District addendum and schedule of data

This addendum supplements the privacy policy and the data security and incident response policy. Those two documents are written to apply to any district in any state. This one holds the items that change by district or by state: the data inventory, the named sub-processors, the questionnaire offer, deployment terms, and the Nevada-specific addendum. Where a signed agreement differs from anything here, the signed agreement controls.

The standard roster is limited to the fields used by the service: student name, grade, section, and a school-assigned identifier. We do not request, do not need, and will not accept the following.

• Social Security numbers or any government identification number.
• Health, medical, immunization, or mental-health treatment records.
• Free and reduced-price lunch status, or any other socioeconomic indicator.
• Financial account, payment card, or billing information for students or families.
• Fingerprints and voiceprints. Facial lookup reference images and mathematical face templates are collected only when a district authorizes and enables the optional facial lookup capability, which is disabled by default.
• Disciplinary or academic history imported from another system. Discipline records in the product are only the ones your own staff create inside it.
• Student home addresses, family immigration status, religious affiliation, or juvenile justice records.
• Precise or continuous location tracking of students. Device location is captured only from the staff member's device at the moment they submit an emergency roll call or a safety report.
• Anything used for advertising, marketing, resale, data brokerage, or training systems unrelated to your school's own use.

If a roster file you send happens to contain any of these fields, we drop them on import rather than store them, and we tell you which columns were discarded.

Every data element the application stores, what it is for, and how long it is kept. Districts use this as the line-item checklist an NDPA Exhibit B expects. Anything not listed here is not collected, and we will not begin collecting a new category without telling you first and amending this schedule.

Students do not hold accounts. The only student-facing surfaces are the discipline statement kiosk, which captures only the statement the student types, and the read-only family view, which displays records the school already created.

BreathEasy Administrative Services LLC does not own or operate data centers, servers, or network hardware. The service runs on two major cloud providers, Amazon Web Services and Cloudflare, reached through managed platforms that provision, patch, and monitor those resources on our behalf. Below is the full named list of every third party that touches district data, what each one handles, and where it physically sits.

Provider certifications apply to the infrastructure controls and services identified in those reports. BreathEasy is responsible for application design, access rules, role assignment, data handling, tenant separation, support access, and the policies governing use of the service.

No advertising networks, analytics vendors, data brokers, or social platforms receive any data from the application. Each sub-processor is bound by terms at least as restrictive as our agreement with your district, and none may use district data for its own purposes. We notify district contacts before adding or replacing a sub-processor that handles student data.

BreathEasy Administrative Services LLC does not currently hold its own SOC 2 report. The following supporting information is available for district review.

• Provider assurance: the underlying data centers, physical storage, and network infrastructure operate within environments holding SOC 2 Type II and ISO 27001 certifications. Provider reports are available upon request and apply to the controls and services they cover.
• Self-assessment: completed Consensus Assessments Initiative Questionnaire (CAIQ) v4.1 and HECVAT 4.1.6 are included in the district packet, covering encryption, access control, authentication, backup and recovery, sub-processor management, and incident response.
• Documented controls: the security policy, privacy policy, sub-processor list, Schedule of Data, access-control summary, security logging summary, and incident-response terms are included in the district packet.
• Contract terms: audit rights and district-specific data protection terms are established in the signed district agreement.
• Insurance: cyber-risk and technology errors and omissions coverage is carried through Hiscox with a $250,000 aggregate limit, policy period through February 24, 2027. Certificates of insurance, including certificates naming the district, are issued on request.
• Penetration testing: an independent third-party penetration test of the application has not been performed. A gray-box test would cover application endpoints, authentication and session handling, role enforcement, and multi-tenant separation.
• Governance: the company has two members. One is the designated security officer and incident commander; the other is the designated privacy officer and backup incident commander.
• Network intrusion detection and prevention, host hardening, and configuration monitoring for the underlying infrastructure are provided by Cloudflare and Amazon Web Services under their certified programs. Application-level activity is covered by the security event log.

Download the completed questionnaires from /district-documents, individually or inside the complete packet ZIP. Questions about any answer: help@breatheasy.net.

The written district agreement defines participating schools, programs, roles, enabled modules, data categories, duration, and authorized district contacts before district data is imported.

• Data use begins after the district authorizes the deployment scope in writing.
• Optional capabilities are enabled only when listed in the written district scope and configured during onboarding.
• The privacy, security, export, retention, and deletion terms apply to the authorized deployment scope.
• At contract end, the district receives a full export and live data is permanently deleted within 30 days unless the signed agreement states otherwise.

Our general commitments on detection, notification timelines, and post-incident reporting are in the data security and incident response policy. The following apply specifically to a confirmed breach originating on infrastructure we control.

• We notify the district's designated contact without unreasonable delay and no later than 72 hours after confirming the incident, with what happened, what data was involved, and what we are doing.
• We cooperate fully with the district's own notification duties under state breach-notification law and its contractual obligations, and we provide the factual detail the district needs to write its notices.
• We bear the reasonable cost of forensic investigation of our own systems, and of parent and staff notification and credit monitoring where those costs are attributable to a breach on our infrastructure. Final allocation is set in the signed agreement.
• We do not contact parents or students directly about an incident unless the district asks us to in writing.
• A written post-incident report covering root cause, remediation, and preventive changes follows within 15 business days.

For Nevada districts, the following state-specific terms apply in addition to our general policies. They track the operator obligations in NRS 388.267 through 388.296, originally enacted as SB 463.

• No targeted advertising. We do not serve, and will not permit any third party to serve, behavioral or targeted advertising to students based on any information collected through the service.
• No commercial profiling. We do not build profiles of students for any purpose other than delivering the educational service the district authorized.
• No sale or rental of pupil records. Student data is never sold, leased, licensed, or transferred to data brokers, marketers, or any third party for commercial purposes.
• Deletion within 30 days. On written district request or at contract termination, we securely destroy or return all covered student information within 30 days, and we provide written certification that live records, cached copies, and backups have been purged or rendered permanently unrecoverable.
• District ownership. All student personally identifiable information remains the exclusive property of the local educational agency. We claim no intellectual property rights in uploaded or generated student records.
• School official designation. The district designates the service as a school official with a legitimate educational interest under 34 CFR 99.31(a)(1)(i)(B), which is what allows the district to share records with us without individual parental consent.
• Operators who violate these provisions are subject to civil penalties of up to $5,000 per violation under Nevada law. We accept those obligations contractually.

We serve districts nationwide. The general privacy and security policies are written to be state-neutral so that only this document changes from state to state. We provide the standard NDPA state-specific terms on request, including California (CSDA), Texas (TX-NDPA), Illinois (SOPPA), and New York (Education Law 2-d) addenda. Nevada terms ship by default because that is where the company is organized. Request your state's addendum from sales@breatheasy.net.

BreathEasy Administrative Services LLC
201 Lupin Street, Pahrump, Nevada 89048
Security, privacy, and questionnaires: help@breatheasy.net
Contracts and pilots: sales@breatheasy.net

District addendum and schedule of data version 1.4, effective September 18, 2026. A current copy of this document, plus downloadable PDFs, are available at /district-documents.