Privacy Policy

This policy explains how Westchester Hebrew High School (“the School,” “we”) and its software provider ThinkBright, which operates the Zehut platform (“Zehut,” “the Service”), collect, use, protect, and share information in the School’s information system.

The School is the owner and controller of the education records in Zehut. ThinkBright operates Zehut on the School’s behalf as a “school official” with a legitimate educational interest under the Family Educational Rights and Privacy Act (FERPA), and processes information only under the School’s direction to provide the Service.

1. Who this policy covers

Zehut is used by the School’s administrators, teachers, staff, students, and the parents and guardians of enrolled students. This policy applies to information handled in the Service, including its web application, mobile apps, and family portals. Zehut is not a consumer product and is not marketed to the general public; accounts exist only for people the School has enrolled or employed.

2. Information we collect

We collect only what the School needs to run its programs and educate its students:

• Student & family records — name, contact details, date of birth, grade level, guardian relationships, and enrollment status.
• Academic information — schedules, attendance, assignments, grades, transcripts, and, where the School uses them, standards or skills assessments.
• Staff information — names, roles, and work contact details for employees who use the Service.
• Health & safety information — allergy, medical, or safety notes the School records to keep a student safe. Detailed health information is restricted to authorized staff.
• Billing information — tuition, fees, and financial-aid records. Card and bank payments are processed by our payment provider; Zehut does not store full card numbers.
• Communications — messages, announcements, and notifications sent through the Service.
• Technical information — sign-in activity and basic device/log data needed to operate and secure the Service.

3. How we use information

Information in Zehut is used solely to provide the Service to the School — for example to:

• maintain student records, schedules, attendance, and grades;
• let parents and students see their own information through the portals;
• manage enrollment, billing, and financial aid;
• send school communications and required notices;
• secure the Service and maintain an audit trail of who accessed or changed records.

We do not sell personal information, we do not use it for advertising, and we do not use student data to build advertising or marketing profiles or to train external, third-party advertising models.

4. How we share information

Access to information is limited by role, and it is shared only in these circumstances:

• Within the School — with the administrators, teachers, and staff whose roles require it, and with a student’s own parents/guardians through the portal.
• Service providers — vetted vendors who help operate the Service under contract and may process information only on our instructions. These include our cloud hosting and database, payment processing, and email/SMS delivery providers, and, where the School enables it, single-sign-on and rostering partners the School chooses (such as Clever or ClassLink).
• Legal requirements — when required by law or to protect the safety of a member of the school community.

Any disclosure of education records outside the School is recorded. We do not transfer student data to third parties except as described here or as the School directs.

5. How we protect information

• Each school’s data is isolated in a multi-tenant database enforced by row-level security.
• Information is encrypted in transit and at rest, including backups and uploaded files.
• Access is role-based — a user only reaches the records their role permits.
• Every change to a student record is written to an immutable audit log (who, what, and when).
• Student data is hosted in the United States.

6. How long we keep information

We keep information for as long as the School maintains its records and its agreement with ThinkBright is in effect. Records may be retained afterward where the School or the law requires it (for example, transcripts and immunization records). Removed records are retired rather than immediately erased, and are purged on a schedule.

7. Your rights

Because the School controls the records, requests to inspect, correct, export, or delete a student’s information are directed to the School, which fulfills them through Zehut:

• Inspect — parents and eligible students can view a student’s records in the portal, and may request a full copy.
• Correct — you may ask the School to correct information you believe is inaccurate.
• Export & deletion — you may request an export or, subject to the School’s legal obligations, deletion of a student’s data.

To exercise these rights, contact the School using the details below.

8. Children’s privacy

Zehut is a school service. Where a student is under 13, the School provides consent on the parent’s behalf for the student’s use of the Service, consistent with the Children’s Online Privacy Protection Act (COPPA). We collect only the information needed for the student’s education and never use it for advertising. Parents may review or request deletion of their child’s information through the School.

9. Cookies

Zehut uses only the cookies needed to keep you signed in and to keep the Service secure. We use privacy-friendly, aggregate usage measurement to keep the Service reliable; we do not use advertising or cross-site tracking cookies.

10. Changes to this policy

We may update this policy as the Service changes. When we make a material change, we will update the effective date above and, where appropriate, notify the School.

11. Contact

For questions about this policy or about a student’s information, contact Westchester Hebrew High School at privacy@whhsny.org.