Confidentiality Policy — GraceRoot Institute

1

Overview

GraceRoot Institute understands that participants in court-ordered educational programs are in sensitive legal situations. Your personal information, program records, and educational data are treated with the same level of care and discretion as clinical records.

This policy applies to all participants enrolled in GraceRoot court-ordered programs: Parenting Education, Child Abuse Prevention, Anger Management, Trauma-Informed DV Education, and Substance Abuse Education. It is operated by Academic Research Solutions, Inc. dba Dareu2bu Counseling Services.

Court-ordered education is not therapy or counseling, and therefore is not subject to HIPAA in the clinical sense. However, GraceRoot voluntarily maintains HIPAA-adjacent confidentiality standards because we believe participants deserve clinical-grade protection of their educational records.

2

What Information We Collect

Data Category	Specific Information	Purpose
Identity	Full name, email address	Account creation, certificate issuance, communication
Enrollment	Course slug, enrollment date, payment plan, Stripe session ID, court-ordered flag	Access control, completion tracking, certificate generation
Progress	Module completion dates, modules completed	Program completion verification, certificate issuance
Assessments	Quiz scores, pass/fail status, submitted answers, submission timestamps	Completion verification, academic integrity monitoring
Certificates	Certificate ID, issuance date, program hours, certificate type	Court documentation, verification
Technical	IP address (at agreement signing), browser user agent (at agreement signing)	Legal integrity of signed participant agreement
Submissions	Recipient name/email/role when participant sends certificate to a representative	Documentation tracking, rate limiting

We do not collect: Social Security numbers, dates of birth, case numbers, offense details, attorney names, court case information, or any clinical/therapeutic disclosures. GraceRoot is an educational program, not a clinical record holder.

3

How Information Is Stored

Database: All participant data is stored in a Neon PostgreSQL database hosted on secure, SOC 2 compliant infrastructure with encryption at rest.
Transport encryption: All data transmitted between your browser and GraceRoot servers uses TLS/SSL encryption (HTTPS).
Access controls: Database access is restricted to authorized program administrators. No third-party has direct database access.
No local storage of sensitive data: Participant program data is not stored in browser cookies or local storage except for session management.
Payment data: GraceRoot does not store payment card information. All payment processing is handled by Stripe, which maintains PCI DSS compliance.

Data retention: Court-ordered program records (enrollment, completion, certificates, quiz scores, signed agreements) are retained for a minimum of 7 years from the date of program completion. This meets or exceeds standards required for court-mandated educational record-keeping.

4

Who Has Access to Your Information

Party	Access Level	Conditions
Program Administrator (Dr. Quinones)	Full access to all participant records	Administrative necessity; bound by professional and legal obligations
GraceRoot technical staff	Limited access for system maintenance	Access logged; bound by confidentiality obligations
Your referring court representative	Receives information you explicitly send via "Send to My Representative"	Only with participant-initiated action; you control what is sent
Third-party service providers	Stripe (payment processing), Neon (database hosting), email delivery service	Data processing agreements in place; no access to educational record content
Law enforcement / courts	As required by valid legal process (subpoena, court order)	Only to the extent legally required; we will notify you if legally permitted

GraceRoot does not sell, rent, or trade participant information to any third party. We do not share your information with employers, insurance companies, or other non-judicial parties.

5

When Information May Be Shared

Your information will only be shared in the following circumstances:

With your explicit consent: When you use the "Send to My Representative" feature on your dashboard, you control exactly what is sent and to whom. You initiate the disclosure.
Required by court order: If GraceRoot receives a valid subpoena or court order requiring disclosure of your records, we will comply to the extent legally required.
Required by law (mandatory reporting): If a participant discloses information indicating imminent risk of harm to self or others, or if mandatory reporting obligations under Texas law are triggered, GraceRoot will comply with those legal obligations. (Note: GraceRoot is an educational program, not a clinical setting — mandatory reporting situations are rare.)
Dismissal for conduct violations: If a participant is dismissed for academic dishonesty or conduct violations, the referring court or supervising officer may be notified of the dismissal (but not the details of the underlying conduct).

We do not proactively report to courts. GraceRoot does not automatically report your progress, scores, or completion status to courts or supervising officers. You control when and how your completion documentation is shared. You may use the dashboard's "Send to My Representative" feature to send documentation at any time.

6

Participant Rights

Right to access: You may request a copy of your program records (enrollment, completion, quiz scores, certificates) at any time by emailing support@graceroot.institute. We will respond within 10 business days.
Right to correction: If you believe your records contain an error (incorrect name on certificate, wrong completion date, etc.), you may submit a written correction request. We will review and respond within 10 business days.
Right to know: You have the right to know what information we hold about you and how it is being used. This policy is the primary disclosure — contact us with specific questions.
Right to notification of breach: See Section 7.

To exercise any of these rights, contact: support@graceroot.institute or write to GraceRoot Institute, 5373 W Alabama St, Houston, TX 77056.

7

Breach Notification

In the event of a data breach that may affect the confidentiality of participant information, GraceRoot will:

Identify the scope and nature of the breach as quickly as possible.
Notify affected participants by email within 72 hours of discovering the breach, where feasible.
Describe what information was involved, what steps GraceRoot has taken, and what participants can do to protect themselves.
Report the breach to relevant authorities as required by Texas law and applicable regulations.

Breach notifications will be sent to the email address on file for each affected participant. It is important to maintain an accurate email address in your account.

8

Questions & Contact

For questions about this Confidentiality Policy, to request your records, or to report a privacy concern:

Email: support@graceroot.institute
Mail: GraceRoot Institute, Attn: Privacy, 5373 W Alabama St, Houston, TX 77056
Program Administrator: Dr. Donetta Quinones, PhD, LPC, LMHC

This policy was last updated May 2026. GraceRoot reserves the right to update this policy. Material changes will be communicated to enrolled participants by email with at least 30 days notice before taking effect.