Privacy Policy for Baseline: AAC Assessments
Effective date: July 14th, 2026
Baseline: AAC Assessments (the “Application”) is a clinical assessment application provided by California Speech and Counseling (“we,” “us,” “our,” or the “Service Provider”). The Application is designed for use by speech-language pathologists, educators, clinicians, caregivers, and other authorized adults to administer Augmentative and Alternative Communication (“AAC”) assessments and maintain related student records.
This Privacy Policy explains how information is processed, stored, and protected when the Application is used.
1. Local-Only Data Storage
The Application is designed to store student and assessment information locally on the user’s device.
The Application does not automatically upload or transmit student records, assessment results, clinical notes, camera information, or other information stored within the Application to California Speech and Counseling or to third-party servers. California Speech and Counseling cannot remotely view, retrieve, modify, or delete information stored within the Application.
The Application does not currently provide cloud synchronization, online accounts, remote databases, advertising, or third-party analytics.
Information may leave the device only when an authorized user deliberately exports, saves, shares, transfers, or backs up that information, as described below.
2. Information Stored by the Application
Authorized users may enter or generate information including:
Student first and last name
Student date of birth
Student profile notes
Assessment types and configurations
Assessment dates and duration
Test progress, including incomplete or resumed assessments
Scores, accuracy percentages, and response times
Trial-by-trial targets, selections, and results
Selected grid positions and other interaction details
Prompting levels
Behavior tags and observations
Clinician notes
Test battery information
Accuracy-map images generated from assessment results
This information may constitute personal information, education records, health information, or other legally protected information depending on the user, the student, the organization administering the assessment, and the circumstances in which the Application is used.
All such information is stored locally within the Application’s storage container on the device unless an authorized user intentionally exports or shares it.
3. How Information Is Used
The Application uses locally stored information only to provide its assessment and recordkeeping functions, including:
Creating and maintaining student profiles
Administering AAC assessments
Saving and resuming assessments
Calculating and presenting assessment results
Recording clinical observations and notes
Generating visual accuracy maps
Generating PDF assessment reports
Displaying assessment history on the device
California Speech and Counseling does not use student or assessment information for advertising, marketing, profiling, analytics, or data brokerage.
4. TrueDepth Face Data, eye tracking, and camera use
The Application includes an optional Eye Tracking selection method. When an authorized user selects this feature, the Application requests permission to use the device’s front TrueDepth camera and starts Apple’s ARKit face-tracking framework using ARFaceTrackingConfiguration.
Information processed using TrueDepth and ARKit
The Application processes the following ARKit-generated face-tracking information:
A three-dimensional gaze-direction value provided by ARFaceAnchor.lookAtPoint;
Numerical left-eye and right-eye blink values provided by ARKit’s eyeBlinkLeft and eyeBlinkRight blend-shape coefficients;
Temporary calibration samples that associate the gaze-direction value with known locations displayed on the screen;
A temporary calibration transform derived from those samples;
A temporary, smoothed on-screen gaze coordinate; and
The grid cell currently indicated by the calculated gaze coordinate.
The Application’s code does not read, record, store, or transmit raw camera images, photographs, video, depth maps, facial mesh geometry, or a facial-recognition template.
How this information is used
This information is used exclusively to provide the optional Eye Tracking selection method. Specifically, it is used to:
Calibrate the student’s estimated gaze direction to locations on the iPad screen;
Display a visible gaze indicator so the student and clinician can see the estimated gaze location;
Determine which assessment grid cell the student is looking at;
Allow a student to select a grid cell by maintaining their gaze on it for the required dwell period;
Allow a student to select the currently indicated grid cell by blinking when Blink selection is enabled; and
Temporarily disregard unstable gaze coordinates while a blink or partial eye closure is detected.
Face-tracking information is not used to identify or authenticate the student, create a facial profile, infer the student’s identity or personal characteristics, conduct analytics, provide advertising, or for any purpose unrelated to the Eye Tracking selection method.
Storage and retention
Face-tracking information, gaze coordinates, blink values, calibration samples, and the calibration transform exist only temporarily in the device’s volatile memory while the Eye Tracking feature is active. They are not written to the Application’s persistent database, files, logs, PDF reports, or device backups.
The Application clears the calibration samples, calibration transform, gaze coordinate, and blink state when the assessment is completed, saved and exited, or otherwise closed. The information cannot subsequently be recovered by California Speech and Counseling because it was never transmitted to or stored by California Speech and Counseling.
When eye tracking results in an assessment selection, the Application may store the resulting selected grid cell or item, whether the selection was correct, and the response time as part of the student’s local assessment record. These ordinary assessment results do not contain the student’s gaze path, gaze coordinates, blink values, calibration information, face image, depth information, or facial geometry. As explained in Section 5, an authorized user may deliberately export an assessment report, but exported reports do not contain face-tracking information.
Disclosure and sharing
Face-tracking information is processed entirely on the device using Apple’s ARKit framework. The Application does not transmit face-tracking information to California Speech and Counseling, Apple, an analytics provider, a cloud service, or any other third party. The Application contains no third-party advertising or analytics SDK that receives this information.
Camera access is optional and is requested only when Eye Tracking is selected. Users may deny or revoke camera permission through the device’s system settings. The Application’s other selection methods remain available without TrueDepth camera access.
5. PDF Reports and User-Directed Sharing
The Application allows authorized users to generate PDF reports containing student and assessment information. Depending on the available record, a report may include a student’s name, date of birth, assessment results, accuracy information, and clinical notes or observations.
A report remains local unless the user chooses to save, export, or share it. When a user deliberately shares or saves a report, the report may be transferred to a destination selected by that user, including:
The Files application
Email or messaging applications
Cloud-storage services
AirDrop
Printing services
Another application or device
California Speech and Counseling does not select or control these destinations and is not responsible for their privacy, security, or retention practices.
Users must ensure that any export or disclosure is authorized and is performed using methods approved by their employer, school, healthcare organization, or other governing entity. Exported reports must be protected and deleted in accordance with applicable law and organizational policy.
6. HIPAA and Protected Health Information
Information entered into the Application may constitute protected health information (“PHI”) when the Application is used by or on behalf of an entity subject to the Health Insurance Portability and Accountability Act (“HIPAA”).
The Application’s local-only design does not, by itself, establish or guarantee HIPAA compliance. HIPAA compliance depends on how the Application and the device are configured, managed, secured, and used.
Because California Speech and Counseling does not receive or have access to information stored locally in the Application, merely providing the Application does not make California Speech and Counseling the custodian of that information. Unless otherwise established through a separate written agreement, California Speech and Counseling does not receive, maintain, or transmit PHI on behalf of a user through the Application.
Users and their organizations are responsible for determining whether HIPAA applies to their use of the Application and for implementing all required administrative, physical, and technical safeguards. This responsibility includes:
Restricting device access to authorized individuals
Using an appropriate device passcode and security settings
Using mobile-device-management controls when required
Preventing unauthorized access to student records
Managing device backups appropriately
Sharing reports only through approved secure methods
Responding appropriately to a lost, stolen, or compromised device
Following applicable retention and disposal requirements
Conducting any required organizational security or risk assessment
Users should consult their organization’s privacy or security officer before storing PHI in the Application.
The U.S. Department of Health and Human Services explains that providing software alone generally does not create a business-associate relationship when the software provider does not have access to a covered entity’s PHI. HHS software-vendor guidance
7. FERPA and Education Records
When the Application is used by a school, school district, educational agency, or an individual acting on its behalf, information stored in the Application may constitute an education record protected by the Family Educational Rights and Privacy Act (“FERPA”).
The Application’s local-only design does not, by itself, establish or guarantee FERPA compliance. The educational agency or institution and its authorized users are responsible for determining whether FERPA applies and for ensuring that the Application is used consistently with FERPA and other applicable student-privacy requirements.
This responsibility includes:
Limiting access to school officials with a legitimate educational interest
Obtaining parental or eligible-student consent when required
Ensuring that any disclosure is permitted by FERPA
Preventing unauthorized redisclosure
Maintaining appropriate access controls
Responding to lawful requests to inspect, review, or amend education records
Following applicable record-retention and destruction policies
Protecting exported reports and device backups
Complying with state and local student-privacy requirements
California Speech and Counseling does not receive or control education records stored locally within the Application.
The U.S. Department of Education states that educational agencies must use reasonable methods to ensure that school officials access only records for which they have a legitimate educational interest. Department of Education FERPA guidance
8. Children’s Information
The Application is designed to be operated by clinicians, educators, caregivers, and other authorized adults. It is not intended for independent use by children.
Authorized adult users may use the Application to assess children, including children under 13, and may enter information concerning those children. The Application does not require a child to create an account, provide contact information, or independently submit information to California Speech and Counseling.
The adult user and the user’s organization are responsible for:
Having appropriate authority to assess the student
Obtaining parental, guardian, or institutional permission when required
Determining which information may lawfully be entered
Providing any legally required notice
Protecting the confidentiality of the student’s information
Complying with COPPA, FERPA, HIPAA, state student-privacy laws, professional confidentiality requirements, and other applicable laws
Because student information remains on the device, California Speech and Counseling cannot independently access, review, correct, or delete a child’s locally stored record.
9. No Advertising, Tracking, or Sale of Information
The Application does not currently contain:
Third-party advertising
Advertising identifiers
Behavioral tracking
Tracking pixels
Cookies
Third-party analytics SDKs
Data-broker integrations
Social-media tracking
Cross-application tracking
California Speech and Counseling does not sell or share student or assessment information for advertising or behavioral profiling.
The Application does not automatically collect device IP addresses, browsing history, application-usage history, or precise location information.
10. Apple and Device Services
The Application operates on Apple devices and uses Apple-provided operating-system frameworks. Apple may separately process information associated with the App Store, device diagnostics, operating-system services, backups, or the user’s Apple Account according to the user’s settings and Apple’s privacy policies.
California Speech and Counseling does not control information independently collected by Apple.
Users and organizations should review their device-backup settings. If the device is configured to create backups, locally stored Application data may be included in a device or cloud backup managed by Apple or the organization. Such backups are not transmitted to or accessible by California Speech and Counseling.
11. Data Retention and Deletion
Student and assessment information remains stored on the device until an authorized user:
Deletes the applicable student record;
Uses the Application’s “Clear All Data” function; or
Removes the Application from the device.
Deleting a student record deletes the student and the assessment information associated with that student from the Application’s active local database.
California Speech and Counseling cannot remotely delete locally stored information because it does not have access to that information.
Deleting information from the Application may not delete:
PDF reports previously exported or shared
Copies stored in email, messaging, or cloud-storage services
Copies maintained by another person or organization
Information contained in device or organizational backups
Printed copies
Users are responsible for locating and deleting those copies in accordance with applicable law and organizational policy.
12. Security
The Application stores its records within its iOS application container and relies on security protections provided by the device and operating system. No method of electronic storage can be guaranteed to be completely secure.
The Application does not provide a separate user-account system or an independent in-app passcode. Anyone who can unlock the device and access the Application may be able to view the information stored within it.
Users are responsible for maintaining the physical and electronic security of the device, including using appropriate passcodes, biometric device authentication, automatic locking, software updates, device-management policies, and remote device-management or erasure capabilities where appropriate.
Users should not store identifiable student or clinical information on shared or unsecured devices.
13. Access, Correction, and Privacy Requests
Because California Speech and Counseling cannot access information stored locally in the Application, requests to access, correct, export, or delete a locally stored student record must generally be handled through the device by the authorized user or organization controlling that device.
Parents, guardians, students, or patients seeking access to a record maintained by a clinician, school, or healthcare provider should contact that clinician, school, provider, or organization directly.
If you contact California Speech and Counseling by email, we may receive your name, email address, and the contents of your message. We will use that information to respond to your inquiry and maintain it only as reasonably necessary for support, legal, or business-record purposes.
Do not send student records, PHI, education records, PDF reports, or other sensitive information to the support email address unless California Speech and Counseling has expressly requested it and provided an approved secure method.
14. Required Legal Disclosures
Because California Speech and Counseling does not possess or have access to student and assessment information stored locally in the Application, it ordinarily cannot disclose that information in response to a request.
California Speech and Counseling may disclose information it actually possesses—such as support correspondence—when required by applicable law, court order, subpoena, or other valid legal process, or when reasonably necessary to protect legal rights or safety.
15. Changes to This Privacy Policy
We may update this Privacy Policy to reflect changes to the Application, our practices, or applicable legal requirements.
The updated policy will include a revised effective date. Material changes will be communicated through the Application, the Application’s App Store listing, our website, or another appropriate method when required.
16. Contact Us
Questions about this Privacy Policy or the Application’s privacy practices may be directed to:
California Speech and Counseling
Email: info@caspeechcounseling.com
Mailing address: 3441 Bloomfield Ln. Clovis, CA 93619
Telephone: (818) 570-8261
For questions concerning a particular student record, contact the clinician, school, healthcare provider, or organization that controls the device on which the record is stored.