Compliance & Agreements
Everything your district's procurement, legal, and IT teams need to evaluate T1D Ready — the subscription agreement, our student data privacy commitments, health-data handling, and the full security package.
Master SaaS / Subscription Agreement
The commercial terms that govern your school or district's subscription to T1D Ready™.
Contracting entity
Your subscription is provided by Bip & Son LLC d/b/a T1D Ready ("T1D Ready"). Bip & Son LLC is the legal entity that contracts with your school or district, signs the HIPAA Business Associate Agreement, and is responsible for the obligations described in these documents. T1D Ready is the brand name used throughout the platform.
Subscription term and renewal
Subscriptions run for the selected term (monthly or annual). Terms renew automatically at the end of each billing period unless cancelled before renewal. District agreements follow the annual term stated on the order.
Pricing
Single-school plans are $599/month or $6,000/year. The District Plan is $15,000/year and includes 3 schools, with each additional school at $4,500/year. All plans are billed securely through Stripe; no per-user fees for nurses, staff, or parents.
User licenses
A single subscription covers an unlimited number of authorized users within the subscribing school or district — nurses, administrators, staff, and parents. Each user receives role-based access and parents are limited to their own linked student(s).
Implementation / support
Onboarding includes access-code provisioning, account setup, and staff guidance. Ongoing support is available through the in-app support center and by email at the address listed below.
Service levels and uptime
We target high availability for the platform and its monitoring services. Planned maintenance is scheduled to minimize disruption; any material service-level or credit commitments for district customers are documented in the signed agreement.
Termination
Either party may terminate at the end of the current term with notice. Upon termination, access ends at the close of the paid period and data is returned or deleted according to the Data Processing Agreement below.
FERPA & Student Data Privacy (Data Processing Agreement)
How we handle education records and student data as a FERPA school official to your school or district.
FERPA role as a school official
Under FERPA, T1D Ready acts as a school official with a legitimate educational interest. We provide an institutional service the school would otherwise perform itself, work under the direct control of the school or district, and use education records only to provide this service — the basis on which student information is shared with us.
FERPA Data Processing Agreement
We sign a written Data Processing Agreement with every school and district. We will sign your district's own DPA, or the SDPC National Data Privacy Agreement (NDPA) — a free, pre-negotiated agreement already used by more than 13,000 school districts across 35 state alliances. Ask for the NDPA and we execute it, which lets many districts skip DPA negotiation entirely; the executed copy is then filed in the SDPC Resource Registry.
SDPC Resource RegistryState student-privacy law alignment
Our DPA is written to meet the state vendor laws districts ask about most — New York Education Law § 2-d, Illinois SOPPA, California SOPIPA, and Texas TSPA. If your state requires its own terms, send us the agreement and we will complete and return it.
Student data collected
We collect only what is needed to coordinate school-day care: student name, grade/school, guardian and emergency contacts, diabetes type, target glucose ranges, CGM readings, care logs (insulin, carbs, ketones, treatments), schedule, and authorized-user account details.
Purpose limitation
Student data is used solely to provide the T1D Ready service to your school — monitoring, care logging, communication, and compliance reporting. It is never used for any other purpose.
No sale of student data
We do not sell, rent, or trade student data. It is never disclosed to third parties except the subprocessors required to operate the service, under contract and confidentiality obligations.
No targeted advertising
We do not use student data for advertising, marketing, profiling, or behavioral targeting of any kind, and no advertising is served within the platform.
Authorized users
Access is limited to users your school authorizes — administrators, nurses, and staff — and to parents for their own linked student(s). Role-based permissions enforce these boundaries.
Subprocessors
We rely on a limited set of vetted infrastructure and payment subprocessors to run the service. The current subprocessor list is provided in the Security Package section below and is kept up to date.
Data retention / deletion
Student data is retained only while your school maintains an active subscription or as required by your agreement. On request or termination, data is deleted within the timeframe defined in the signed agreement.
Data ownership
Your school or district owns all student data. T1D Ready acts solely as a service provider and processes data only on your instructions.
Data return upon termination
Upon termination, we provide an export of your data in a standard format on request, then delete it from active systems per the retention terms.
Data Privacy Information (DPI)
Plain-language answers about the health information stored in T1D Ready.
What health information we collect
Continuous glucose monitor (CGM) readings, fingerstick blood glucose values, insulin doses, carbohydrates, ketones, and treatments recorded in care logs, plus each student's target glucose range and care plan documents supplied by the school.
Who can see it
Only authorized users: school administrators and nurses see the students in their school; staff see the students assigned to them; parents see only their own linked student(s). Access is enforced by role-based permissions.
Where it is stored
Data is stored in encrypted, access-controlled cloud infrastructure operated by our platform provider, with logical separation between organizations and strict per-user access rules.
How it is encrypted
Data is encrypted in transit using TLS and encrypted at rest. Credentials and CGM session tokens are stored securely and are never exposed to unauthorized users.
How long we retain it
Health information is retained for the duration of the school's subscription and any retention period required by your agreement, after which it is removed.
How it is deleted
Data is deleted on school request or at termination per the agreement. Deletion removes records from active systems; standard backup cycles are purged on a rolling basis.
Security Package Information
The technical and organizational controls that protect the platform and your data.
SOC 2 Type II (Base44 platform)
T1D Ready does not hold its own SOC 2 report — it runs on Base44, whose SOC 2 Type II report is independently audited and covers the security, availability, and confidentiality controls of the platform. That report is available to your review team on request under NDA through the Base44 Security Trust Center; contact us and we will arrange access.
Base44 Security Trust CenterHECVAT & security questionnaires
For application-level review we complete the HECVAT (Higher Education Community Vendor Assessment Toolkit) — the vendor security assessment most K-12 and higher-education reviewers accept — along with VPAT and district-specific forms. Send yours and we will return it completed.
Penetration-test summary
The platform is regularly assessed for security vulnerabilities. An executive summary of the most recent penetration test can be shared with districts under NDA.
Vulnerability management
Dependencies and platform components are continuously monitored and patched. Security findings are triaged by severity and remediated on a defined timeline.
Encryption
TLS protects data in transit and encryption at rest protects stored data. Sensitive credentials are stored securely and access is restricted.
Access control / role-based permissions
Every record is governed by role-based access rules, ensuring administrators, nurses, staff, and parents only reach the data they are authorized to see.
Audit logging & access monitoring
Account, authentication, and record-level activity is logged with timestamps and user attribution. Logs are retained for compliance review and support breach investigation and accounting-of-disclosures requests — without altering the underlying student record.
Multi-factor authentication (MFA)
Account authentication is provided by our platform identity layer, with support for strong authentication methods including single sign-on where configured.
Incident response
A documented incident-response process covers detection, containment, notification, and remediation, with breach notification to affected schools as required by law and your agreement.
Business continuity / disaster recovery
The service runs on resilient, redundant cloud infrastructure with backup and recovery procedures designed to protect availability and data integrity.
Subprocessor list
Core subprocessors: cloud hosting and storage, identity/authentication, and Stripe for payment processing. A complete, current list is available on request for your compliance review.
Accessibility Conformance Report (ACR)
How T1D Ready is made usable for every nurse, staff member, parent, and student who depends on it.
Conformance target
T1D Ready is built and tested against WCAG 2.1 Level AA — the standard districts apply under ADA Title II and Section 508 to online tools and services. Interactive controls meet a minimum 44×44px tap target, work with keyboard-only navigation, and the layout adapts from phone to desktop.
Accessibility Conformance Report (ACR / VPAT)
A completed Accessibility Conformance Report — VPAT 2.5 WCAG edition, stating the evaluation date and method — is available for your procurement file on request. Send us your accessibility requirements and we will return the report completed.
How we evaluate
Conformance is self-assessed using automated testing tools together with manual passes on a keyboard and screen reader, across the staff-facing and parent-facing flows, on mobile and desktop viewports.
Known limitations
The application interface targets Level AA. Files the platform generates for download — exported care logs, annual reports, and printable compliance documents — are produced as standard PDFs and are not guaranteed to be fully tagged for screen readers. Where an accessible copy of a generated document is needed, contact us and we will supply the content in an accessible format.
Reporting an accessibility barrier
If any part of T1D Ready is difficult to use with assistive technology, report it through the contact page. We confirm the issue, provide a workaround where one exists, and fix it in a subsequent release.
HIPAA Business Associate Agreement
The BAA we execute with your school or district — including required safeguards, breach notification, and PHI return and destruction terms. Print or save it as a PDF for your review file. Your executed copy is generated with your district's details during onboarding and stored in your admin portal.
BUSINESS ASSOCIATE AGREEMENT
HIPAA Compliance — 45 C.F.R. §§ 160.103, 164.308, 164.502(e), 164.504(e)
This Business Associate Agreement ("Agreement") is entered into as of October 27, 2026 (the "Effective Date") by and between:
Covered Entity
[School/District Name]
[Address]
Contact: [Name]
[Email]
[Phone]
Business Associate
Bip & Son LLC d/b/a T1D Ready
6650 Rivers Ave Ste 100, Charleston, SC 29406
Contact: Compliance Officer
J.Rothgeb@t1dready.com
(individually a "Party" and collectively the "Parties"). This Agreement is entered into pursuant to the Health Insurance Portability and Accountability Act of 1996 ("HIPAA"), the Health Information Technology for Economic and Clinical Health Act ("HITECH Act"), and their implementing regulations at 45 C.F.R. Parts 160 and 164.
1. Definitions
a. "Protected Health Information" or "PHI" means individually identifiable health information as defined in 45 C.F.R. § 160.103, transmitted or maintained in any form or medium, including student glucose readings, care logs, medical orders, and emergency contact information.
b. "Electronic Protected Health Information" or "ePHI" means PHI that is transmitted by or maintained in electronic media.
c. "Breach" means the acquisition, access, use, or disclosure of PHI in a manner not permitted under the HIPAA Privacy Rule, which compromises the security or privacy of the PHI.
d. "Designated Record Set" means a group of records maintained by or for Business Associate on behalf of Covered Entity, including student health records, care logs, and glucose reading histories.
2. Permitted Uses and Disclosures by Business Associate
a. Business Associate may use or disclose PHI only as permitted or required by this Agreement or as Required by Law.
b. Business Associate may use PHI for the proper management and administration of the T1D Ready™ platform, including: (i) maintaining and operating the platform; (ii) providing glucose data synchronization, care logging, alert notifications, and messaging features; (iii) data aggregation and de-identification in accordance with 45 C.F.R. § 164.514; and (iv) reporting violations of this Agreement to appropriate authorities.
c. Business Associate shall not use or disclose PHI in a manner that would violate the HIPAA Privacy Rule if done by Covered Entity.
3. Safeguards — Administrative, Physical, and Technical
a. Business Associate shall implement administrative, physical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of ePHI, in accordance with 45 C.F.R. § 164.308 (Administrative Safeguards), § 164.310 (Physical Safeguards), and § 164.312 (Technical Safeguards).
b. Administrative safeguards include: role-based access controls, workforce training on HIPAA compliance, designated security official, incident response procedures, and regular risk assessments.
c. Physical safeguards include: secure facility access controls, workstation security policies, and media disposal procedures for PHI stored on physical media.
d. Technical safeguards include: TLS encryption for data in transit, encryption at rest, unique user authentication, automatic logoff, audit controls, and integrity controls to ensure ePHI has not been altered or destroyed in an unauthorized manner.
4. Breach Notification
a. Business Associate shall notify Covered Entity without unreasonable delay, and in no case later than 60 calendar days after discovery of a Breach of unsecured PHI, in accordance with 45 C.F.R. § 164.410.
b. Such notification shall include: (i) the identification of each individual whose PHI was involved; (ii) a description of what happened; (iii) the types of information involved; (iv) the steps individuals should take to protect themselves; (v) what Business Associate is doing to investigate, mitigate, and protect against further breaches; and (vi) contact procedures for affected individuals.
c. Business Associate shall also notify Covered Entity of any use or disclosure of PHI not provided for by this Agreement of which it becomes aware, and any Security Incident of which it becomes aware, without unreasonable delay.
5. Subcontractors and Sub-Agreements
a. Business Associate may engage subcontractors to create, receive, maintain, or transmit PHI on its behalf only if the subcontractor provides satisfactory written assurance that it will implement safeguards equivalent to those required by this Agreement.
b. Business Associate remains liable for any acts or omissions of its subcontractors that violate this Agreement.
6. Access to PHI by Covered Entity and Individuals
a. Business Associate shall make PHI in a Designated Record Set available to Covered Entity within 30 days of a request, in accordance with 45 C.F.R. § 164.524 (access to PHI) and § 164.526 (amendment of PHI).
b. Business Associate shall provide Covered Entity with information necessary to comply with the accounting of disclosures requirements under 45 C.F.R. § 164.528.
c. Business Associate shall amend any PHI in a Designated Record Set that Covered Entity directs it to amend, and shall forward the amendment to any subcontractors.
7. Government Access and Internal Practices
a. Business Associate shall make its internal practices, books, and records relating to the use and disclosure of PHI available to the Secretary of the Department of Health and Human Services for purposes of determining Covered Entity's compliance with the HIPAA Privacy Rule, in accordance with 45 C.F.R. § 160.303(c).
8. Term and Termination
a. This Agreement shall be effective as of the Effective Date and shall continue in effect until the earlier of: (i) the date Covered Entity terminates this Agreement for cause; or (ii) the date Business Associate ceases to provide services to Covered Entity.
b. Upon termination, Business Associate shall return or destroy all PHI received from or created on behalf of Covered Entity, in accordance with 45 C.F.R. § 164.504(e)(2)(ii)(J). If return or destruction is not feasible, Business Associate shall extend the protections of this Agreement to the PHI and limit further uses and disclosures to those purposes that make the return or destruction infeasible.
c. The obligations under Sections 4 (Breach Notification) and 8(b) (Return of PHI) shall survive termination of this Agreement.
9. Covered Entity Obligations
a. Covered Entity shall notify Business Associate of any limitation(s) in its Notice of Privacy Practices that may affect Business Associate's use or disclosure of PHI.
b. Covered Entity shall not request Business Associate to use or disclose PHI in any manner that would not be permissible under the HIPAA Privacy Rule if done by Covered Entity.
c. Covered Entity shall ensure that all parents and guardians provide informed consent for their child's health data to be shared through the T1D Ready™ platform.
10. Miscellaneous
a. Indemnification: Each Party shall indemnify and hold harmless the other Party from and against any claims, losses, or damages arising from its breach of this Agreement.
b. Limitation of Liability: Neither Party shall be liable for indirect, incidental, or consequential damages arising out of this Agreement.
c. Governing Law: This Agreement shall be governed by the laws of the State of California, without regard to its conflict of law provisions.
d. Entire Agreement: This Agreement constitutes the entire agreement between the Parties regarding the subject matter and supersedes all prior agreements.
e. Amendment: This Agreement may only be amended by a written instrument signed by both Parties.
Signatures
Covered Entity Authorized Representative
Name: ____________________
Title: ____________________
Date: ____________________
Business Associate — Bip & Son LLC d/b/a T1D Ready
Name: Compliance Officer
Title: Chief Compliance Officer
Date: ____________________
This document was auto-generated by the T1D Ready™ compliance platform on October 27, 2026.
Need a document for your review?
Request the complete Master Agreement, the FERPA Data Processing Agreement, the Accessibility Conformance Report (ACR/VPAT), the security package, or a completed security questionnaire for your procurement process.
For Associations
We host a free 30-minute webinar on T1D school compliance for state school nurse association members — covering HIPAA and 504 obligations, care-plan documentation, CGM responsibilities, and what districts are asked to produce during an audit. We'll also cover the readiness checklist your members can run in their own schools.
Request a Demo
See T1D Ready with your district's workflow. Share a few details and we'll schedule a 30-minute walkthrough for your health services, nursing, and IT teams.