1. Implementation of Data Security and Privacy Requirements

TTA, LLC operates Access.AnxietyTraining.com as an educational platform hosted on Thinkific's secure learning management system. We implement data security requirements through a combination of minimal data collection practices and reliance on Thinkific's enterprise-grade security infrastructure.

Our approach:

• Collect only essential student information (name and email address)
• Utilize Thinkific's SOC 2 Type II certified platform for all data processing
• Maintain strict data use limitations aligned with educational purposes only

2. Administrative, Operational and Technical Safeguards

Administrative Safeguards:

• Limited access to student data restricted to authorized TTA personnel only
• Regular review of data access permissions
• Documented data handling procedures

Technical Safeguards (via Thinkific):

• Data encryption in transit and at rest
• Regular security monitoring and threat detection
• Secure data centers with 24/7 monitoring
• Regular security updates and patch management

Operational Safeguards:

• No sharing of student data with third parties beyond Thinkific
• Data used exclusively for course delivery and completion tracking
• Regular backup procedures managed by Thinkific

3. Employee and Subcontractor Training

All TTA employees with access to student information receive training on:

• FERPA requirements and student privacy rights
• Company data handling policies
• Incident reporting procedures
• Confidentiality obligations

Thinkific, as our technology subcontractor, maintains comprehensive staff training on data security and privacy practices as documented in their security policies.

4. Contractual Safeguards

• All TTA employees sign confidentiality agreements covering student data protection
• Our agreement with Thinkific includes data protection clauses meeting educational standards
• Subcontractor agreements (Thinkific) include specific privacy and security requirements

5. Data Security Incident Management

Incident Detection:

• Continuous monitoring through Thinkific's security systems
• Regular review of access logs and system alerts

Response Plan:

• Immediate containment of any suspected breach
• Notification to affected educational agencies within 72 hours
• Coordination with Thinkific's incident response team
• Documentation and analysis of all incidents

Reporting:

• Direct communication to educational agency contacts
• Detailed incident reports including scope, timeline, and remediation steps

6. Data Transition Procedures

When educational agencies request data transfer:

• Export capabilities available through Thinkific platform
• Data provided in standard formats (CSV, PDF)
• Secure transfer methods used for all data transmission
• Verification of successful transfer before any data deletion

7. Secure Data Destruction

Process:

• Data deletion performed through Thinkific's secure deletion protocols
• Multiple-pass overwriting of data storage locations
• Physical destruction of any backup media when required

Certification:

• Written certification provided to educational agencies upon data destruction
• Documentation includes destruction method, date, and verification of completion

8. Alignment with Educational Agency Policies

Our practices align with educational agency data policies by:

• Limiting data collection to educational necessity
• Ensuring data use restrictions match agency requirements
• Providing transparency in data handling practices
• Maintaining compliance with FERPA and state privacy laws

9. NIST Cybersecurity Framework Alignment

TTA, LLC aligns with NIST CSF v1.1 through Thinkific's security framework:

IDENTIFY: Asset management and risk assessment conducted by Thinkific
PROTECT: Access controls, data security, and protective technologies implemented DETECT: Continuous monitoring and anomaly detection in place
RESPOND: Incident response procedures established and tested
RECOVER: Recovery planning and improvement processes maintained

Complete NIST CSF alignment details available in Thinkific's security documentation at: https://www.thinkific.com/security/

Technology Infrastructure

Platform: Thinkific Learning Management System
Security Certifications: SOC 2 Type II, Privacy Shield Framework
Data Centers: AWS with enterprise-grade security controls
Detailed Security Information: https://www.thinkific.com/security/

Contact Information:
TTA, LLC 1373 W. 6th Street,
Erie, PA 16505
info@anxietytraining.com

Document Version: 1.1
Last Updated: 08/01/2024