Whitecoat Technologies, Inc. (“Whitecoat,” “we,” “our,” or “us”) respects your privacy and is committed to protecting it through the practices described in this Privacy Policy (“Policy”). This Policy explains how we collect, use, retain, and disclose Personal Information when you visit our website (https://www.whitecoatai.com/) or use the Whitecoat Learning Platform application (https://app.whitecoatai.com/) (together, the “Services”).
We provide our Services to universities, schools, school districts, health care organizations, health systems, and other customers (each a “Program”). Whitecoat primarily acts as a service provider to these Programs and processes Personal Information on their behalf. Programs are responsible for obtaining any necessary consents and for responding to privacy rights requests related to data they control. Users include students and other learners, educators, administrators, preceptors, and other individuals whom a Program permits to access the Services (“Users”).
Information a Program creates about a learner, such as evaluations and competency ratings, belongs to that Program. Information a learner enters about themselves belongs to the learner. Section 1 explains this in more detail.
By using or accessing the Services, you acknowledge and accept this Policy. If you do not agree with it, do not use the Services.
“Personal Information” means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household.
Whitecoat primarily provides the Services as a service provider to Programs and processes Personal Information pursuant to contracts with those Programs. With respect to the Platform, Programs determine the purposes and means of processing. For limited website interactions such as basic analytics and contact forms, Whitecoat may act as a business under certain state privacy laws.
Where a Program is subject to the Family Educational Rights and Privacy Act, Whitecoat acts as a “school official” with a legitimate educational interest under 34 C.F.R. § 99.31(a)(1)(i)(B). We perform a function the Program would otherwise perform using its own employees, we remain under the Program’s direct control with respect to education records, and we do not redisclose education records except as FERPA permits or as the Program, learner, or a learner’s parent or guardian directs.
Information a Program or its faculty, staff, or preceptors create about a learner belongs to the Program and may also be an education record. Information a learner enters about themselves — profile details, self-assessments, portfolio work, credentials they upload, curriculum vitae, and stated career interests — belongs to the learner. System logs and usage data generated by operation of the Platform belong to Whitecoat.
This Policy applies to our website and the Platform, including communications with us and any digital properties we operate where this Policy is posted. It does not apply to a Program’s separate websites, systems, or services.
| Category | Examples |
|---|---|
| Identifiers and Contact Information | Name, email address, mailing address, phone number, account username. For a learner a Program identifies as under 18, the date on which the learner turns 18. We do not collect or request date of birth. |
| Parent or Guardian Information | Where a learner is under 18: parent or legal guardian name, email address, phone number, and relationship to the learner, provided by the Program. |
| Employment and Educational Information | Title, credentials, specialty, clinical affiliations, educational records, work status and history, rotation and placement records, assessments and competency ratings, pass or fail status of eligibility requirements (for example, pass or fail only of background checks or drug screenings). |
| Commercial Information | Records of services used, surveys, assessments. |
| Visual Information | Photograph or profile image, if a User chooses to upload one. |
| Internet and Network Activity | Device data, IP address, general-level geolocation, log and usage data, interactions with the Services. |
| Inferences | Preferences and usage trends derived from interaction with the Services, used to operate and improve the Platform. We do not create profiles of K-12 students except for a school purpose. |
| Consent and Authorization Records | Records of acceptance of our Terms of Use and of any authorization to share information with an employer, including the categories authorized, the recipient or class of recipients, the date, and any withdrawal. |
| Sensitive Personal Information (only if a Program directs it) | We do not request Social Security numbers, financial account numbers, protected health information, or patient-identifying information. Where a Program directs collection of licensure numbers or similar identifiers, we process them only as that Program directs and not for our own purposes. |
We collect Personal Information (a) directly from you, for example through account registration and communications; (b) from your Program, for example through account provisioning and program data; (c) from a parent or legal guardian, where a learner is under 18; and (d) automatically from your device and interactions with the Services, for example IP address and pages viewed. Your Program may instruct us to collect additional Personal Information through the Services for program, compliance, or accreditation purposes.
We use Personal Information as a service provider to your Program and, for limited website interactions, to operate our website. Typical uses include:
We compute statistics from information on the Platform to operate and improve the Services, develop new features, and produce benchmarking and research. Those statistics never describe fewer than five individuals, never contain an individual-level record, and are not attributed to a Program outside that Program without its permission. We do not attempt to re-identify anyone from them, and we contractually prohibit recipients from doing so.
We do not sell Personal Information. We do not share Personal Information for cross‑context behavioral advertising or targeted advertising. We do not use Personal Information to market other products to learners. We do not use Personal Information to build a profile about an individual for use outside the Services.
The Platform includes AI-assisted features, including the Grace assistant and automated assessment features.
We will tell any Program on request which Platform features involve AI processing and which service providers support them.
We and our service providers use cookies, pixels, and similar technologies to operate and improve our public website. You can manage preferences using your browser settings and through the cookie banner on our website.
| Cookie type | Purpose |
|---|---|
| Necessary | Enable core site functions and security. |
| Preferences | Remember settings such as language. |
| Statistics (analytics) | Measure usage and improve performance. |
| Marketing | Support limited marketing and retargeting activity on our public website only. Enable or disable through the cookie banner. |
The cookies above are used on our public website at whitecoatai.com. Within the Whitecoat Learning Platform we use only cookies that are strictly necessary to operate the application and keep it secure. We do not use marketing or retargeting cookies inside the Platform, and we do not use them in connection with any K-12 student.
Do Not Track. Our systems do not respond to browser “Do Not Track” signals at this time.
Session replay and heatmaps. We may use session analytics tools such as Microsoft Clarity on our public website to understand aggregate usage, for example clicks and scrolls.
We disclose Personal Information in the circumstances below. We do not sell Personal Information.
| Recipient | Purpose of disclosure |
|---|---|
| Your Program | To enable and manage your participation in the Program’s activities and obligations. |
| Employers, accreditation bodies, and licensing bodies | Only where you, or your parent or legal guardian if you are under 18, have authorized the disclosure. See Section 8. |
| Service providers | Website hosting, content delivery, cloud infrastructure, and AI model hosting (Amazon Web Services), website form handling and lead storage (Cloudflare), identity and authentication, marketing and CRM for our website (for example, HubSpot), website analytics (for example, Google Analytics), demo scheduling (Calendly), email and messaging (for example, SendGrid), payment processing, and customer support (for example, Intercom). We maintain a current list of service providers that process Program information and make it available to any Program on request. |
| Affiliates and successors | In connection with mergers, acquisitions, or asset transfers. |
| Legal and compliance | To comply with law, respond to lawful requests, enforce terms, and protect rights and safety. |
Service providers are bound by written agreement to data-protection obligations no less protective than those we owe your Program, and may process information only to deliver the Services at our direction. Engaging a service provider on those terms is not a sale or an unauthorized sharing of your information.
The Platform can share information from a learner’s record with a prospective or current employer, an accreditation body, or a licensing body. This never happens automatically.
Where an authorization covers a group of partner organizations, the current list of those organizations is available from the Program at any time.
The Services are available to individuals 18 years of age or older, and to individuals under 18 who are enrolled in a Program where a parent or legal guardian has accepted our Terms of Use on their behalf. We do not offer the Services to children under 13, and a Program may not enroll a learner under 13 without a separate written agreement with us addressing the Children’s Online Privacy Protection Act.
We do not collect or request date of birth. The Program identifies to us any learner who is under 18 and tells us the date that learner turns 18. Absent that identification, we treat a learner as 18 or older.
While a learner is under 18, the parent or legal guardian exercises the choices described in this Policy on that learner’s behalf, including any decision to share information with an employer. This follows FERPA, under which a parent’s rights transfer to the student when the student turns 18 or enrolls in a postsecondary institution. When a learner turns 18, those rights transfer to the learner, and any authorization previously given remains in effect until the learner changes it.
The Platform shows a learner, on a read-only basis, what has been shared about them and with whom. A learner cannot change a parent’s or guardian’s decision.
Where a Program serves students in kindergarten through grade twelve, the following applies to information about those students:
For Programs in Tennessee, these commitments are intended to align with the Student Online Personal Protection Act, Tenn. Code Ann. § 49-1-708. Programs in other states may be subject to additional requirements, which we address in the Program’s agreement with us.
This section applies only to California residents. Whitecoat primarily acts as a service provider for Platform data; please direct requests about Platform information to your Program. For limited website interactions where Whitecoat acts as a business, the disclosures and rights below apply.
| Category | Examples | Sources | Business purposes | Disclosed for a business purpose? | Sold or shared? |
|---|---|---|---|---|---|
| Identifiers and contact | Name, email, phone | You; Program | Account setup, support, security, communications | Yes, to service providers and your Program | No |
| Parent or guardian information | Name, email, phone | Program; parent or guardian | Consent administration for learners under 18 | Yes, to your Program | No |
| Employment and education | Title, credentials, records, assessments | Program; you | Program operations, compliance | Yes, to your Program and service providers | No |
| Commercial records | Transactions, services used | You; Program | Fulfillment, records, support | Yes, to service providers | No |
| Visual | Profile photo you upload | You | Profile display, identity confirmation | Yes, to your Program and service providers | No |
| Internet and network | IP, device, usage data | Your device | Site operation, security, analytics | Yes, to analytics and hosting providers | No |
| Inferences | Preferences from use | Derived | Operate and improve the Services | Yes, to service providers | No |
| Consent records | Authorizations and withdrawals | You; parent or guardian; Program | Administering and evidencing consent | Yes, to your Program | No |
| Sensitive PI (only if a Program directs) | Licensure IDs, background check status | Program; you | Program and compliance needs | Yes, to your Program and service providers | No |
Where a learner or a parent or guardian authorizes sharing with an employer, accreditation body, or licensing body under Section 8, that disclosure is made at their direction and is not a sale or a sharing for cross‑context behavioral advertising.
Retention. We retain Personal Information for the minimum period necessary to fulfill the purposes described above, or longer if required by law or by your Program. See Section 14.
Platform data: submit requests to your Program. Whitecoat will assist as required by law. Website data: write to support@whitecoatai.com. We will verify your identity, and the authority of any authorized agent, before fulfilling a request, and will respond within 45 days, with a possible 45‑day extension where permitted.
| Category of Personal Information | Categories of recipients | Purpose |
|---|---|---|
| Identifiers and contact | Service providers; your Program | Provide Services, support, security, communications |
| Parent or guardian information | Your Program | Consent administration for learners under 18 |
| Employment and education | Your Program; service providers; and, at your direction, an employer or accreditation or licensing body | Program operations, compliance, and authorized employer sharing |
| Commercial records | Service providers | Fulfillment, records, support |
| Visual | Your Program; service providers | Profile display, identity confirmation |
| Internet and network | Hosting and analytics providers | Operation, security, analytics |
| Inferences | Service providers | Operate and improve the Services |
| Consent records | Your Program | Administering and evidencing consent |
| Sensitive PI (only if a Program directs) | Your Program; service providers | Program and compliance needs |
We do not disclose Personal Information to third parties for their own direct marketing purposes. To inquire further, contact support@whitecoatai.com.
We do not offer programs that provide financial incentives or price or service differences related to the collection, retention, sale, or sharing of Personal Information.
Residents of states with comprehensive privacy laws, including Colorado, Connecticut, Virginia, Utah, Tennessee, and others, may have rights to access, correct, delete, and obtain a copy of Personal Information, and to opt out of targeted advertising, sale, and certain profiling. For Platform data, submit requests to your Program. For website data, contact support@whitecoatai.com. We will verify and respond within applicable timeframes. You may appeal a denial by writing to support@whitecoatai.com with “Privacy Appeal” in the subject line.
Several states also have laws specific to student information. Our commitments for K-12 Programs are described in Section 10.
We implement technical, organizational, and physical safeguards designed to protect Personal Information, including role-based access controls, individual named credentials, encryption in transit and, where stored, at rest, logging of access by our personnel, and background screening and confidentiality obligations for staff with access. We review our security program at least annually. No method of transmission or storage is fully secure.
Access by Whitecoat personnel to identifiable Program information is limited to defined support purposes such as responding to a support request, diagnosing errors, provisioning accounts, and investigating security incidents. That access is logged. It does not extend to product improvement or marketing.
Information is stored and processed within the United States. We do not transfer information outside the United States, or permit access to it from outside the United States, without the Program’s written consent.
Please maintain the confidentiality of your credentials and notify your Program promptly of any unauthorized access. Security concerns may also be sent to security@whitecoatai.com.
We retain Personal Information for the minimum period necessary to fulfill the purposes described in this Policy, or longer if required by law or by your Program. Retention periods may be determined by regulatory, accreditation, or program requirements applicable to a Program.
The Services may contain links to third-party websites or platforms. Their privacy practices are governed by their own policies. Review those policies before submitting information to third parties.
We may update this Policy from time to time. If we make material changes, we will post the updated Policy, update the version and effective date above, and provide additional notice as required by law. Where a Program has an agreement with us, that agreement governs the effect of any change to this Policy on that Program.
Questions about this Policy or our privacy practices may be directed to support@whitecoatai.com, or to Whitecoat Technologies, Inc., 753 Glen Oaks Dr., Franklin, TN 37067. For requests about Platform data, please contact your Program Administrator.