Amira Privacy Policy for Canada

Introduction and Scope

Amira Learning, Inc. (“Amira,” “we,” or “us”) is committed to protecting the privacy of students, teachers, and school personnel using our reading assessment and tutoring platform. This Privacy Policy explains how we collect, use, disclose, and safeguard personal information in Canadian K-12 school environments. It applies to student users (children using Amira for reading exercises) and educator users (teachers and school administrators using Amira to assess and support literacy instruction) in Canada.

Last Updated: July 2, 2026

We comply with Canada’s federal Personal Information Protection and Electronic Documents Act (PIPEDA) and all applicable provincial private-sector privacy laws, including Ontario’s Freedom of Information and Protection of Privacy Act (FIPPA), Municipal Freedom of Information and Protection of Privacy Act (MFIPPA) and Personal Health Information Protection Act (PHIPA), Alberta’s Personal Information Protection Act (PIPA), British Columbia’s PIPA, and Québec’s Act Respecting the Protection of Personal Information in the Private Sector (Law 25). These laws set out rules for how Amira must handle personal information. In this Policy, “personal information” means any information about an identifiable individual, as defined under Canadian privacy laws.

By using Amira’s services through your school or district, you acknowledge that your personal information (or your child’s information) will be handled in accordance with this Policy. We provide our platform to schools and school boards, who act as the primary account holders. Amira functions as a service provider to these educational institutions - we process student and teacher data only for the educational purposes authorized by the school and not for any commercial use outside the scope of providing our services.

Information We Collect

We collect only the personal information necessary to support students’ learning and educators’ instructional needs. The types of information we collect and how we collect it are explained below.

1. Information Provided by Schools/Educators: Teachers or school administrators provide information to create accounts and roster students for Amira’s use. This may include:

• Educator Information: Name, school email address, school/district name, role (e.g. teacher, administrator), and class details (grade level, class name, and number of students). Educators also provide login credentials (which may be single-sign-on or school-managed accounts).
• Student Information (Roster): Student first and last name, school email or login ID, student grade level and class enrollment, and preferred language.

2. Information Collected from Students: When a child uses the Amira reading app under teacher supervision, we collect data generated through their interactions, including:

• Reading Performance Data: This includes the content the student reads (e.g. stories, passages), the words read correctly or mispronounced, and system-generated assessments. It also includes records of the student’s progression, scores, and the interventions or feedback given by the Amira app.
• Audio Recordings: As a key feature, Amira records students’ voices while they read aloud into the app. These voice recordings are considered personal information and are used to analyze reading abilities. The recordings allow our AI to understand each student’s reading strengths and difficulties, enabling personalized feedback and identifying areas for improvement. For example, Amira’s system may analyze a recording to detect if a student struggles with certain phonemes or words and then provide targeted exercises. We retain these recordings in a de-identified form for as long as needed for the educational purposes described (see Data Retention below) and to improve our reading assessment algorithms in a way that does not identify the child to any unauthorized party.
• App Usage Data: We automatically collect certain data about how the student uses the Amira app. This includes which reading exercises or stories were completed, response times, points or rewards earned, and other in-app actions. This usage data helps track the child’s progress and ensures the platform adjusts to their learning level.

3. Information from Schools or Integrated Systems: In some cases, Amira may integrate with school information systems or third-party education platforms to simplify rostering and login (for example, using a standard like OneRoster or integration with a district’s student information system). In doing so, we may receive student and teacher data from those systems, such as class lists or unique student IDs, as authorized by the school.

We do not knowingly collect personal information directly from children without appropriate consent. Students do not create accounts on their own - accounts are set up by schools or educators. Amira only collects and uses student personal information for educational purposes with consent from the child’s school (or parent/guardian, as required).

Amira does not monitor a user’s activity outside of the Amira software. We also do not use data from other platforms, unless explicitly authorized by the user for purposes related to the Amira app (such as integrations between rostering software and Amira)

How We Use Personal Information

We use the collected information strictly to provide and improve our educational services, and for no other purposes. Specifically:

• Providing and Personalizing the Learning Experience: Student data (including performance metrics and voice recordings) is used to deliver real-time reading coaching and tailored exercises. For example, Amira uses a child’s reading errors and fluency data to adjust difficulty and give specific feedback, thereby personalizing the child’s learning experience. Voice recordings are analyzed by our AI to pinpoint strengths and weaknesses in reading, which helps us provide individualized support to each student. We also track reading progress over time so teachers and parents can see improvement.
• Teacher Dashboards and Reports: We use student performance data to generate reports and analytics for educators. Teachers and school administrators can log in to see a student’s reading scores, error patterns, and progress reports. This helps educators identify which students might need extra help and which skills to focus on in class. We may also offer printable or shareable reports for parents based on this data.
• Account Administration and Support: We use educator-provided information to set up and manage accounts and classes. For example, we use teacher email addresses to create login credentials, send necessary service communications (like class setup confirmations or password resets), and provide customer support. We might also send service notifications or administrative emails to educators - such as system updates, security alerts, or changes to this Policy - to keep you informed.
• Communication with Users: If you contact us with a question or for support, we will use your contact information to respond and resolve issues. We may also use educator contact details to send optional updates about new features, training resources, or tips for using Amira effectively in the classroom. These are considered marketing communications to educators - we will only send such communications with appropriate consent, and educators can opt-out at any time.
• Service Improvement and Research: Amira continually strives to improve its literacy assessment algorithms and content. We may use de-identified or aggregated data (data that cannot identify an individual student or teacher) to conduct research and development. For instance, analyzing aggregated reading fluency scores across many users can help us refine our assessment benchmarks. We ensure that any data used for product improvement or academic research cannot be traced back to a specific student or educator. If we ever wish to use identifiable personal information for purposes beyond the core educational service (for example, to feature a success story or case study), we will seek explicit consent from the individual or their parent/guardian.
• Compliance and Protection: We may use personal information as necessary to comply with legal obligations or to protect the rights and safety of our users, Amira, and others. For example, we will use and disclose information if required to respond to a lawful request by authorities, or to investigate and address violations of our Terms of Service or this Policy. We also use data to prevent fraud or unauthorized access to student records, and to ensure the security of our systems.

We do not use student personal information for any advertising or marketing purposes. That means no targeted ads will be shown to students in the Amira app, and we do not create marketing profiles of individual children. We also do not sell or trade personal information about students for any purpose. The student data we collect is used only to support learning and school-authorized activities. In addition, we do not use or disclose any child’s information for behavioral advertising or any kind of profiling beyond their educational progress.

Legal Basis and Consent

Amira only collects, uses, and discloses personal information with an appropriate legal basis. The different types of legal basis and their applications are listed below:

• Consent: For students’ personal information, consent is obtained through the school or school district, which acts with authority to permit the use of student data for educational technology. Schools often obtain parental consent on behalf of Amira’s services, in accordance with school policies and applicable laws. Amira relies on consent from a parent or legal guardian (typically facilitated by the school) for any collection of personal information from minor students. The consent will be explicit (opt-in) for any sensitive uses. By providing student data to Amira, the school is confirming that it has the authority or consent to do so.
• Contractual Necessity: When it comes to educators’ own information and the operational data needed to run our platform, we collect and use such information under the legal basis of fulfilling our contract. We limit this processing strictly to what is required to deliver and support the platform’s functionality, in alignment with the purposes identified by the school at the time of collection.
• Legal and Regulatory Compliance: In certain situations, we may process personal information because we are legally required to - for instance, to comply with a subpoena/court order or to meet data retention rules under education laws.

Disclosure of Information to Third Parties

Amira does not share or disclose personal information except as needed to operate our educational services or as required by law. We never sell personal data and do not share student information for promotional or advertising purposes. The circumstances in which we may disclose information are:

• To the School and Educators: Student performance data and recordings are made available to the student’s teachers and authorized school officials through the Amira platform. For example, a student’s reading recording and analysis may be accessible to their teacher for review. Schools control which of their staff have access. This sharing is inherent in providing the service to the school.
• With Service Providers (“Processors”): We use reputable third-party companies to help us deliver the Amira service. These service providers may include cloud hosting providers, data center operators, speech recognition and AI analytics services, technical support infrastructure, and email communication services. When we share data with service providers, it is only what is necessary for them to perform their function. All such providers are bound by contractual agreements to keep personal information confidential and secure, and to use it only for the purposes of providing services to Amira in line with this Policy. We conduct due diligence on our vendors’ data protection practices and ensure they meet or exceed the privacy safeguards required by Canadian law. Amira services provided in Canada are hosted on infrastructure located in Canada.
• For Legal Reasons: We may disclose personal information when required by law or legal process. If we receive a court order, subpoena, or a lawful request from law enforcement, we will comply to the extent the law requires us to. We would only share the data specifically demanded and only after verifying the legitimacy of the request. Additionally, if necessary to protect the rights, safety, or property of our users, our company, or others, we may disclose information. This could include sharing information to investigate or prevent fraud or security issues, or to enforce our terms and this Policy.
• De-Identified or Aggregated Data: We may share data that has been de-identified (stripped of personal identifiers) or aggregated (combined so it’s not tied to any individual) with third parties for research or product development. De-identified data is not considered personal information, and we ensure that there is no reasonable way to re-identify individuals from such data.

Data Security Safeguards

We take data security very seriously and have implemented industry-standard security measures to protect personal information against loss, theft, unauthorized access, and unauthorized disclosure. Some of the key security practices and safeguards we employ include:

• Encryption: Personal information, especially sensitive data like student names and voice recordings, is encrypted both at rest and in transit. This means data stored on our servers is encrypted, and communications between your device and our servers (such as when the app uploads a reading recording) are protected by encryption protocols (HTTPS/TLS). Encryption helps ensure that even if data were intercepted or accessed inappropriately, it would not be readable.
• Access Controls: We restrict access to personal data strictly to those employees, contractors, and service providers who require it to perform their job duties (principle of least privilege). All personnel with access to personal information are bound by confidentiality obligations. Schools can also control access through their educator accounts.
• Administrative and Organizational Measures: Amira has a dedicated privacy and security team, responsible for overseeing compliance and data protection. We have put in place internal policies and procedures for handling data securely, including data encryption standards, incident response plans, and protocols for data access.
• Third-Party Security Audits and Certifications: We subject our platform to routine security assessments. Amira holds a SOC 2 (Service Organization Control 2) certification, following an audit performed by independent auditors, to verify that our security controls, availability, and confidentiality measures meet rigorous industry standards. We also align our security program with internationally recognized frameworks. Additionally, when working with third-party service providers, we vet their security practices and ensure they have up-to-date security certifications or audits as appropriate.
• Physical and Technical Safeguards: Our servers are hosted in secure AWS facilities with robust physical security. Technical safeguards include firewalls, intrusion detection systems, and continuous network monitoring to protect against and detect any unauthorized access attempts. We also utilize anti-virus and anti-malware tools on our systems and employ secure software development practices to minimize vulnerabilities in our application.
• Data Minimization: We collect only the personal information that is necessary for the purposes described and we retain it only for as long as needed (see Data Retention below).
• Incident Response: Amira has a detailed data breach response plan. In the unlikely event of a security breach that affects personal information, we will promptly notify the affected school authorities and individuals. Under PIPEDA, if a breach creates a “real risk of significant harm” to users, we will report it to the Privacy Commissioner of Canada and inform affected individuals without undue delay. We will also notify any relevant provincial privacy regulators as needed. Our team will take immediate steps to contain the incident, mitigate harm, and prevent future occurrences. Records of any privacy/security incidents are maintained in accordance with legal requirements.

Data Retention and Deletion

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, or to meet legal or contractual requirements. This means:

• Active School Use: For schools and districts currently using Amira, we retain student and educator information for the duration of the school’s contract or active subscription. Student reading data and recordings remain available so long as the student is actively using Amira under the school’s license, enabling longitudinal progress tracking. This aligns with the educational purpose of helping track improvement over time.
• Account Deactivation or End of School Contract: If a student no longer uses Amira (for example, they graduate, transfer, or the school stops using our service), we will initiate a process to remove or de-identify their personal information. By default, when a school’s subscription ends or an educator account is deactivated, personal data is no longer actively used and is scheduled for deletion. We either delete the data or irreversibly de-identify it after a defined retention window. This window is usually short (measured in weeks or a few months) to accommodate any potential service reactivation or data export requests from the school. For instance, if a school leaves Amira and later returns within a short time, we may retain data briefly to restore accounts if instructed, but otherwise we securely delete it. Audio recordings and detailed student performance data will be securely erased or de-identified once they are no longer needed for their original purpose.

Deletion Requests: Schools or parents (via the school) can request deletion of a student’s personal information at any time through the Amira app’s interface. Note that deleting certain data may mean the student can no longer use the Amira service (since it may include their login or progress data). We do not charge any fee for handling access or deletion requests.

Individual Privacy Rights and Choices

Under Canadian privacy laws, individuals (or their parents/guardians in the case of minors) have various rights regarding their personal information. Amira is committed to upholding these rights and providing accessible ways for individuals to exercise them. These rights include:

• Right to Access: You have the right to access personal information that Amira holds about you.
• Right to Correction: If any personal information we have is inaccurate or incomplete, you have the right to correct them. Schools and teachers can also directly edit certain information through the platform (for instance, correcting a student’s misspelled name). We encourage schools to keep roster information current, and we will honor any verified correction requests.
• Right to Withdraw Consent: Where our processing of personal information is based on consent, that consent can be withdrawn at any time. Withdrawal of consent may mean we can no longer provide services to the student. Withdrawing consent does not affect the lawfulness of processing that occurred before the withdrawal. If certain data must be retained for legal reasons, we will inform you.
• Right to Deletion: Separate from withdrawing consent, individuals may have the right to request deletion (erasure) of their personal information in certain circumstances. These requests are subject to the provisions outlined in the Data Retention and Deletion section.
• Right to Lodge a Complaint: If you believe your or your child’s privacy rights have not been respected, you have the right to complain. We encourage you to contact us first so we can address your concern directly. However, you also have the right to file a complaint with the relevant privacy regulator. For federal matters, this is the Office of the Privacy Commissioner of Canada (OPC). If your province has a separate regulator (e.g., the Ontario, Alberta or BC Information and Privacy Commissioners, or Québec’s Commission d’accès à l’information), you can contact them as appropriate. We will provide contact information for these regulators upon request, or you can find it on their official websites. Lodging a complaint with authorities is a right under PIPEDA and you will not be penalized or denied service for doing so in good faith.

How to Exercise Your Rights

Typically, because Amira provides services through schools, the fastest way to exercise these rights is by contacting your school. For example, a parent can request the teacher or school administrator to correct or obtain their child’s information from Amira, and the school can then work with us to fulfill the request. This is often efficient since schools can verify the identity and authority of the requester. We work closely with our school customers to assist with any privacy-related requests and will promptly comply with the school’s direction in line with applicable law.

You also have the option to contact Amira directly with privacy requests or questions (see "Contact Us" below). If you contact us directly, we may need to coordinate with the school to verify your identity/relationship to the student before acting on the request. We will respond to all individual rights requests as soon as possible and at the latest within the timeframe required by law (generally 30 days under PIPEDA, with extension possible in some cases). If we need an extension or cannot fulfill a request, we will inform you and explain the reasoning. There is no charge for making a request.

Educator users can access and update some of their own information by logging into their Amira account (for example, changing a profile picture or updating an email address). Educators can also opt out of receiving marketing or promotional emails from Amira (we include unsubscribe links in any such communications). Note that we will still send essential service emails (like security alerts or password resets) as these are not marketing. If you have connected Amira with other services (single sign-on, etc.), you can manage permissions via those services.

Amira’s Role as a Data Processor (Service Provider)

It is important to understand that in the context of providing services to schools, Amira acts as a data processor or service provider on behalf of educational institutions, which are the data controllers. The school or school district determines the purposes and means of the processing of student personal information - essentially, the school decides to use Amira as a tool for educational assessment, and Amira processes data only under the school’s instructions and authorization.

Practically, this means:

• No Secondary Use: We only collect, use, and disclose student data for the purposes of providing our reading assessment and tutoring services to the school. We do not use student personal information for our own purposes unrelated to education, nor do we commercialize it. Our contract with the school typically specifies that we are a processor of student data and that the school retains ownership/control over that data.
• Following School Instructions: If a school requests a certain action regarding student data (such as deletion, or providing access to a parent, or not collecting certain optional data), we comply, as long as it’s consistent with our legal obligations. We enable schools to fulfill their own responsibilities under laws like PIPEDA or provincial acts, for instance by providing them with the tools to access or correct information.
• Processor under Provincial Laws: In provinces which have their own private sector privacy laws, our role as a processor/service provider is conceptually similar. We comply with any specific provisions in those laws about data processors.

Children’s Privacy

Children’s privacy is at the core of our business and is protected by additional safeguards and practices, many of which have been described above. To reiterate and summarize our commitments regarding minors:

• Parental Consent: Amira does not allow children to sign up on their own. A school or educator must enable a student’s access, and by doing so, they confirm that proper parental consent or authority is in place. If any personal information is to be collected directly from a child (for instance, if a student inputs something into Amira), it will only be as part of the authorized educational activity and with the school’s oversight.
• Age-Appropriate Transparency: We strive to make our platform understandable to children. While this Privacy Policy is directed at adults, Amira’s interface uses kid-friendly language and design. We do not ask children for more information than is necessary to use the reading program. If a child has questions about privacy, we encourage them to talk to their teacher or parent, who can contact us on their behalf.
• No Child Marketing: We have zero tolerance for advertising to children on our platform. We do not display third-party ads, and we do not use information about a child for any kind of marketing or profiling beyond their educational needs. We also do not condition a child’s participation on providing more personal data than is reasonably required.
• Protecting Minors’ Data as Sensitive: We recognize that all data about children is highly sensitive. Our security controls (discussed above) treat student data with the highest level of protection. For instance, any employee accessing student records must have senior approval and a specific need. When using student data to improve our AI or for research, we remove identifiers. If we ever encounter an unintended exposure of a child’s data, we prioritize containment and notification in line with regulations that treat such incidents with elevated seriousness.

Updates to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons. When we make changes, we will revise the “Last Updated” date at the top of this Policy. We ensure that any material changes to the Privacy Policy are communicated clearly to users through appropriate channels, such as: email updates sent to registered users, including Educators and administrators, as well as announcements on the Amira website.

Contact Us (Privacy Questions or Concerns)

Amira Learning has appointed a Privacy Officer to oversee our data protection program and address any questions or concerns related to privacy and this Policy. If you have any questions, requests, or complaints regarding your personal information or this Privacy Policy, please contact us:

Email: trust@amiralearning.com
Mailing Address: Amira Learning, Inc. - Attn: Privacy Officer 490 Post St, Suite 500 PMB 2538, San Francisco, CA 94102

We will respond to inquiries as quickly as possible, and in any event within the timelines required by law. Communication may be in English or French as needed.

If you contact us by email, please do not include sensitive information (like a child’s full name or ID) in the subject line. We may need to verify your identity and entitlement (especially for student data requests) before proceeding, to protect privacy.

Should you feel that we have not adequately addressed your privacy-related concern, you have the right to reach out to the appropriate privacy regulator. For example, you may contact the Office of the Privacy Commissioner of Canada (OPC) or, if applicable, your provincial privacy commissioner. We sincerely hope that we can resolve any issue directly and encourage you to allow us to work with you for a satisfactory resolution.

Thank you for trusting Amira with your students’ reading journey. We are dedicated to safeguarding the personal information under our care and enabling children to improve their literacy skills in a safe and secure manner.