For student education records supplied by or generated within a partner institution, the institution is the data controller (and the FERPA record owner) and White Coat World is the data processor / School Officialunder 34 CFR § 99.31(a)(1)(i)(B). We process such data only on the institution's documented instructions and for the purpose of providing the service.
We process the categories of student data described in our Privacy Policy (profile, academic metrics, application materials, and engagement data) solely to deliver gap analysis, school matching, faculty review, and outcome reporting. We do not sell, license, or use student data for advertising, and we do not use it to train third-party AI models.
We engage the following sub-processors under written terms that impose data-protection obligations no less protective than this agreement. The same set is described, in plainer terms, in our Privacy Policy and on our Security page; where the three differ in wording they must not differ in membership, and this list governs:
The two entries marked not active are disclosed because activating them is a configuration change rather than a code change; the institution would receive notice before either is enabled. We will likewise give the institution notice of any new sub-processor and an opportunity to object.
Encryption in transit (TLS) and at rest (AES-256); row-level security and least-privilege service-role access; audited access to student records; and defense-in-depth controls described on our Security page. We notify the institution without undue delay upon confirming a personal-data breach affecting its students.
Soft-deleted records are permanently purged within 30 days by a scheduled job; audit-log entries roll off after 12 months. On termination, or on the institution's request, we return or delete institutional and student data. Students may export their own data and permanently erase their account at any time (right to erasure).
We assist the institution in responding to student/parent requests to access, correct, or delete records, and in meeting its FERPA, and where applicable GDPR/CCPA, obligations. Requests should be directed through our contact form, which is the channel we monitor. We also publish security@whitecoatworld.org, but inbound delivery to that address is still being provisioned, so please use the form if you need certainty your request arrived.
This Agreement takes effect on the date of last signature and continues for as long as we process institutional or student data for the Institution. Either party may terminate for material breach on thirty (30) days' written notice if the breach is not cured within that period, and the Institution may terminate for convenience on thirty (30) days' written notice. On termination we stop processing, and within thirty (30) days return or delete institutional and student data at the Institution's election, except where retention is required by law. Sections 4, 5, 6, 8, and 9 survive termination.
Student accounts are not terminated by the end of this Agreement. A student's profile is their own and persists independently; what ends is the institution's access to it and our processing on the institution's behalf.
This is deliberate, and it protects the Institution as much as the student. A pre-health application runs four to eight years and routinely outlasts a student's enrolment, so tying the account's life to the contract would destroy a student's own work — their essays, their logged hours, their plan — for reasons that have nothing to do with them, and would leave the Institution explaining it. The two are separable rather than conflated: education records the Institution supplied, or that were generated within the institutional relationship, are handled under the paragraph above and are returned or deleted at the Institution's election. What persists is the student's own account, which reverts to the direct arrangement described in the Privacy Policy, with White Coat World as controller under that student's own consent and no institutional access until a new agreement and a new consent exist.
Liability under this Agreement is governed by the written services agreement or order form between the parties. Where none exists, Section 11f of the Terms of Use applies: institutional accounts are not subject to the consumer damages floor, disputes proceed under the AAA Commercial Arbitration Rules, and a signed agreement between the parties supersedes the online terms wherever the two conflict. Nothing in this Agreement limits either party's liability for a breach of its confidentiality or data- protection obligations, or for gross negligence or wilful misconduct.
Each signatory represents that they are duly authorized to enter into this Agreement on behalf of the party they represent, and that doing so does not conflict with any other obligation of that party. The individual who accepts the Institutional Account Addendum in the product makes the same representation for the account itself — that Addendum is the agreement actually accepted in-product, and this document is what the parties execute alongside it.
This template becomes binding only when executed by both parties. Until then it is provided for review.
Institution
White Coat World
Privacy Policy · Terms of Use · Institutional Addendum · Security