Parents' Bill of Rights

Pursuant to New York State Education Law Section 2-D and the regulations of the Commissioner of Education, Lessimp, Inc ("Lessimp") provides the following Parents' Bill of Rights to all parents and eligible students whose data is collected, maintained, or processed through the Lessimp Academy platform.

1. Right to Know What Data Is Collected

Lessimp Academy collects only the minimum student data necessary to deliver STEM education courses. Data collected includes:

• Student identification: Name, email address, school-assigned user ID
• Educational records: Course enrollment, lesson completion, assessment scores, certificates earned
• Technical data: Login timestamps, device type (for compatibility), session duration
• Demographic data (optional, for NDEP reporting only): Grade level, veteran status of household, race/ethnicity, gender, disability status, income bracket

Lessimp Academy does NOT collect:

• Social Security numbers
• Financial or banking information
• Health or medical records
• Biometric data
• Location tracking data
• Social media accounts or activity
• Browsing history outside the Lessimp Academy platform

2. Right to Inspect and Review Data

Parents and eligible students have the right to inspect and review the complete record of student data maintained by Lessimp. To request access:

• Email: privacy@lessimp.com
• Subject line: "DOE Student Data Access Request — [Student Name]"
• Response time: Within 10 business days

3. Right to Have Data Corrected

If student data maintained by Lessimp is inaccurate, misleading, or in violation of the student's privacy rights, parents may request correction. Lessimp will respond within 10 business days and either make the correction or provide a written explanation of the decision.

4. Right to Data Security

Lessimp protects student data with industry-standard security measures aligned with the NIST Cybersecurity Framework (CSF):

• Encryption in transit: All data transmitted between student devices and Lessimp servers uses TLS 1.2+ encryption
• Encryption at rest: All student data stored in Google Cloud Firestore is encrypted at rest using AES-256
• Access controls: Student data is accessible only to the student and authorized school administrators. Lessimp staff access is restricted by role-based access control (RBAC) with Firebase Custom Claims
• Audit logging: All access to student data is logged in SOC 2-compliant audit trails
• Data isolation: DOE student accounts are isolated from all non-educational features. DOE students cannot access dating, social, trading, or marketplace features

5. Right Against Commercialization

Lessimp will NEVER:

• Sell student personally identifiable information (PII)
• Use student data for targeted advertising
• Use student data to create a commercial profile
• Share student data with third-party advertisers or data brokers

Student data is used exclusively for the delivery and improvement of educational services.

6. Right to Data Destruction

Upon termination of the data sharing agreement between Lessimp and the NYC Department of Education (or the individual school):

• All student PII will be destroyed immediately (not retained for any period)
• Destruction is documented in a tamper-proof audit log
• A destruction certification is provided to the school/DOE upon request
• Parents may also request individual data destruction at any time by contacting privacy@lessimp.com

7. Right to Breach Notification

In the event of a data breach affecting student data, Lessimp will:

• Notify the NYC DOE within 7 calendar days of discovery (per Ed Law 2-D)
• Notify affected parents within the same timeframe
• Notify the New York State Education Department (NYSED) as required
• Provide a detailed incident report including: nature of the breach, data affected, remediation steps taken, and contact information for follow-up

8. Right to Complain

Parents who believe their rights under Education Law Section 2-D have been violated may:

1. Contact Lessimp directly: privacy@lessimp.com
2. Contact the NYC DOE DIIT School Partnership Program: DIITSPP@schools.nyc.gov
3. File a complaint with the New York State Education Department

9. Third-Party Subprocessors

Lessimp Academy uses the following subprocessors to deliver educational services:

No student PII is shared with any subprocessor not listed above. Lessimp does not use third-party analytics (no Google Analytics, no tracking pixels) on DOE student sessions.

10. Data Minimization and Purpose Limitation

Lessimp adheres to the principle of data minimization:

• Only data strictly necessary for course delivery is collected
• Data is used only for the purpose for which it was collected
• Data is retained only for the duration of the data sharing agreement
• Optional demographic data (for NDEP reporting) is collected only with explicit consent and can be declined without affecting access to courses