Privacy Policy

Effective Date: 5/8/2026

Summit Professional Education ("Summit," "we," "us," or "our") respects your privacy and is committed to protecting your personal information. This Privacy Policy explains what we collect, how we use it, and your rights. This policy applies to personal data collected from learners, institutional partners, and visitors to our website.

Note: The privacy practices set forth in this privacy policy are for this web site only. If you link to other web sites, please review the privacy policies posted at those sites.

Information We Collect

We may collect:

• Name
• Email address
• Professional credentials
• Course history
• Payment information (securely processed and tokenized via Stripe; we do not store full payment details)
• IP address and browser/device data

How We Use Information

We use personal data to:

• Deliver educational services
• Manage accounts and course participation
• Process payments
• Improve our platform and user experience
• Communicate with you about services and updates

Legal Basis for Processing

We process personal data under:

• Contractual necessity
• Legitimate business interests
• Consent where required

FERPA Compliance

Where applicable, Summit acts as a "school official" under FERPA. We use personal data only to provide contracted educational services.

Data Sharing

We share data only with trusted service providers (subprocessors) necessary to operate our services, such as hosting, analytics, and payment providers. A current list of subprocessors is available here. We do not sell personal data. We may disclose information if required by law, regulation, legal process, or to protect the rights, safety, and security of Summit and its users.

International Data Transfers

Data is processed in the United States, including AWS regions us-east-1 and us-west-2.

Cookies and Tracking

We use:

• Analytics cookies (e.g., Google Analytics, Microsoft Clarity)
• Functional cookies required for site operation

Where required, we obtain consent before using non-essential cookies.

Data Retention

We retain personal data only as long as necessary to fulfill the purposes outlined in this policy, unless a longer retention period is required or permitted by law.

Typical retention periods include:

• Account and profile data: retained for the duration of the relationship and up to 7 years after inactivity
• Course and completion records: retained for at least 7 years to support credential verification and compliance
• Transaction and billing records: retained for 7 years for tax and accounting purposes
• Support and communication records: retained for up to 3 years
• Analytics data: retained in aggregated or de-identified form where possible

Security

We implement administrative, technical, and physical safeguards designed to protect personal data, including:

• Access controls based on least privilege
• Encryption in transit and at rest where appropriate
• System monitoring and logging
• Vendor security reviews

No system is completely secure, but we take reasonable steps to protect your information.

Incident Response and Breach Notification

In the event of a data breach involving personal information, Summit will:

• Investigate and contain the incident promptly
• Notify affected individuals and partners as required by applicable law
• Provide relevant information about the nature of the breach and recommended actions

Your Privacy Rights

Depending on your location, you may have the right to:

• Access your personal data
• Correct inaccurate data
• Request deletion of your data
• Restrict or object to certain processing
• Request data portability where applicable

To submit a request, contact: customerservice@summit-education.com. We will respond within 30 days and may need to verify your identity before processing requests.

U.S. State Privacy Rights

If you are a resident of certain U.S. states with applicable privacy laws, you may have additional rights, including:

• Right to know what personal data is collected and how it is used
• Right to request deletion of personal data
• Right to correct inaccurate information
• Right to opt out of the sale or sharing of personal data (Summit does not sell personal data)
• Right to non-discrimination for exercising your rights

Requests can be submitted via the contact information above.

Global Privacy Control (GPC)

Automated Decision-Making and Profiling

Summit does not use personal data to make automated decisions that produce legal or similarly significant effects about you, and we do not engage in profiling for such purposes. If this changes, we will update this Privacy Policy and, where required by law, provide you with the right to opt out.

Email Communications

You may opt out of marketing emails at any time by using the unsubscribe link in emails or contacting us directly at customerservice@summit-education.com.

Children's Privacy

Our services are not directed to children under 13, and we do not knowingly collect personal data from children.

Accessibility

Summit is committed to ensuring this Privacy Policy is accessible to all users. If you require this policy in an alternative format, please contact us.

Privacy Impact Assessments

We perform privacy and security reviews for new systems or processes that involve personal data.

Policy Updates

We may update this policy from time to time. If changes are material, we will notify users via email or through our website.

HIPAA and Health Data

Summit is not a healthcare provider and does not provide medical advice. In cases where Summit processes protected health information (PHI) on behalf of covered entities, we do so as a Business Associate and comply with applicable requirements under the Health Insurance Portability and Accountability Act (HIPAA) and HITECH Act. Where required, Summit enters into Business Associate Agreements (BAAs) with customers and implements appropriate safeguards to protect PHI.

Data Processing Addendum (DPA)

For institutional and enterprise customers, Summit offers a Data Processing Addendum (DPA) governing the processing of personal data. To request a DPA, contact: customerservice@summit-education.com.

Appeals Process

If you are not satisfied with how we handled your privacy request, you may submit an appeal by contacting us at customerservice@summit-education.com. We will review and respond to appeals within a reasonable timeframe as required by applicable law.

Privacy Contact Information

If you have any questions, concerns, or comments about our privacy policy you may contact us using the information below:

By Email: customerservice@summit-education.com.

By Phone: 1-800-433-9570