CRM and practice management platforms

A practice-management platform holds more student data than any other tool you use: every student, every family note, every document, for years. That concentration is what makes the boring clauses (retention, business transfer, de-identification) matter most here.

Concentration changes the questions. A breach of an essay tool exposes essays; a breach of your CRM exposes your entire practice, and years of former clients besides. The same logic applies to quieter events than a breach: if the vendor is acquired, everything transfers at once, and if your contract ends, what happens to a decade of archived families depends on a retention clause you probably have not read yet. Before trusting one, know how long records live after you close them, what "delete" actually does to an archived student, and who the data belongs to if the company changes hands.

Start with these explainers

• What "de-identified" student data actually means

  Platforms keep de-identified data forever. How de-identification works, why small groups re-identify easily, and the questions that reveal the difference.

• "We never sell your data": it depends what "sell" means

  Sharing data with partners for something of value can count as selling under state law, or not count under a policy's own definition. How to read the claim.

• The bankruptcy clause: what happens to student data when a platform folds

  Most privacy policies let data transfer in a merger, acquisition, or bankruptcy. What the clause looks like and what happened when the FTC intervened.

• Does FERPA protect your students' data? For IECs, mostly no

  FERPA binds schools that take federal funds, not independent educational consultants. What actually protects the data families hand to your practice.

• What SOC 2 does and does not tell you about student data

  SOC 2 is an audit of security controls the company chose, not a promise about what it may do with student data. What the badge covers and what it never can.

• Does deleting an account actually delete student data? start here

  Many platforms honor deletion requests by removing the name and keeping the rest. How to tell which kind of delete a policy actually promises.

Demoing a CRM? Bring the checklist, and ask the retention question first: what happens to a family's records two years after they leave your practice. The checklist and the prompt pack are both free and printable.