AI & Privacy
How PRISM handles candidate information, classroom video, transcripts, and AI-assisted feedback - and which decisions belong to your institution.
Information collected
PRISM stores the information needed to run clinical observations and assessments:
- Account information - name, email address, institution and college affiliation, and assigned roles.
- Course membership - which courses a person belongs to and their role in each (Faculty, TA, Reviewer, or Student).
- Submissions - teaching videos, supporting documents, and candidate notes.
- Feedback and evaluations - timestamped comments, rubric scores, overall comments, and final evaluations.
- AI-generated content - transcripts, summaries, and suggestions, when AI processing is enabled.
- Activity records - sign-ins, password changes, and administrative actions, kept for security and auditing.
Authorized uses
Information in PRISM is used to deliver clinical observation, feedback, and evaluation for the courses a person belongs to, and to produce course and program reports for authorized personnel.
Any additional uses - for example research, program evaluation beyond accreditation reporting, or sharing with partner schools - must be defined and approved by the institution.
Video and transcript processing
- Videos and attachments are stored on the PRISM server outside the public web directory. They have no public address.
- Uploaded videos are converted on the PRISM server for streaming playback.
- Every time a video is played or a file is downloaded, PRISM checks that the signed-in person is allowed to see that specific submission.
- Classroom recordings may include K-12 students. Only people with access to the course and submission can view them.
Hosting location, backup arrangements, and encryption details for stored video will be documented here after review by the institution's IT and privacy offices.
How AI is used
AI-generated observations are suggestions that require educator review. Faculty and authorized reviewers remain responsible for evaluation decisions.
- A platform administrator can turn AI processing on or off for the entire platform.
- When enabled, AI produces a transcript, a video summary, timestamped observations, and feedback suggestions for each submitted video.
- AI summaries, observations, and suggestions are visible to faculty and authorized reviewers only. They are never shown to candidates.
- Faculty choose, per assessment, whether candidates may view the machine-generated transcript of their own video.
- AI never finalizes an evaluation. Final evaluations are made only by authorized faculty.
Planned change: AI score suggestions will become an optional, administrator-controlled feature that is off by default, and AI content will count only after an educator accepts it.
Third-party providers
- OpenAI (only when AI processing is enabled) - the audio of a submitted video is sent for transcription, and the resulting transcript is sent to generate summaries and feedback suggestions.
- Email delivery - account and notification emails are sent through PRISM's configured mail server.
- Google Fonts - the site's typeface is loaded from Google's font service.
Contract terms, data-processing agreements, and data-use and retention commitments for each provider must be reviewed and documented by the institution before this section is finalized.
Retention and deletion
A platform administrator can set retention periods for videos, AI reports, and notifications. Automatic deletion happens only for data types where a retention period has been set; otherwise data is kept until it is deleted.
The institution's retention schedule for candidate records, classroom video, and evaluation results, and the process for deletion requests, will be published here once approved.
Access controls
- Accounts are created by administrators or by invitation into a specific course and role. There is no public sign-up.
- Permissions come from each person's role in each course and are checked on the server for every request - not just hidden in the interface.
- Candidates see only their own submissions. Evaluation results become visible to them only after faculty finalize the evaluation.
- A reviewer sees their own evaluations and comments, never another reviewer's. Faculty see all reviews for their course.
- Passwords are stored as one-way hashes. Changing a password signs the account out of its other sessions.
- Sign-ins, password changes, and administrative actions are recorded in an audit log.
Consent considerations
Teaching recordings often capture K-12 students, mentor teachers, and school staff. Programs should confirm that the required permissions are in place before candidates record or upload classroom video.
Consent requirements, release forms, and partner-district agreements for classroom recording, and whether AI processing requires additional consent, are institutional decisions to be documented here.
Institutional responsibilities
PRISM collects and organizes evidence. The institution remains responsible for its assessment policies, evaluation decisions, interpretation of results, and any accreditation submissions.
Assignment of data ownership, finalization authority, reviewer permissions, and approval of AI features will be documented here.
Support contact
The official contact for privacy questions and data requests will be listed here once designated by the institution.