Youth Data Privacy, Protection & Sharing Policy

EHAS Inc. is committed to protecting the privacy and dignity of young people, caregivers, staff, volunteers, and partners. This policy establishes intended minimum practices for information collected or used to enroll participants, deliver programs, evaluate outcomes, and administer grants. It applies to paper files, electronic systems, and approved third-party tools.

Only information reasonably needed for program delivery and accountability will be requested. This may include participant name, age/age bracket, caregiver contact details, emergency contact, consent records, accessibility accommodations volunteered by families, attendance, learning assessments, course completion, and optional feedback.

Demographic information should be optional where practicable, collected for a defined purpose, and reported in aggregate. We avoid collecting medical diagnoses, trauma histories, precise locations, government IDs, or other sensitive information unless necessary, justified, and appropriately safeguarded.

Authorized uses include verifying eligibility, obtaining consent, maintaining participant safety, providing instruction and support, communicating about activities, measuring learning outcomes, improving the curriculum, meeting legitimate grant obligations, and complying with applicable law.

Data will not be repurposed for unrelated fundraising outreach or marketing without a separate appropriate permission.

EHAS will establish age-appropriate notices and obtain parent or legal guardian permission whenever required by law, program design, host-site rules, or platform terms. Young participants will receive understandable explanations of what information is requested and how it may be used.

Photos, names, testimonials, and public-facing stories require separate documented media permission. Participation in storytelling must not require disclosure of private or traumatic experiences. Participants can decline optional surveys or public sharing without losing access to core activities where feasible.

Access to identifiable records will be limited to personnel who need it for approved duties. EHAS maintains named account access, strong passwords and multi-factor authentication where available, secure storage, appropriate sharing permissions, and secure disposal.

Volunteers and implementation partners must follow confidentiality and safeguarding requirements. Sensitive records should not be stored in personal messaging threads or publicly accessible folders.

Caregivers may receive appropriate information about their own child subject to consent, safety, and applicable rights. Educators, host sites, mentors, and service providers should receive only information necessary for an authorized program purpose under appropriate permissions or agreements.

Funders and public audiences should ordinarily receive aggregated or de-identified program counts, engagement trends, completion rates, and outcome summaries, with suppression of small groups where re-identification is possible.

EHAS will not sell youth personal data. Disclosure required by law or needed for child safety will be handled according to applicable rules.

Facilitators and youth may use only tools approved for their age, permissions, and current terms. They must not submit names, addresses, contact information, account credentials, private family information, medical records, school IDs, photos or recordings of identifiable minors, or confidential documents into unapproved AI systems.

We prefer fictionalized case studies, pseudonyms, and offline alternatives. Vendors' privacy practices, account settings, data retention, and model-training options are reviewed before use. Participants are never required to create age-ineligible accounts.

EHAS retains information only as long as necessary, based on a records schedule that accounts for grant, legal, and safeguarding obligations, and securely erases or destroys records when the period ends.

Access, correction, consent-withdrawal, and deletion requests can be sent to our privacy contact below. We recognize legal exceptions and recordkeeping duties, and we document how each request is fulfilled.

Suspected unauthorized access, disclosure, loss, or misuse must be promptly reported to an appointed EHAS data lead, investigated, contained, documented, and addressed. Required notifications will be made under applicable law and contracts.

EHAS trains staff and volunteers before they access participant records, reviews vendor agreements, and revisits this policy at least annually and whenever systems or regulations change.