Student Data Flow — LTI 1.3 Integration (BCON Activities ↔ Populi)

1. Purpose

The BCON Activities site hosts three interactive learning activities (Mark the Words, Bow-Tie, and Case Study). This integration lets an instructor add an activity to a Populi course and have a student's score recorded in the Populi gradebook automatically, using the education-standard LTI 1.3 / LTI Advantage protocol (the same standard Populi uses for Turnitin, Moodle, and similar tools).

2. Data inventory

Received by the activity site when a student launches an activity:

Not received (when the tool is configured with Privacy = Anonymous, the recommended setting): student name, email address, or student ID number.

Sent from the activity site back to Populi: a single numeric score (0–100) for that assignment, for that opaque user ID.

Stored by the activity site: nothing about students. There is no student database. The score is calculated in the browser, transmitted to Populi, and not retained on the activity site.

3. How the data flows

Every message is sent over encrypted HTTPS. Launch and grade messages are cryptographically signed (RS256 JSON Web Tokens) and the grade is delivered over an authenticated OAuth 2.0 channel, so neither can be forged or read in transit.

4. Safeguards

• Data minimization. Only the opaque user ID is used — no name, email, or student number is needed, requested, or displayed.
• No server-side student records. Nothing about a student is stored on the activity site; there is no education-record store on this side to secure or breach. Populi remains the sole system of record.
• Encrypted and signed end to end. HTTPS/TLS throughout; signed tokens; authenticated grade passback.
• Separation from AI features. Some activities offer AI-generated coaching that sends the text a student types (not their identity) to a third-party AI service (Anthropic). The grade/LTI path and the AI path are fully separate — no student identity is ever sent to the AI service. Students are warned on-screen not to enter personal or patient identifiers into free-text fields.

5. FERPA considerations

• A student's score is an education record under FERPA; this integration transmits that record into Populi's gradebook.
• Populi is the system of record. Access rights, retention, correction, and disclosure of the grade are governed by Populi and the College's existing controls — this integration adds no separate record store.
• Data minimization satisfied. Only an opaque ID and a number cross the wire.
• No re-disclosure or secondary use. The activity site does not share, re-disclose, repurpose, or retain any student data.

6. Third-party services involved

7. Institutional responsibilities to confirm

• The Populi tool's Privacy setting is Anonymous (so no name/email is transmitted to the activity site).
• If any party outside the College operates or maintains the activity site, a written agreement designates them a school official with a legitimate educational interest, prohibiting secondary use and re-disclosure (FERPA 34 CFR § 99.31(a)(1)).
• The College's standard FERPA annual notification and directory-information policies remain in effect (unchanged by this integration).