---
title: "School and Institution Consent | Ilmiya"
description: "Direct notice, institutional authorization, and parental consent for student use of Ilmiya."
url: "https://ilmiya.com/parental-consent/"
language: "en"
---
# School and Institution Consent
Direct notice, institutional authorization, and parental consent for student use of Ilmiya.
This notice describes the authorization required before a school, education organization, tutoring center, or independent educator enables Ilmiya for a student. The organization or educator contracting with Ilmiya is the **Customer**. The Customer is responsible for selecting an appropriate educational purpose, confirming its authority, and obtaining and retaining the permissions required for that use. Ilmiya remains responsible for the obligations applicable to it as the service operator.
For the educational processing the Customer directs, Ilmiya acts as its processor. If the Customer processes on behalf of another institution, Ilmiya acts as its subprocessor and the Customer must pass on that institution’s authorized instructions. The Customer determines the educational purpose and applicable lawful basis. Contract labels and ownership clauses do not change the duties the law places on either party.
Student access is provided through an approved Customer arrangement. These notices do not establish a public signup route for children. A person accepting a commercial agreement must have legal capacity to contract and authority to bind the Customer. Students who are legally entitled to make their own decisions retain that authority.
## How Ilmiya Is Used by Children
Children use the Services through accounts and activities approved by their school or educator for a defined educational purpose. The Customer selects the curriculum, enables the appropriate features, and supervises its students’ use. The applicable service agreement and [Data Protection Addendum](https://ilmiya.com/data-protection-addendum/) govern the processing instructions. The [Global Privacy Policy](https://ilmiya.com/privacy-policy/) and [Children’s and Students’ Privacy Notice](https://ilmiya.com/privacy-disclosure/) explain the associated information practices.
This framework covers school authorization and parental consent where required, including COPPA requirements for covered collection from children under 13. It also preserves the additional protections that apply to older learners or under another jurisdiction’s law. School authorization is available only within the conditions described below.
## School Authorization as Consent
A school may authorize collection of children’s personal information on parents’ behalf where COPPA permits that authorization for a service used for the school’s benefit and educational purposes. Ilmiya must provide the school with direct notice before collection and verify that the authorization comes from an authorized school representative. School authorization is limited to the disclosed educational use. It cannot permit advertising, unrelated commercial use, or an activity outside the school’s authority.
The Customer must confirm that the approving representative has authority under its own policies and applicable law. A teacher’s employment or possession of a school email address does not, by itself, establish authority to bind the school. The Customer must make the applicable notice available to families and provide any additional notice or parental choice required by law or its policies.
A tutoring center, private organization, or independent educator may authorize processing within its lawful role as a Customer. Its educational purpose alone does not establish authority to consent on a parent’s behalf under COPPA. Where school authorization is unavailable, the Customer must obtain the required parental consent before enabling the relevant collection. The Customer handles notice delivery, legally required verification and consent records, including withdrawal. Ilmiya supplies direct notice and supporting resources.
When the Customer approves or provisions an account, it confirms that the required notices and permissions cover the intended use. It must retain the supporting evidence. That confirmation cannot replace direct notice, legally sufficient parental verification, or an authorization that the approving person lacks. It also cannot permit use of Student Data for sale, advertising, or model training prohibited by the DPA.
## Direct notice before student access
Ilmiya, Inc. supplies curriculum and learning materials alongside software and infrastructure for education and administration. The Customer selects the services and materials used in its learning environment, which may operate entirely under the Customer’s branding. Ilmiya provides the direct notice below. Before enabling student access, the Customer must make the applicable information available to families and identify the features it selects. The notice builder and editable template help the Customer describe its own use.
| Activity | Personal information involved | Purpose and recipients |
| --- | --- | --- |
| Account access and class membership | Name or username, account identifier, assigned role, institution and class membership; contact information where required. | Provide authorized access. Records are available to authorized Customer staff and contracted providers supporting the service. |
| Lessons and learning records | Submitted work, answers, uploaded files, feedback, progress, assessments, and learning profiles derived from the activity. | Deliver instruction and maintain the Customer’s education records. The Customer determines permitted staff and participant access. |
| Communication features | Messages, replies, attachments, participants, and timestamps. | Deliver the selected communication. Intended recipients, authorized administrators, and necessary service providers can process these records. |
| Enabled AI features | Prompts, selected learning context, attachments, responses, stored conversation history, and embeddings where used. | Provide the requested assistance through the applicable AI or search providers. Identifiers are minimized or coded where practicable; content can still identify a learner. |
| Enabled voice features | Submitted audio, transcripts, speech or recitation feedback, and related activity records. | Process the disclosed voice activity through its applicable providers. The feature schedule must identify whether raw audio is stored and give separate retention periods for audio and transcripts. |
| Service operation and support | Account and technical identifiers, connection and device information, sign-in and error records, and support correspondence. | Operate and secure the approved service and resolve support requests. Access is limited to authorized personnel and the providers needed for those tasks. |
Information is supplied by the Customer, families, and students, or generated through their use of an enabled feature. Only information reasonably necessary for the authorized activity may be collected. The Customer must identify which activities apply to its students and disclose any additional collection before enabling it. Optional diagnostic recording requires its own defined purpose and applicable safeguards before use with learners.
The [Children’s and Students’ Privacy Notice](https://ilmiya.com/privacy-disclosure/) provides the detailed data practices. Customer Data is hosted, stored and processed in the United States. The [provider register](https://ilmiya.com/sub-processors-list/) identifies service providers and the features they support. Providers receive only the information needed for their contracted work and must comply with the [Data Protection Addendum](https://ilmiya.com/data-protection-addendum/).
Ilmiya does not sell Student Data or use it for advertising. Third-party providers must not train their models on Customer Data. Ilmiya does not currently train models on Customer Data. A future proposal for customer-specific customization requires separate written terms and any additional lawful authorization before processing starts.
## Direct Parental Consent
Where parental consent is required, the relevant collection, use, and disclosure must not begin without it, except where a specific legal exception applies. The notice supplied to the parent must describe the actual activities being authorized. A signature accepting website terms is not a substitute for that notice or the required verification method.
The Customer administers consent collection and recordkeeping. Where COPPA requires verifiable parental consent, the Customer must use a legally sufficient method to establish that the person consenting is the child’s parent or legal guardian. Ilmiya provides direct notice and simple supporting tools. It does not operate a routine service for collecting or manually reviewing each family’s consent form.
The Customer must retain appropriate evidence and make it available securely where required by law or reasonably necessary to address an authorization issue. The selected method must meet any applicable operator-receipt requirement. Ilmiya retains duties that law places directly on it and may suspend an affected use if required authorization is absent, withdrawn or materially disputed.
When parent contact information is collected solely to request consent, it is used for that purpose. Further collection from the child must wait for the required consent, subject to a specific legal exception. If consent is not obtained within a reasonable period, the contact information collected for that request must be deleted.
Parents must receive the material information about the proposed collection and any required separate disclosure choice before deciding. Consent to a disclosure that is unnecessary to provide the requested service must be separate where the law requires it. Declining an optional use must not prevent access to an activity that can operate without that use. Voice and AI services are optional. A learner may decline or leave them inactive and continue using the core learning service. A Customer must not treat authorization for a core account as activation of either service. This notice does not authorize public sharing, biometric identification, or unrelated secondary use.
## Template for Gaining Parental Consent
Use the [notice and consent builder](https://ilmiya.com/consent-builder/) to add your institution’s details and selected services, then print a one-page form or save it as a PDF. An [editable one-page template](https://cdn.ilmiya.com/legal-downloads/d12d32f3b7cdd069f4c34c36d73bc268068acec3ba0e62ba46e671693bbbb82c/ilmiya-parent-notice-consent.docx) is also available. See the [example below](https://ilmiya.com/parental-consent/#consent-form-example).
The template gives families the material information about the selected service and leaves separate choices for optional AI and voice. Complete the operator contact, relevant features, retention arrangements, and secure return instructions before issue. The Customer distributes the completed notice and manages the required consent through its own legally sufficient process. Retain that notice with the authorization record. The builder does not collect completed family forms.
The [FTC’s COPPA guidance](https://www.ftc.gov/business-guidance/resources/complying-coppa-frequently-asked-questions#N.%20COPPA%20AND%20SCHOOLS) explains school authorization and the operator’s responsibilities. The [COPPA consent rule](https://www.ecfr.gov/current/title-16/chapter-I/subchapter-C/part-312/section-312.5) describes verification methods.
## Teacher Guidance: Ensuring Compliance
Before student access begins, the Customer must:
1. Identify the students and educational purpose covered, including the applicable countries and age requirements.
2. Confirm the approving person’s authority and whether lawful school authorization or parental consent is required.
3. Deliver the relevant direct notice and feature information, arrange required permissions, and retain evidence of the completed process.
4. Limit access to authorized accounts and recipients, apply its safeguarding policies, and review proposed changes before enabling them.
5. Notify Ilmiya promptly of withdrawals, disputed authority, or a material change in the approved use.
### Education records and U.S. school requirements
Where FERPA applies, the school must establish the basis for disclosing education records and retain the control required for that basis. An educator purchasing a tool does not establish the school’s approval or the conditions of the school official exception. The DPA describes Ilmiya’s duties concerning authorized use, redisclosure, and assistance with access or amendment requests. The Customer must also follow applicable student-privacy law and its own recording and safeguarding rules.
## Records
Records must identify the authorizing person, their role, the notice version and feature scope, the date and verification method, and any subsequent withdrawal. The Customer must provide reasonable evidence on request through an appropriate secure channel. Records must remain access-controlled and retained only for a documented lawful purpose.
Each party must protect the authorization evidence it holds and retain it only for its documented purpose or a binding recordkeeping duty. Ilmiya may hold an institutional authorization, a record supplied to resolve a request, or evidence required by the consent method. This does not require routine delivery of every family form to Ilmiya. The Customer remains responsible for securely administering its collection and records.
## Voice recordings and sensitive information
Before recording begins, the Customer must provide required notice and obtain permission from everyone whose information may be captured, including other classroom or tutoring participants. Device microphone permission does not establish those permissions.
The feature notice must explain the use and storage of audio and transcripts separately. Ordinary authorization for a voice activity does not permit voiceprint identification. Information about religious beliefs, health, or disability can arise in learning activities and requires any additional legal condition applicable to that information.
## Requirements outside the United States
The Customer and Ilmiya must meet the laws applicable to their respective activities. U.S. school authorization does not establish a legal basis under EU or UK data protection law. The Customer must identify the lawful basis for processing it controls and any additional condition for sensitive information. Required transfer safeguards must cover the actual processing and access locations.
Where an online service offered directly to a child relies on consent, the applicable age and parental-responsibility rules must be met. The EU GDPR sets a default age of 16, with national laws able to lower it to 13; the UK threshold is 13. These thresholds govern that consent-based processing and do not establish a universal age for education services or contractual capacity.
A school may rely on a public-task or other lawful basis where its law provides one. It must identify that basis rather than treating every activity as consent-based. When consent is the basis, the choice must be freely given and specific; a required lesson must not depend on agreement to an unnecessary use. A general parent approval does not establish a missing condition for information revealing religious beliefs, health, or disability.
Any required privacy impact assessment and safeguards must address the actual features before the affected processing begins. These duties apply to existing activities when a gap is identified as well as to new deployments.
## Parents’ Rights
Parents and eligible students may request access to information, correction, deletion, or cessation of further collection as applicable law permits. Contact the Customer or [legal@ilmiya.com](mailto:legal@ilmiya.com). Ilmiya will assist the Customer and respond directly where required. Identity and authority must be verified before records are disclosed, while protecting other students’ information.
Children also have rights of their own. The person entitled to exercise a right depends on the applicable law, the learner’s capacity, and the record involved. Rights under FERPA can transfer to an eligible student. The [Global Privacy Policy](https://ilmiya.com/privacy-policy/) explains additional rights, response periods, and complaint routes.
## Withdrawal of Consent
The Customer may withdraw its authorization by written instruction. Parents may withdraw consent through the contact supplied with their notice or by contacting Ilmiya. The Customer must promptly communicate a withdrawal affecting the service. The affected collection or use must stop without waiting for the deletion period. If required processing can no longer take place, the associated feature or account may become unavailable; the Customer determines appropriate educational alternatives.
## Retention and deletion
The Customer must specify a lawful retention schedule for the approved educational purpose. Raw audio, transcripts, messages, and AI histories require separate consideration. Children’s personal information must not be retained indefinitely or beyond the purpose for which it was collected.
Ilmiya completes a valid, sufficiently specific deletion request from an authorized Customer contact within 30 calendar days of receipt, including relevant providers and backups, or earlier where law requires. Only a narrowly limited binding legal preservation duty can justify retaining affected records as set out in the DPA. Closing account access does not itself delete shared education records still held for a lawful purpose.
At service end, the DPA provides a 30-day export period. Any restricted recovery copy is limited to a documented lawful need within the original purpose and a maximum of 12 months from actual service end. An earlier deletion request, the end of that need, or an earlier legal deadline shortens the period.
## Changes to This Framework
A material change requiring new authorization must be disclosed and authorized before the changed processing begins. Posting a revised webpage does not provide that authorization or amend an existing Customer agreement by itself.
**Operator:** Ilmiya, Inc., 3800 American Blvd West, Suite 1500, Bloomington, MN 55425, USA. Contact [legal@ilmiya.com](mailto:legal@ilmiya.com) or use the [legal inquiry form](https://ilmiya.com/legal-inquiry/).
## A notice for your families
Start with this one-page example. Add your institution’s details and the services you select in the [notice and consent builder](https://ilmiya.com/consent-builder/), or [download the editable template](https://cdn.ilmiya.com/legal-downloads/d12d32f3b7cdd069f4c34c36d73bc268068acec3ba0e62ba46e671693bbbb82c/ilmiya-parent-notice-consent.docx).
**Your institution**For families
## Student learning notice
Parent notice and consent
Institution address
Contact person · Email · Telephone
### How we use the platform
Our institution uses a contracted education platform for the educational activities described here. Please return your choices to us. Where parental consent is required, the relevant collection, use and disclosure will not begin without it.
### Information used for learning
Lessons, curriculum activities and other core services use your child’s name or username, institution and class details, submitted work, feedback and progress. Selected communication features use messages and attachments. Account, device and connection records help operate and protect the service.
Our authorized staff and intended recipients can access the relevant records. Our platform provider, Ilmiya, processes information under our instructions, using contracted providers for the services we select. The information is hosted, stored and processed in the United States. Student information is not sold, used for advertising or used to train Ilmiya or provider AI models. This form does not authorize public sharing or biometric identification.
### Retention and your rights
**Our retention arrangements:** State the relevant periods and deletion process.
Contact us or legal@ilmiya.com to request access, correction or deletion, or to withdraw permission for future collection. A required activity may end if its processing can no longer continue. Optional AI and voice can remain off while your child uses core learning.
### Your choices
I authorize the core learning use described above.YesNo
AI and voice features are outside the scope of this form.
I am the parent or legal guardian and have authority to make these choices.
Student name
Parent or guardian
Signature
Date
**Return to:** Institution contact and secure return method.
**Platform provider: Ilmiya, Inc.** · 3800 American Blvd West, Suite 1500, Bloomington, MN 55425, USA
legal@ilmiya.com · Telephone: Complete before issue
[ilmiya.com/privacy-disclosure](https://ilmiya.com/privacy-disclosure/) · [ilmiya.com/sub-processors-list](https://ilmiya.com/sub-processors-list/)
[All legal documents](https://ilmiya.com/legal/)[Contact legal](https://ilmiya.com/legal-inquiry/)
---
[View this page on Ilmiya](https://ilmiya.com/parental-consent/) · [All pages in Markdown](https://ilmiya.com/markdown-index.md)