COPPA Online Notice

1. Operator Identification

2. Personal Information Collected from Children

Through the Brooks Band™ device and companion platform, Sensory Bridges may collect the following categories of personal information from children under 13:

What We Do NOT Collect from Children

• Audio recordings or voice content
• Photographs, videos, or images of the child
• GPS or precise geolocation data
• Social media identifiers or online contact information of the child
• Health records, medical diagnoses, or disability classifications
• Financial information

3. How We Use Children’s Personal Information

Children’s personal information is used solely for the following educational purposes:

• To deliver real-time self-regulation awareness feedback to the child through the Brooks Band™ device (haptic prompts and LED indicators).
• To generate engagement summaries and progress reports for authorized educators, therapists, and caregivers through the administrative data platform.
• To support the creation of documentation that educators and therapists are legally required to produce under IDEA, FERPA, and applicable state education law.
• To improve the functionality and effectiveness of the Brooks Band™ platform through analysis of aggregated, de-identified data that cannot be linked to any individual child, consistent with the COPPA Rule’s requirements for de-identification (16 C.F.R. § 312.12).

Children’s personal information is never used for:

• Targeted advertising or marketing to the child or to any other individual.
• Building behavioral or marketing profiles of the child.
• Sale, lease, or monetization to any third party for any purpose.
• Training machine learning or AI models on identifiable children’s data.
• Any commercial purpose unrelated to the educational services described above.

4. Disclosure Practices

Children’s personal information may be disclosed only to the following parties:

• Authorized Organization: The school, local education agency (LEA), or therapy organization that has executed a pilot or service agreement with Sensory Bridges and has authorized the child’s use of the device.
• Platform Administrators / Educators: Individuals designated by the Authorized Organization to manage the platform and review student data (such as special education teachers, SLPs, and OTs acting in an educational capacity).
• Parent / Guardian: The child’s legal parent or guardian has view-only access to their child’s engagement summaries.
• Service Providers: Third-party service providers that process data on behalf of Sensory Bridges solely to operate the platform (such as cloud hosting infrastructure). These providers are contractually prohibited from using children’s personal information for any purpose other than providing services to Sensory Bridges and are required to maintain reasonable data security practices. A current list of service providers processing children’s data is available upon request by contacting privacy@sensorybridges.com.
• Legal Process: If required by law, subpoena, or court order.

Children’s personal information is not disclosed to any advertising network, data broker, social media platform, or any third party for commercial purposes.

5. Parental Rights

As a parent or guardian of a child whose information is collected through the Brooks Band™ platform, you have the following rights under COPPA (16 C.F.R. § 312.6):

• Right to Review: You may request to review the personal information collected from your child. We will provide the information within 30 days of a verified request.
• Right to Deletion: You may request that we delete all personal information collected from your child. Upon receipt of a verified request, we will delete the data within 30 days and confirm deletion to you in writing.
• Right to Refuse Further Collection: You may refuse to permit further collection of your child’s personal information. If you exercise this right, the Brooks Band™ device will be deactivated for your child, and no further data will be collected. Previously collected data will be deleted upon your request.
• Right to Consent to Collection Without Disclosure: You may consent to the collection of your child’s personal information without consenting to its disclosure to third parties (other than service providers necessary to operate the platform).

How to Exercise These Rights

We will verify your identity as the child’s parent or guardian before fulfilling any request. Verification methods may include matching information you provide with information on file from the school enrollment process, or other reasonable methods.

6. Parental Consent

Before collecting personal information from a child under 13, Sensory Bridges obtains consent through one of the following methods:

• School Authorization: In school-based deployments, the child’s school may authorize data collection on behalf of parents for educational purposes only, consistent with the FTC’s longstanding school authorization guidance. Sensory Bridges acknowledges that regardless of school authorization, the operator retains independent responsibility for all COPPA obligations, including providing online notice (16 C.F.R. § 312.4), maintaining data security (16 C.F.R. § 312.8), implementing data retention limits (16 C.F.R. § 312.10), and ensuring data minimization. School authorization is limited to educational uses and does not extend to biometric data collection, Medicaid billing data, research participation, or third-party disclosures beyond the Data Processing Agreement.
• Direct Parental Consent: For biometric data collection (voice volume level data treated as a biometric identifier), Sensory Bridges requires separate, direct parental consent regardless of whether school authorization has been obtained. Direct consent is obtained through a signed consent form or equivalent verifiable parental consent method as defined by 16 C.F.R. § 312.5.

7. Data Retention Policy

As required by the 2025 amended COPPA Rule (16 C.F.R. § 312.10), Sensory Bridges maintains the following data retention policy for children’s personal information:

Upon expiration of the applicable retention period, or upon receipt of a verified parental deletion request, children’s personal information is permanently deleted. De-identified, aggregated data that cannot be linked to any individual child may be retained for product improvement purposes.

8. Data Security

Sensory Bridges maintains a written information security program as required by the 2025 amended COPPA Rule (16 C.F.R. § 312.8). The program includes:

• On-device processing: voice data is processed on the Brooks Band™ device itself. Raw audio is never stored or transmitted off-device.
• Encryption in transit (TLS 1.2 or higher) and at rest (AES-256 or equivalent).
• Role-based access controls limiting data access to authorized personnel.
• A designated individual responsible for maintaining the information security program.
• Review and assessment of data security practices no less than annually, and promptly following any security incident.
• Employee and contractor training on COPPA compliance and children’s data handling obligations.
• Incident response procedures for identifying, containing, and remediating security incidents affecting children’s data.

9. Additional Information

For the complete privacy practices governing the Brooks Band™ device and platform, see our Application and Platform Privacy Policy.

For privacy practices governing the sensorybridges.com website, see our Website Privacy Policy.

If you have questions or complaints about our COPPA compliance, you may contact us at privacy@sensorybridges.com or contact the Federal Trade Commission at www.ftc.gov or 1-877-FTC-HELP (1-877-382-4357).

© 2026 Sensory Bridges, Inc. All rights reserved.