Has anyone else dealt with these?? They’re NFC, track how long they’re in the bathroom, and where they are. I dont know what company this is through, nor what they are doing with all the data they’re collecting. They also use things called smart passes. I’m thinking about emailing the school district and not allowing them to make my child use them. It seems invasive and creepy. :( If anyone has any advice how to approach this, please let me know. Or knows about them in general. I just don’t trust it. Thank you!!

Also!! Would super appreciate helping me lay out properly communicated points, as I am not a confrontational person, and am very mad. I’m worried I’ll just sound like I’m pitching a fit for no reason. I never want to be that parent that is dreaded by schools. But this is important. Especially due to my more sensitive situation (my children are foster kids)

Edit for FAQ:

• each kid gets an individual digital pass, it records their geolocation, behavioral problems, responses to medical questionnaires, and it can be shared with 3rd parties according to their privacy policy. (Students are considered “customers”)

• I’m from the US.

• they are supposed to wear it all day, every day and check in every place they go with kiosks.

• they are also being limited to 3 bathroom breaks a day… So I guess fuck you if you’ve got heavy periods or IBS. And you can’t go in between classes. Bathrooms will be locked unless it’s an emergency, but you have to have a teacher override the lock. Which isn’t exactly how an emergency works.

• one of my biggest concerns as someone in the US is a school shooter situation where they get access to this system and now they can pinpoint where every kid is and is going. Can prevent stragglers.

My email to the principal (I will be doing a follow up about the health problems)

Hello Principal,

This is Blah463.I have several concerns about this smartpass system and the general bathroom break policy. While I understand the issues posed by students being able to go to the bathroom freely, I believe an old school solution would be better and not as concerning (like signing out of the classroom). I believe it is through Raptor Technologies, though please correct me if I am wrong.

I apologize if this comes across as harsh, as I am honestly quite angry I was not even asked permission for this. I would have declined. This puts my and every other student in danger, risks data breaches, makes it more difficult for students to use the bathroom (despite this showing to have negative effects on their urinary health, and makes them less likely to properly hydrate).

Here is Raptor Technologies’ Privacy Policy, I will be citing it directly throughout this email. https://apps.raptortech.com/About/Privacy

Their Privacy Policy

Starting directly with their privacy policy, as this INCLUDES students and their information. “Customer Information may relate to different types of individuals, including Customers’ staff, volunteers, visitors, students, parents/guardians, and other individuals.” They follow COPPA (https://www.ftc.gov/legal-library/browse/rules/childrens-online-privacy-protection-rule-coppa) for students under 13, which means the company is less restricted on their data collection and use for anyone 13 and older, as they no longer fall under these guidelines. There should ALWAYS be a requirement for the student, at the very least, to CONSENT to their data being collected.

What Data is Collected?

According to their privacy policy, the customer information that may be collected (which once again, includes students):

• Attendance and hall pass information, such as dates and times of arrival and departure, attendance in classes, and hall pass permissions.

• Dismissal information, such as pick-up times, persons and vehicles authorized for pick-up, and confirmation of pick-up.

• Health screening responses, such as any symptoms individuals report as part of a health screening process or service. (This one is of special concern, what about HIPAA? https://www.hhs.gov/hipaa/for-individuals/guidance-materials-for-consumers/index.html)

• “What Rights Does the Privacy Rule Give Me over My Health Information?”

THIS DOES NOT APPLY TO SCHOOL DISTRICTS, I DO NOT CARE ABOUT THE SCHOOL HAVING MEDICAL INFORMATION, IT IS THIS 3RD PARTY COMPANY I HAVE CONCERNS ABOUT.

"Receive a notice that tells you how your health information may be used and shared.

Decide if you want to give your permission before your health information can be used or shared for certain purposes, such as for marketing"

• Behavioral health information, such as bullying, disrespectful behavior, depression, or other inappropriate or concerning behavior. (Once again, this is a HIPAA concern.)

• Geolocation information, If enabled, our Services will collect information about precise geolocation to provide certain location-enabled features, such as the user’s location during an emergency.

• Usage information, including information we log automatically when individuals use any applications in connection with the Services, such as the times and frequency of access to the application, interactions with application features, and other technical information.

How Customer Information is Used

- "Allowing Customers to...manage attendance, hall passes and dismissal processes; undertake health screenings; prepare for, respond to, and recover from emergencies; identify student wellbeing concerns, and develop and engage in compliance and training initiatives;"

How They Share Customer Information

• “At the direction of the Customer. Our Customers may direct us to integrate a Service with third-party offerings, software, or applications. In such cases, we will share Customer Information with those third parties at the Customer’s direction.” Meaning, once again, you would not inform parents properly of where their child(ren)'s information is being stored or shared.

• “In the event of a corporate transaction. In the event of a corporate divestiture, merger, consolidation, acquisition, reorganization, sale or other disposition of all or any portion of our business or assets, we may share Customer Information with acquirers and other relevant participants in the transaction.” According to Liz Mineo from the Harvard Gazette, “…while customers have made the decision to share with 23andMe, from whom they get a lot of benefit, they really have very little say about what will happen should the company be taken over or should the company go bankrupt, and its assets sold,” as an example of how data can STILL be shared with 3rd parties, even if the company IS reputable. Which Raptor Technologies is NOT.

Raptor Technologies’ Past Data Breach (Jan 2024)

Here are several articles reporting about their data breach in 2024, exposing millions of school records including: safety procedures, student medical files, and court documents. This is unacceptable. This is why this information SHOULD NOT all be stored TOGETHER on a private company's off-site servers.
https://www.wired.com/story/us-school-shooter-emergency-plans-leak/
https://www.edweek.org/technology/a-massive-data-leak-exposed-school-lockdown-plans-what-districts-need-to-know/2024/01
https://hackread.com/texas-school-safety-software-data-leak/
https://www.techradar.com/pro/security/school-software-breach-reveals-private-data-on-millions-of-users
https://www.k12dive.com/news/raptor-technologies-school-safety-data-leak/704790/
https://www.twingate.com/blog/tips/Raptor-data-breach "The data exposed in the breach included school lockdown plans, student medical records, information on students flagged as posing a threat on campus, evacuation plans, court documents outlining family abuse and restraining orders, names and ID numbers of staff, parents, guardians, and students, details about school security measures, drivers licenses of school visitors, active shooter response plans, campus maps and CCTV locations, locations and descriptions of "safe rooms," emergency contact lists, layouts of schools or classrooms, infrastructure issues, monthly drills, safety protocol violations, background check details, and information on at-risk students."
https://databreaches.net/2024/01/11/us-school-shooter-emergency-plans-exposed-in-raptor-technologies-data-leak/


THIS WAS NOT EVEN FROM HACKING. This was the company publishing these documents by accident on a PUBLIC WEBSITE, meaning ANYONE ONLINE could have access to the information.

I will never trust a company that messes up this badly.

Safety Concerns

Not including the data breach, I wonder about the practices of staff that have access to this information, people in general do not have good digital practices. Often using very insecure passwords (especially the same passwords for multiple things), being careless about what information they share, being susceptible to social engineering (how most hacks happen), etc.

In the United States we have the ever-present concern of school shooters, if someone with these intentions were to get access to where EVERY STUDENT is at any given time (since they are required to check-in at kiosks), as well as the school's emergency plans, they now know how to target as many people as possible. This is morbid, but it is a genuine problem.

I understand the problems with students and damage to the bathrooms, but this is not the solution. Period. I did not consent to my student’s data being shared with 3rd party. I do not mean to come at this with aggression or anger, but this is something I am very protective of in a world where companies sell data like candy is given out at Halloween, except they get lots of money in return. This normalizes to students that privacy is not a right, they were not asked if they were OK with their data being sent off. This normalization leads to apathy. I believe schools should teach digital hygiene practices, but this is not what this is about.

I am willing to discuss other solutions for my child. Though I believe it is a concern for everyone, and I will be contacting other parents with my concerns, as most people are not technologically savvy enough to realize what risks these devices pose.

I will glady come in for a meeting to further discuss my concerns, but I can assure you, I will not be persuaded to allow this breach of privacy. Schools are meant to protect children, not put them further in danger and teach them to not care about their data and safety. I would also like to see the school’s specific privacy agreement with Raptor Technologies. My student is of particular concern when it comes to privacy with being in the foster care system.

Thank you for your time

Blah463