Back to Gardenia
DRAFT — not yet reviewed by legal counsel

FERPA Notice

Last updated: 2026-04-23

The short version. FERPA protects records held by a school. Gardenia is not a school — we're a private service that helps you organize records you requested from the school. FERPA doesn't apply to Gardenia directly, but we treat your child's records with at least the same care. Nothing you upload here is shared with anyone without your explicit permission.

1. What FERPA is

The Family Educational Rights and Privacy Act (FERPA), 20 U.S.C. § 1232g, is a federal law that protects the privacy of student education records. FERPA applies to educational agencies and institutions that receive federal funding — principally public K-12 schools, public post-secondary institutions, and some private institutions that accept federal funds.

FERPA gives parents (and students 18+) several rights:

  • The right to inspect and review their child's education records maintained by the school, generally within 45 days of a request (34 C.F.R. § 99.10).
  • The right to seek amendment of inaccurate or misleading records.
  • The right to consent in writing before a school discloses personally identifiable information from education records, subject to specific exceptions (§ 99.30).
  • The right to file a complaint with the U.S. Department of Education's Student Privacy Policy Office if the parent believes the school has failed to comply with FERPA.

2. Gardenia is not a FERPA-covered entity

Gardenia Joy, LLC is a private software company. Gardenia is not:

  • A school.
  • A local educational agency (district).
  • A state educational agency.
  • An entity acting as a "school official" or "contractor" under the direct control of a school that has received federal funds.

FERPA therefore does not apply to Gardenia directly. Gardenia does not maintain official student education records as a covered entity. We maintain parent-uploaded copies of records — which is a different legal status.

3. How records arrive on Gardenia

Records end up on Gardenia by one path only: you, the parent or guardian (or in some cases, a teacher or advocate with appropriate authorization), request records from the school under FERPA, receive them, and then upload them to your Gardenia vault. The school's disclosure to you was a FERPA disclosure. Your choice to upload those records to Gardenia after the fact is a personal-storage decision — FERPA no longer governs the records once they leave the school and enter your control.

4. How Gardenia treats uploaded records

Even though FERPA doesn't apply directly, we treat uploaded records with at least the same care:

  • Encryption at rest (AES-256) and in transit (TLS 1.2+).
  • Row-Level Security at the database layer — cross- account reads are structurally prevented, not just policy-restricted.
  • Disclosure only on your explicit direction. Nothing uploaded to your vault is shared with any third party without a specific action from you (such as "share this document with my advocate" or "send this letter to the school").
  • Audit trail of every view, edit, download, and share of each document — viewable by you in Settings → Activity.
  • Right to delete. You can delete any uploaded document at any time.
  • No use for AI training. Your child's evaluations, IEPs, and reports are never used to train general-purpose AI models. See our Privacy Policy.

5. Sharing records with advocates, teachers, or attorneys

Gardenia supports adult-to-adult sharing in limited ways:

  • Consult attachments. When you book a 1:1 consult and attach a document, that document is made available to the advocate (typically Nicole Burch) for the duration of the consult and any follow-up. This sharing is logged in your Activity view.
  • Ask Nicole attachments. Same mechanism — the document is attached to your question and visible to the answering advocate.
  • Team / family account sharing is not currently enabled. When it is, you will control exactly what any co-account- holder (spouse, grandparent, advocate-on-retainer) can see.

We do not:

  • Share your records with the school automatically.
  • Share your records with other parents, even if their child attends the same school.
  • Allow any third party to "subscribe" to your records feed.

6. If a school asks for records we hold

If a school, district, state agency, or other educational entity contacts Gardenia asking to see records in your account, we will not disclose them absent your explicit consent or a lawful court order, warrant, or subpoena. You will be notified whenever we receive such a request unless we are legally prohibited from notifying you.

7. Requesting records FROM your school

FERPA's 45-day response rule is a powerful tool parents often underuse. Gardenia's letter templates include a records-request letter (Module 01 and Module 10 of the Parent Advocate 101 course both use it) that cites 34 C.F.R. § 99.10 and starts the clock. Sending a written records request to the school:

  • Starts a 45-day federal response deadline.
  • Creates a paper trail you can use in any subsequent dispute.
  • Triggers the school's obligation to explain what records exist and in what format.

8. Correcting records the school holds

FERPA gives you the right to request that the school amend inaccurate or misleading records. Gardenia does not directly submit amendment requests to schools — that is a conversation between you and the school. We do, however, provide:

  • A letter template to formally request an amendment.
  • A template to formally invoke your right to a FERPA hearing if the school declines to amend.
  • Guidance on how to insert a statement of disagreement into the record if the hearing does not resolve in your favor — the school is required to keep your statement with the record.

9. Records retention after account closure

When you close your Gardenia account, records you uploaded are purged from live systems within 30 days and from backups within 90 days. See our Privacy Policy § 7.2 for full details. You can export everything first with one click via Settings → Data Export.

10. Questions

Questions about how Gardenia handles records: privacy@gardenia.joy.

Questions about FERPA itself or a school's FERPA compliance: U.S. Department of Education, Student Privacy Policy Office: studentprivacy.ed.gov.

This FERPA notice is a draft prepared for Gardenia's internal review. FERPA interpretation is nuanced — in particular, the line between a "private service holding parent-uploaded copies" and "a contractor acting as a school official" can depend on the specific integrations Gardenia offers to schools in the future. Before this document appears in production, it should be reviewed by counsel experienced in ed-tech privacy law. The "DRAFT" marker stays until that review is complete.