91³Ô¹ÏÍø

I. General Statement

The 91³Ô¹ÏÍø (91³Ô¹ÏÍø) is committed to the responsible collection, use, protection, and management of personal information. 91³Ô¹ÏÍø collects and uses personal information as necessary to support its academic, research, administrative, and operational activities and to provide services to students, faculty, staff, visitors, and other members of the university community.

91³Ô¹ÏÍø maintains administrative, technical, and physical safeguards designed to protect personal information and limits access based on legitimate university purposes and responsibilities. 91³Ô¹ÏÍø also maintains policies, procedures, and practices that support appropriate data handling and guide the university community in protecting information throughout its lifecycle.

Privacy and information security are shared responsibilities. As technologies and data practices continue to evolve, 91³Ô¹ÏÍø regularly evaluates its practices and responds to privacy and security risks, incidents, and changes in applicable legal and regulatory requirements.

II. Use of Cookies and Similar Technologies

A cookie contains a small amount of visitor and website information stored on an individual’s computer. These files interact with the visitor and the website to provide a webpage tailored to the user through its awareness of information held within the file. Cookies also can carry all, or parts, of the information stored within the file to other websites that the individual may visit or to third parties.

To disable the use of cookies, which could negatively impact your web browsing experiences, please visit and research your browser’s settings to make adjustments.

Your personal information will be retained and disposed of in accordance with Florida’s public records retention requirements and 91³Ô¹ÏÍø’s records management policies and practices. Specific retention periods vary depending on the type of record and the purpose for which it was collected.

For more detail, see 91³Ô¹ÏÍø’s University policy on 91³Ô¹ÏÍø’s Records Management page, which includes Florida’s General Records Schedules for State and Local Government Agencies (Chapter 119, Florida Statutes) and Rule 1B-24, Florida Administrative Code.

The following describes the types of cookies 91³Ô¹ÏÍø uses on our main website (www.ucf.edu/):

• Required or Strictly Necessary Cookies are essential to enable you to navigate our websites, interact with the content, and use the features. Without these cookies, services you may ask for, such as registering for an account, cannot be provided.
• Functionality Cookies allow our websites to remember choices you make and provide more personal features. For instance, a functional cookie can be used to remember the volume level you prefer to use when watching videos on our websites. The information these cookies collect may be anonymized and they cannot track your browsing activity on other websites.
• Social Media Cookies may be set by third parties, such as YouTube and Twitter, to collect information about your social media experience.
• Analytics Cookies collect information about how visitors use our websites, for instance which pages visitors go to most often or how long they spend on a particular page. This information is used to improve our websites and to aid us in investigating problems raised by visitors. Analytics cookies do not collect information that identifies a visitor; they are utilized to assess patterns of usage, rather than the behavior of a single person.
• Targeting/Advertising Cookies are employed by dedicated partners and platforms to advertise on our behalf. Affiliate tracking cookies simply allow us to see what external site/experiences connect you to 91³Ô¹ÏÍø. We use these cookies to make advertising more engaging and relevant to you and to avoid showing ads you’ve already seen. These cookies anonymously collect information about your browsing habits to help us produce better content and more dynamic web interactions.

If you have questions about our use of cookies and similar technologies, please feel free to contact 91³Ô¹ÏÍø’s Data Protection Officer.

III. Electronic Mail (E-Mail) Communications

As a public university in Florida, 91³Ô¹ÏÍø is subject to Florida’s public records laws. Emails sent to or received by 91³Ô¹ÏÍø employees in connection with university business may be considered public records and may be subject to disclosure upon request.

Before sending information by email, consider whether the information is sensitive or confidential and whether email is the appropriate method of communication. If you have concerns about providing your email address or other information by email, contact the appropriate 91³Ô¹ÏÍø office to discuss alternative ways to communicate.

IV. Student Rights to Privacy

The Family Educational Rights and Privacy Act (FERPA) (20 U.S.C. § 1232g; 34 C.F.R. Part 99) is a federal law that protects the privacy of student education records and provides students with certain rights regarding those records.

At the postsecondary level, FERPA rights belong to the student, regardless of age. These rights include the right to inspect and review education records, request amendment of records the student believes are inaccurate, misleading, or otherwise in violation of their privacy rights, provide consent before certain disclosures of personally identifiable information from education records, and file a complaint concerning an alleged violation of FERPA.

FERPA generally requires 91³Ô¹ÏÍø to obtain a student’s written consent before disclosing personally identifiable information from the student’s education records. However, FERPA permits disclosure without consent in certain circumstances, as provided by law.

91³Ô¹ÏÍø may also disclose information it has designated as “directory information” without consent, subject to FERPA requirements. Students may restrict the disclosure of their directory information by logging into , navigating to Student Self Service > Student Center > Personal Information, and selecting FERPA/Directory Restriction.

Students who believe 91³Ô¹ÏÍø has failed to comply with FERPA may file a complaint with the U.S. Department of Education’s Student Privacy Policy Office:

Student Privacy Policy Office
U.S. Department of Education
400 Maryland Avenue, SW
Washington, DC 20202-85020

Or

Students may also contact 91³Ô¹ÏÍø’s or the 91³Ô¹ÏÍø Privacy Office at privacy@ucf.edu with FERPA-related questions or concerns before filing a formal complaint.

.

V. Health Insurance Portability and Accountability Act (HIPAA)

91³Ô¹ÏÍø is a hybrid entity under the Health Insurance Portability and Accountability Act (HIPAA). This means that HIPAA does not apply to the university as a whole but applies to designated components of 91³Ô¹ÏÍø that perform covered functions.

91³Ô¹ÏÍø’s Healthcare Component includes Covered Healthcare Units that provide health care and engage in electronic transactions subject to HIPAA, as well as designated Non-Covered Healthcare Units that may be required to comply with certain HIPAA requirements because of their relationship with 91³Ô¹ÏÍø’s Covered Healthcare Units. Together, these units comprise the 91³Ô¹ÏÍø Healthcare Component.

This section provides a general summary of 91³Ô¹ÏÍø’s HIPAA privacy practices. It is not 91³Ô¹ÏÍø’s official HIPAA Notice of Privacy Practices (NPP). Each designated Covered Healthcare Unit maintains an applicable NPP describing how the unit may use and disclose protected health information (PHI) and the rights individuals have regarding their PHI. You may request the applicable NPP from the 91³Ô¹ÏÍø Covered Healthcare Unit that provides your care or contact the 91³Ô¹ÏÍø Privacy Office at privacy@ucf.edu.

91³Ô¹ÏÍø’s Covered Healthcare Units maintain reasonable and appropriate safeguards to protect PHI and provide individuals with information about how their PHI may be used and disclosed. When required by HIPAA, 91³Ô¹ÏÍø also provides notification following a breach of unsecured PHI.

Under HIPAA and as described more fully in the applicable NPP, you may have the right to:

• Access and obtain a copy of your PHI;
• Request an amendment to certain PHI;
• Request restrictions on certain uses and disclosures of your PHI;
• Request confidential communications by alternative means or at alternative locations;
• Request an accounting of certain disclosures of your PHI;
• Obtain a paper copy of the applicable NPP upon request; and
• File a complaint if you believe your HIPAA privacy rights have been violated.

HIPAA generally permits Covered Healthcare Units to use and disclose PHI for treatment, payment, and health care operations without an individual’s written authorization, as well as for certain other purposes permitted or required by law. When HIPAA requires an individual’s authorization for a use or disclosure, 91³Ô¹ÏÍø will obtain that authorization.

HIPAA also permits health information to be de-identified in accordance with specific regulatory requirements. Once information has been properly de-identified under HIPAA, it is no longer considered PHI under the HIPAA Privacy Rule.

In certain circumstances, information disclosed pursuant to an individual’s authorization may no longer be protected by HIPAA after it is received by a person or organization that is not subject to HIPAA.

If you believe your HIPAA privacy rights have been violated, you may contact the 91³Ô¹ÏÍø Director of Privacy Compliance at privacy@ucf.edu or file a complaint with the . 91³Ô¹ÏÍø will not retaliate against you for filing a complaint.

.

VI. Children’s Privacy

91³Ô¹ÏÍø websites and online services are generally intended for students, employees, prospective students, and other members of the university community and public and are not directed to children under the age of 13.

91³Ô¹ÏÍø does not knowingly collect personal information online from children under 13 in a manner that would require parental consent under the Children’s Online Privacy Protection Act (COPPA). If a 91³Ô¹ÏÍø website, program, or service is designed for children under 13 and collects personal information from them, 91³Ô¹ÏÍø will provide appropriate notice and obtain parental consent when required by law.

If you believe that a child under 13 has provided personal information through a 91³Ô¹ÏÍø website or online service in circumstances that may be subject to COPPA, please contact the 91³Ô¹ÏÍø Privacy Office at privacy@ucf.edu.

VII. Use of Third-Party Services

91³Ô¹ÏÍø does not sell personal information. 91³Ô¹ÏÍø may share personal information with third-party service providers that support university operations and services, including technology, communications, educational programs, website functionality, analytics, and other services provided to the university community. When appropriate, 91³Ô¹ÏÍø requires service providers to protect personal information and use it only for authorized purposes.

Some 91³Ô¹ÏÍø websites and online services use third-party technologies or content, such as embedded media, analytics tools, scripts, or other website features. When these technologies are used, certain information about your device or interaction with the website, such as your IP address, browser or device type, date and time of access, and pages visited, may be transmitted to the third-party provider.

91³Ô¹ÏÍø websites may also contain links to websites or services operated independently by third parties. When you leave a 91³Ô¹ÏÍø website or choose to interact with an independent third-party service, that provider’s privacy practices and terms apply. 91³Ô¹ÏÍø encourages you to review the privacy notices of those services before providing personal information.

Some 91³Ô¹ÏÍø departments may offer communications by text message (SMS). When required, 91³Ô¹ÏÍø will obtain appropriate consent before sending text messages, and additional terms or notices may apply to specific messaging programs. SMS/text messaging opt-in information and consent are excluded from third-party sharing.

VIII. Privacy Rights Under Applicable Laws

91³Ô¹ÏÍø is a public university located in the State of Florida and is generally subject to applicable U.S. federal and Florida laws. In certain circumstances, privacy and data protection laws from other jurisdictions, including the European Union’s General Data Protection Regulation (GDPR), may also apply to specific 91³Ô¹ÏÍø activities.

When an applicable privacy law provides individuals with rights regarding their personal information, 91³Ô¹ÏÍø will respond to requests in accordance with that law and other legal obligations applicable to the university.

Depending on the law and circumstances, these rights may include the right to request access to or correction of personal information, deletion or restriction of certain processing, data portability, or objection to certain uses of personal information.

These rights are not absolute and may be subject to exceptions or limitations. For example, 91³Ô¹ÏÍø may be required to retain or disclose certain records under applicable federal or Florida law even when an individual requests deletion of that information.

Individuals who wish to submit a privacy rights request or have questions about rights that may apply to their personal information may contact the 91³Ô¹ÏÍø Privacy Office using the information provided below.

IX. International Data Transfers

91³Ô¹ÏÍø is a public research university located in the United States. In connection with 91³Ô¹ÏÍø programs, services, and activities, personal information may be transferred to, stored in, or processed in the United States or other countries where 91³Ô¹ÏÍø or its service providers operate.

Privacy and data protection laws vary by jurisdiction. When applicable law imposes requirements on the international transfer of personal information, 91³Ô¹ÏÍø will take appropriate steps to address those requirements and protect personal information consistent with applicable law and university policy.

X. 91³Ô¹ÏÍø Mobile App Location Services

The 91³Ô¹ÏÍø Mobile app may use your device’s location or proximity to Bluetooth beacons to provide location-based notifications. When enabled, this information is used only to determine whether a notification should be sent and is not retained after that determination is made.

You can manage location permissions for the 91³Ô¹ÏÍø Mobile app through your device settings.

XI. Questions / More Info

If you have questions about this Privacy Notice, 91³Ô¹ÏÍø’s privacy practices, or the handling of your personal information, or if you would like to submit a privacy-related request, please contact the 91³Ô¹ÏÍø Privacy Office by email or mail:

Director of Privacy Compliance
University Compliance and Ethics
Millican Hall – 3rd Floor
4365 Andromeda Loop N.
Orlando, FL 32816
Contact us online

XII. Updates to this Privacy Notice

Updates to this Privacy Notice occur periodically; this page was last updated on September 25, 2026.