Skip to documentation
Optimal Learning Lab

Applying cognitive theory to optimize learning.
Menu

MoFaCTS Data Privacy, IRB, and FERPA Notes

Documentation homeView source on GitHub

Status: Reference Last Updated: 2026-10-09 | For: Researchers and instructors Source: Current wiki guidance aligned with the public repository docs.

Purpose

This document helps researchers and instructors plan compliant use of MoFaCTS in studies and courses that involve student data.

It is written for graduate-student researchers and instructors who may not be full-time software developers.

  • This is operational guidance, not legal advice.
  • Your institution's IRB, privacy office, and counsel make final compliance decisions.
  • Requirements can differ by institution, funding source, and jurisdiction.

What Data MoFaCTS Handles

MoFaCTS stores learning and course operations data in MongoDB collections (see mofacts/common/Collections.ts), including:

  • Account and roster linkage data (user and section/course membership).
  • Learning interaction logs (history, userTimesLog, state collections).
  • Instructor-authored content (TDFs, stimuli, settings, assets).
  • Operational/audit artifacts (auditLog, error reports, reset tokens).

The Data Output page describes the current exports and their ownership boundaries. Authenticated learners can download their own history. Content owners can export learner history for their own lessons; teacher/admin role, public visibility and shared access alone do not grant that permission. This flow does not offer class-based export. A column labeled Anon Student Id can contain the account username and must not be assumed anonymous.

AI tutoring and AI-assisted authoring send the applicable prompts, source material and dialogue context to the configured provider. Speech features can send audio or text to their configured service. Document these external data flows, provider terms and retention choices in the institutional review. Saved Profile and administrator provider keys are encrypted in server storage, but usable personal keys can be supplied to the authenticated browser for authorized requests; do not describe this as keeping all credentials exclusively on the server.

Prolific participation records contain participant, study and submission identities, and authorized history exports include those columns. Return links grant private participant entry and must not be shared. Public demonstration sessions have a separate 24-hour expiry and cleanup policy; that policy does not delete ordinary learner accounts or establish a research retention schedule. The gaze prototype does not record gaze samples or camera video.

Browser diagnostics can contain learner answers and dialogue excerpts when an administrator enables logging. Persisted citation warnings are text-free, but that does not make captured browser logs text-free. Treat diagnostic exports, backups and screenshots according to the same data plan.

Data Lifecycle Checklist for IRB Protocols

Use this checklist when drafting your protocol or amendment:

  1. Define data elements: List exactly which fields you collect, and why each one is needed.
  2. Minimize direct identifiers: Prefer pseudonymous IDs over names/emails in analysis datasets whenever possible.
  3. Define access boundaries: Specify which roles (student, instructor, admin, analyst) can access raw vs de-identified exports.
  4. Define retention and destruction: State how long raw identifiable data is kept and how it will be destroyed or archived.
  5. Define export controls: Document where export files are stored, who can download them, and whether encryption is required.
  6. Define incident handling: Include contact/escalation steps for potential data exposure events.

FERPA Notes (US Education Context)

FERPA applicability and permitted disclosures require an institutional determination. Consult the Department of Education FERPA guidance and regulations when preparing that review.

Practical implications for MoFaCTS deployments:

  1. Establish institutional role and authority: Confirm whether the research/deployment qualifies under school official or studies-related FERPA pathways before data sharing.
  2. Share the minimum needed data: Export only fields required for the approved educational or research purpose.
  3. De-identify for broader sharing: Remove direct identifiers and assess re-identification risk before sharing outside the authorized team.
  4. Document governance: Keep written procedures for who can access exports, where files are stored, and how long they are retained.
  5. Align notices and agreements: Ensure institutional notices, data-use agreements, and lab SOPs reflect the actual MoFaCTS workflow.

IRB Notes (Human Subjects Research)

Ask the institution to determine the review requirements for the proposed activity using the HHS human-subjects regulations. Software use alone does not establish approval, exemption or consent.

For IRB submissions, include:

  • Study purpose and educational context.
  • Data dictionary of collected fields.
  • Consent/assent and privacy language.
  • Risk assessment (including re-identification risk from logs).
  • Security controls (authentication, role-based access, encryption at rest/in transit where used).
  • Retention and destruction timeline.

GDPR and Other Non-US Contexts

For institutions with EU/EEA participants or cross-border collaboration:

  1. Identify a lawful basis for processing (for example, public task, consent, or legitimate interests as applicable).
  2. Apply data minimization and storage limitation principles.
  3. Define data-subject rights handling (access, rectification, erasure where applicable).
  4. Document controller/processor responsibilities and hosting locations.

Coordinate with institutional privacy officers for jurisdiction-specific requirements.

  1. Use separate environments for production, staging, and local testing.
  2. Limit lesson ownership and exported files to the people authorized by the study/course data plan; application export permission is ownership-based.
  3. Store exports in institution-approved storage (not personal cloud drives).
  4. Keep secrets out of repos and rotate credentials on staff turnover.
  5. Log protocol IDs and approved data uses in project docs.
  6. Review privacy posture at least once per semester.

Canonical References

Developer ownership: mofacts/server/methods/analyticsDownloadMethods.ts authorizes downloads, mofacts/server/lib/historyExport.ts formats exports, and mofacts/common/Collections.ts identifies stored collections. Review the configured installation and providers when describing an actual deployment.