ABOUT THIS POLICY

The Brainchild Collective (“TBC”) is a Chicago-based organization that delivers arts-based and leadership development programs in Chicago Public Schools (CPS) through the Out-of-School Time (OST) framework. We are committed to protecting the privacy and security of the students we serve.

This Privacy Policy describes how TBC collects, uses, stores, and protects information in connection with our programs and services. It applies to information collected through our programs, website, and any related communications.

INFORMATION WE COLLECT

Program Participation Data

In delivering OST programs, TBC collects limited information directly from program participants and their schools to facilitate program enrollment, attendance tracking, and reporting. This may include:

• Student first and last name

• Grade level

• School name

• Program enrollment and attendance records

• Age or date of birth (where required for program eligibility)

Internal Assessment Data

TBC conducts its own internal program assessments to evaluate student learning and program quality. These assessments are created and administered by TBC staff and are not sourced from CPS student records systems. Assessment data is collected for the purpose of program evaluation and improvement only. Individual assessment results are stored at an anonymized, aggregated level for reporting purposes.

What We Do NOT Collect

TBC does not collect the following data categories in the course of delivering OST services:

• Student academic grades or test scores from school records

• Student login credentials or passwords for CPS or school systems

• Student financial information

• Social Security numbers or government ID numbers

• Sensitive health or medical information (beyond basic emergency contact needs)

HOW WE USE STUDENT DATA

Information collected by TBC is used solely for the following purposes:

• Program delivery—to enroll students, track attendance, and manage day-to-day program operations

• Program reporting—to report program participation data to CPS and other authorized partners in compliance with our agreements

• Program improvement—to evaluate program quality and student outcomes using internally generated, aggregated assessment data

• Compliance—to meet legal obligations under SOPPA, FERPA, and applicable CPS contractual requirements

TBC does not use student data for marketing, advertising, or commercial purposes. TBC does not sell student data to any third party.

DATA SOURCES

TBC does not receive or access student records directly from CPS student information systems. Program participation data (names, grade levels, school, attendance) is collected directly from students and school staff at the point of enrollment. Internal program assessments are designed, administered, and stored by TBC independently of CPS data systems.

If TBC is provided access to CPS systems (such as Aspen) for data entry purposes, TBC will only enter program participation data as authorized and will not export, copy, or use CPS student records for any purpose outside of the authorized scope.

DATA SHARING & THIRD PARTIES

TBC does not share individually identifiable student data with third parties except in the following limited circumstances:

• With Chicago Public Schools (CPS), as required by our vendor agreement, for program participation and attendance reporting

• With subcontractors or program staff who are directly involved in delivering TBC programs and who are bound by confidentiality obligations

• As required by law, court order, or government authority

Any third party with whom TBC shares student data is identified in our Student Data Exhibit (Attachment K), filed with CPS as part of our vendor agreement. No unauthorized third party will have access to student data.

DATA SECURITY

TBC implements reasonable and appropriate administrative, technical, and physical safeguards to protect student data against unauthorized access, disclosure, alteration, or destruction. These measures include:

• Restricting access to student data to authorized staff and contractors on a need-to-know basis

• Securing physical and digital records containing student information

• Not transmitting student data via unencrypted email

• Training program staff on student data privacy obligations

DATA RETENTION AND DELETION

TBC retains student program participation data only as long as necessary to fulfill the purposes described in this policy and to meet our contractual and legal obligations. In accordance with our agreement with CPS:

• Student data received from or through CPS will be deleted or returned to CPS at the end of each academic year, or within 10 calendar days of the termination or expiration of our agreement, whichever is later

• Internally generated program assessment data is retained in anonymized, aggregated form for program evaluation purposes

Requests for data deletion may be submitted to TBC’s designated data request manager. TBC will process deletion requests within seven (7) calendar days of receipt, in accordance with SOPPA requirements.

PARENT & GUARDIAN RIGHTS

Parents and guardians of students enrolled in TBC programs have the right to:

• Request access to their child’s program participation records held by TBC

• Request correction of inaccurate information

• Request deletion of their child’s data (subject to legal retention requirements)

• Receive notice in the event of a data security breach affecting their child’s information.

To exercise any of these rights, please contact TBC using the information below.

CONTACT INFORMATION

For questions about this Privacy Policy, to exercise your data rights, or to report a privacy concern, please contact:

 The Brainchild Collective, Ltd.

Attn: Data Request Manager

Email: debra@prismaticmovement.org

UPDATES TO THIS POLICY

TBC may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or program operations. We will post the updated policy on our website and note the revised effective date at the top of this document. Continued participation in TBC programs following any update constitutes acceptance of the revised policy. The current version of this policy is always available at brainchildcollective.co/privacy.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

© 2026 The Brainchild Collective, Ltd. All rights reserved.