.

Providers handle information under their applicable service terms, privacy terms, configurations, and any written agreements that apply to Digital Mundo, LLC. This online DPA does not promise a specific certification, processing region, retention period, contractual addendum, or flow-down term for every provider.

Provider will update the subprocessors page when the provider list materially changes. Any separate written agreement with a School controls applicable advance-notice, objection, termination, or refund rights.

7. Data Subject Rights

Schools, as the responsible party for Student Data, may exercise the following rights on behalf of students at any time by emailing us at hello@speechtherapymagic.com or submitting a request via the contact form at speechtherapymagic.com/contact:

• Access: Request a copy of all Student Data held by Provider for a specific student.
• Correction: Request correction of inaccurate Student Data.
• Deletion: Request deletion of Student Data for a specific student or for students associated with the School, subject to verification, applicable law, technical limitations, and required records.
• Export: Ask whether Student Data can be provided in a reasonably usable format before account closure or deletion.

Provider will process verified access, correction, and deletion requests consistent with applicable law, the Privacy Policy, and any controlling written agreement. Retention varies by data category and may continue for backups, security logs, legal holds, transaction records, or other permitted operational and legal purposes.

8. School Responsibilities

By entering into this DPA, the School agrees to the following obligations:

• Obtain all required parental and guardian consents before enrolling students under the age of 13 in the Service, and maintain records of such consents as required by applicable law.
• Ensure that all Authorized Users are trained on this DPA and comply with its terms and all applicable student data privacy laws, including FERPA and COPPA.
• Promptly notify Provider — within 24 hours where practicable — of any known or suspected unauthorized access to student accounts or Student Data, so that Provider may investigate and take appropriate remedial action.
• Use the Service only for legitimate educational and therapeutic purposes and refrain from using the Service to collect or share Student Data for any commercial, marketing, or non-educational purpose.
• Ensure that adult Authorized User account credentials are kept confidential and are not shared with students or other unauthorized people.

9. Term and Termination

This DPA is effective as of the date the School first uses the Service with student accounts and remains in effect for as long as the School maintains an active Service account or continues to process Student Data through the Service.

This DPA terminates when the School’s underlying Service account terminates, unless applicable law or a controlling written agreement requires otherwise. A School may submit an account or DPA request by emailing hello@speechtherapymagic.com or via the contact form at speechtherapymagic.com/contact.

Termination of this DPA requires termination of the School’s underlying Service account. Before account closure, the School may ask Provider what Student Data can be made available. Requests for access or deletion following closure are handled under Section 7, the Privacy Policy, applicable law, and any controlling written agreement.

10. Governing Law

This DPA is governed by and construed in accordance with the laws of the State of Delaware, without regard to conflict-of-law principles, consistent with the Terms of Service. Applicable federal and state privacy laws may impose additional obligations based on the School, student, jurisdiction, and manner of use.

For disputes arising out of or relating to this DPA, see the Arbitration clause in the Terms of Service.