Privacy Notice

Visual Minds Learning, LLC ("VML," "we," "our," or "us") is the data controller of the personal information collected through visualmindslearning.com, the VPA™ tools, and the Visual Minds Learning iOS app. This notice explains what we collect, how we use it, who we share it with, and the choices you have.

Information we collect

• Account data: name, email address, hashed password, and (if you sign in with Google) the identifiers Google returns.
• Content you submit: newsletter sign-ups, contact-form messages, VPA™ assessment inputs and generated reports, workshop and consulting inquiries.
• Order and support data: plan tier, subscription status, and support messages. Payment card details are collected by Stripe, not by us.
• Technical data: IP address, device and browser type, pages visited, and referring URL, collected via privacy-friendly analytics.

How we use it

• To create and secure your account and deliver the paid features you purchased (contract).
• To respond to inquiries, provide support, and fulfill requests (contract).
• To send the newsletter and educational updates you opted into (consent).
• To detect and prevent fraud, abuse, and security incidents (legitimate interests).
• To improve the site, courses, and resources (legitimate interests).
• To comply with legal obligations, including tax and accounting (legal obligation).

Who we share it with

We do not sell your personal information. We share it only with the categories of recipients listed below, and only as needed:

• Payment processor — Stripe, Inc. Stripe handles checkout, card processing, subscription billing, and receipts for our orders. When you buy, Stripe collects your payment information and, as required, name, email, and billing address directly from you. See Stripe's Privacy Notice.
• Hosting and infrastructure providers that operate our website, database, authentication, and email delivery.
• Analytics providers that give us aggregate usage information.
• Professional advisers (legal, accounting) where necessary.
• Authorities where required by law or to protect rights, safety, or property.

Data retention

We keep account and order data for as long as your account is active and for a reasonable period after closure to comply with legal, tax, and accounting obligations (typically up to 7 years). Newsletter records are kept until you unsubscribe. Aggregated analytics data may be retained longer as it does not identify you.

VPA™ assessment submissions. Scores, notes, and generated reports you enter into the VPA™ tools are stored in your account so you can revisit them; you can delete an individual student record or report at any time from your Account, and deleted records are removed from active systems within 30 days (residual backup copies are overwritten on our normal backup rotation).

Your rights

Subject to your local law, you may request access to, correction of, or deletion of your personal information; ask us to restrict or object to certain processing; withdraw consent for marketing; and request portability of the data you provided. You can also unsubscribe from any marketing email using the link in that email. To exercise these rights, reach us via the Contact page. If you are in the UK or EEA, you have the right to complain to your local supervisory authority.

International transfers

Our service providers may process data outside your country of residence, including in the United States. Where required, we rely on appropriate safeguards (such as Standard Contractual Clauses or an adequacy decision) to protect that data.

Security

We use appropriate technical and organizational measures — including encryption in transit, access controls, and least-privilege administration — to protect your information. No system is 100% secure, but we work to keep yours safe.

Cookies

We use a small number of cookies and similar technologies: essential cookies to keep you signed in and to remember your preferences, and privacy-friendly analytics cookies. You can manage cookies through your browser settings.

Children

The Service is intended for professional use by adults. It is not directed at children under 13, and we do not knowingly collect information from them.

Student and patient data (FERPA, HIPAA, COPPA)

The VPA™ tools are designed to be used by a professional as part of their own practice — the scored Mini VPA™ and Full VPA™ by a licensed occupational therapy practitioner, and the free Fast Screen by a teacher, TVI, or school team member for triage. Whoever enters the information is the data controller of any information they record about a student or patient; VML acts as a data processor and processes that information only to provide the Service.

• Do not enter direct identifiers. The VPA™ input fields are intended for a non-identifying code or initials, age, and clinical observations. Please do not paste full names, dates of birth, medical record numbers, addresses, social security numbers, or other personally identifiable information about a child.
• FERPA. When a school-based clinician uses the Service to support educational records, VML will handle information provided by the school under appropriate FERPA safeguards and only under a written Data Processing Addendum (DPA). Schools that require a DPA before using the Service can request one via the Contact page.
• HIPAA. The Service is not a HIPAA-covered platform and is not offered under a Business Associate Agreement. Clinicians in HIPAA-covered practices should avoid entering Protected Health Information (PHI) into the Service.
• COPPA. The Service is not directed to children under 13, and we do not knowingly collect personal information directly from children. Clinicians who use the Service to record observations about a child are responsible for obtaining any consents required by their setting.

Consent to administer the VPA™

The VPA™ is designed to be administered by a licensed professional as part of a clinician-authorized evaluation. Whether formal parental consent is required — and in what form — is determined by the clinician's setting and applicable law, not by VML. Common cases:

• School-based OT/TVI evaluations (IDEA/Section 504): Written parental consent is required before a formal evaluation, including evaluations that incorporate the VPA™. Districts should use their existing evaluation-consent form and add a Data Processing Addendum (DPA) with VML.
• General education screening (FERPA "school official" exception): Screening use may fall under the school-official exception when VML is under the district's direct control and bound by a DPA. Districts remain responsible for required annual FERPA notices and directory-information policies.
• Private clinical practice: the clinician follows their own informed- consent process and, if the practice is HIPAA-covered, avoids entering PHI (see the HIPAA note above).

Before starting a VPA™ session, the clinician is asked to confirm on-screen that the required consent/authorization is in place. VML relies on that confirmation and does not independently verify parental consent. A sample consent addendum and DPA are available on request via the Contact page.

Changes

We may update this notice from time to time. Material changes will be posted here with a new "Last updated" date.

Contact

Questions about this notice? Reach us via the Contact page.