Privacy Notice

I. General Statement

The University of Central Florida (UCF) is committed to the responsible collection, use, protection, and management of personal information. UCF collects and uses personal information as necessary to support its academic, research, administrative, and operational activities and to provide services to students, faculty, staff, visitors, and other members of the university community.

UCF maintains administrative, technical, and physical safeguards designed to protect personal information and limits access based on legitimate university purposes and responsibilities. UCF also maintains policies, procedures, and practices that support appropriate data handling and guide the university community in protecting information throughout its lifecycle.

Privacy and information security are shared responsibilities. As technologies and data practices continue to evolve, UCF regularly evaluates its practices and responds to privacy and security risks, incidents, and changes in applicable legal and regulatory requirements.

II. Use of Cookies and Similar Technologies

A cookie contains a small amount of visitor and website information stored on an individual’s computer. These files interact with the visitor and the website to provide a webpage tailored to the user through its awareness of information held within the file. Cookies also can carry all, or parts, of the information stored within the file to other websites that the individual may visit or to third parties.

To disable the use of cookies, which could negatively impact your web browsing experiences, please visit knowcookies.com and research your browser’s settings to make adjustments.

Your personal information will be retained and disposed of in accordance with Florida’s public records retention requirements and UCF’s records management policies and practices. Specific retention periods vary depending on the type of record and the purpose for which it was collected.

For more detail, see UCF’s University policy 2-003 Records Management on UCF’s Records Management page, which includes Florida’s General Records Schedules for State and Local Government Agencies (Chapter 119, Florida Statutes) and Rule 1B-24, Florida Administrative Code.

The following describes the types of cookies UCF uses on our main website (www.ucf.edu/):

• Required or Strictly Necessary Cookies are essential to enable you to navigate our websites, interact with the content, and use the features. Without these cookies, services you may ask for, such as registering for an account, cannot be provided.
• Functionality Cookies allow our websites to remember choices you make and provide more personal features. For instance, a functional cookie can be used to remember the volume level you prefer to use when watching videos on our websites. The information these cookies collect may be anonymized and they cannot track your browsing activity on other websites.
• Social Media Cookies may be set by third parties, such as YouTube and Twitter, to collect information about your social media experience.
• Analytics Cookies collect information about how visitors use our websites, for instance which pages visitors go to most often or how long they spend on a particular page. This information is used to improve our websites and to aid us in investigating problems raised by visitors. Analytics cookies do not collect information that identifies a visitor; they are utilized to assess patterns of usage, rather than the behavior of a single person.
• Targeting/Advertising Cookies are employed by dedicated partners and platforms to advertise on our behalf. Affiliate tracking cookies simply allow us to see what external site/experiences connect you to UCF. We use these cookies to make advertising more engaging and relevant to you and to avoid showing ads you’ve already seen. These cookies anonymously collect information about your browsing habits to help us produce better content and more dynamic web interactions.

If you have questions about our use of cookies and similar technologies, please feel free to contact UCF’s Data Protection Officer.

III. Electronic Mail (E-Mail) Communications

As a public university in Florida, UCF is subject to Florida’s public records laws. Emails sent to or received by UCF employees in connection with university business may be considered public records and may be subject to disclosure upon request.

Before sending information by email, consider whether the information is sensitive or confidential and whether email is the appropriate method of communication. If you have concerns about providing your email address or other information by email, contact the appropriate UCF office to discuss alternative ways to communicate.

IV. Student Rights to Privacy

The Family Educational Rights and Privacy Act (FERPA) (20 U.S.C. § 1232g; 34 C.F.R. Part 99) is a federal law that protects the privacy of student education records and provides students with certain rights regarding those records.

At the postsecondary level, FERPA rights belong to the student, regardless of age. These rights include the right to inspect and review education records, request amendment of records the student believes are inaccurate, misleading, or otherwise in violation of their privacy rights, provide consent before certain disclosures of personally identifiable information from education records, and file a complaint concerning an alleged violation of FERPA.

FERPA generally requires UCF to obtain a student’s written consent before disclosing personally identifiable information from the student’s education records. However, FERPA permits disclosure without consent in certain circumstances, as provided by law.

UCF may also disclose information it has designated as “directory information” without consent, subject to FERPA requirements. Students may restrict the disclosure of their directory information by logging into myUCF, navigating to Student Self Service > Student Center > Personal Information, and selecting FERPA/Directory Restriction.

Students who believe UCF has failed to comply with FERPA may file a complaint with the U.S. Department of Education’s Student Privacy Policy Office:

Student Privacy Policy Office
U.S. Department of Education
400 Maryland Avenue, SW
Washington, DC 20202-85020

Or File a Complaint | Protecting Student Privacy

Students may also contact UCF’s Registrar’s Office or the UCF Privacy Office at privacy@ucf.edu with FERPA-related questions or concerns before filing a formal complaint.

Learn more about FERPA protections at UCF.

V. Health Insurance Portability and Accountability Act (HIPAA)

UCF is a hybrid entity under the Health Insurance Portability and Accountability Act (HIPAA). This means that HIPAA does not apply to the university as a whole but applies to designated components of UCF that perform covered functions.

UCF’s Healthcare Component includes Covered Healthcare Units that provide health care and engage in electronic transactions subject to HIPAA, as well as designated Non-Covered Healthcare Units that may be required to comply with certain HIPAA requirements because of their relationship with UCF’s Covered Healthcare Units. Together, these units comprise the UCF Healthcare Component.

This section provides a general summary of UCF’s HIPAA privacy practices. It is not UCF’s official HIPAA Notice of Privacy Practices (NPP). Each designated Covered Healthcare Unit maintains an applicable NPP describing how the unit may use and disclose protected health information (PHI) and the rights individuals have regarding their PHI. You may request the applicable NPP from the UCF Covered Healthcare Unit that provides your care or contact the UCF Privacy Office at privacy@ucf.edu.

UCF’s Covered Healthcare Units maintain reasonable and appropriate safeguards to protect PHI and provide individuals with information about how their PHI may be used and disclosed. When required by HIPAA, UCF also provides notification following a breach of unsecured PHI.

Under HIPAA and as described more fully in the applicable NPP, you may have the right to:

• Access and obtain a copy of your PHI;
• Request an amendment to certain PHI;
• Request restrictions on certain uses and disclosures of your PHI;
• Request confidential communications by alternative means or at alternative locations;
• Request an accounting of certain disclosures of your PHI;
• Obtain a paper copy of the applicable NPP upon request; and
• File a complaint if you believe your HIPAA privacy rights have been violated.

HIPAA generally permits Covered Healthcare Units to use and disclose PHI for treatment, payment, and health care operations without an individual’s written authorization, as well as for certain other purposes permitted or required by law. When HIPAA requires an individual’s authorization for a use or disclosure, UCF will obtain that authorization.

HIPAA also permits health information to be de-identified in accordance with specific regulatory requirements. Once information has been properly de-identified under HIPAA, it is no longer considered PHI under the HIPAA Privacy Rule.

In certain circumstances, information disclosed pursuant to an individual’s authorization may no longer be protected by HIPAA after it is received by a person or organization that is not subject to HIPAA.

If you believe your HIPAA privacy rights have been violated, you may contact the UCF Director of Privacy Compliance at privacy@ucf.edu or file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights. UCF will not retaliate against you for filing a complaint.

Learn more about your rights under HIPAA.

VI. Children’s Privacy

UCF websites and online services are generally intended for students, employees, prospective students, and other members of the university community and public and are not directed to children under the age of 13.

UCF does not knowingly collect personal information online from children under 13 in a manner that would require parental consent under the Children’s Online Privacy Protection Act (COPPA). If a UCF website, program, or service is designed for children under 13 and collects personal information from them, UCF will provide appropriate notice and obtain parental consent when required by law.

If you believe that a child under 13 has provided personal information through a UCF website or online service in circumstances that may be subject to COPPA, please contact the UCF Privacy Office at privacy@ucf.edu.

VII. Use of Third-Party Services

UCF does not sell personal information. UCF may share personal information with third-party service providers that support university operations and services, including technology, communications, educational programs, website functionality, analytics, and other services provided to the university community. When appropriate, UCF requires service providers to protect personal information and use it only for authorized purposes.

Some UCF websites and online services use third-party technologies or content, such as embedded media, analytics tools, scripts, or other website features. When these technologies are used, certain information about your device or interaction with the website, such as your IP address, browser or device type, date and time of access, and pages visited, may be transmitted to the third-party provider.

UCF websites may also contain links to websites or services operated independently by third parties. When you leave a UCF website or choose to interact with an independent third-party service, that provider’s privacy practices and terms apply. UCF encourages you to review the privacy notices of those services before providing personal information.

Some UCF departments may offer communications by text message (SMS). When required, UCF will obtain appropriate consent before sending text messages, and additional terms or notices may apply to specific messaging programs. SMS/text messaging opt-in information and consent are excluded from third-party sharing.

VIII. Privacy Rights Under Applicable Laws

UCF is a public university located in the State of Florida and is generally subject to applicable U.S. federal and Florida laws. In certain circumstances, privacy and data protection laws from other jurisdictions, including the European Union’s General Data Protection Regulation (GDPR), may also apply to specific UCF activities.

When an applicable privacy law provides individuals with rights regarding their personal information, UCF will respond to requests in accordance with that law and other legal obligations applicable to the university.

Depending on the law and circumstances, these rights may include the right to request access to or correction of personal information, deletion or restriction of certain processing, data portability, or objection to certain uses of personal information.

These rights are not absolute and may be subject to exceptions or limitations. For example, UCF may be required to retain or disclose certain records under applicable federal or Florida law even when an individual requests deletion of that information.

Individuals who wish to submit a privacy rights request or have questions about rights that may apply to their personal information may contact the UCF Privacy Office using the information provided below.

IX. International Data Transfers

UCF is a public research university located in the United States. In connection with UCF programs, services, and activities, personal information may be transferred to, stored in, or processed in the United States or other countries where UCF or its service providers operate.

Privacy and data protection laws vary by jurisdiction. When applicable law imposes requirements on the international transfer of personal information, UCF will take appropriate steps to address those requirements and protect personal information consistent with applicable law and university policy.

X. UCF Mobile App Location Services

The UCF Mobile app may use your device’s location or proximity to Bluetooth beacons to provide location-based notifications. When enabled, this information is used only to determine whether a notification should be sent and is not retained after that determination is made.

You can manage location permissions for the UCF Mobile app through your device settings.

XI. Questions / More Info

If you have questions about this Privacy Notice, UCF’s privacy practices, or the handling of your personal information, or if you would like to submit a privacy-related request, please contact the UCF Privacy Office by email or mail:

Director of Privacy Compliance
University Compliance and Ethics
Millican Hall – 3rd Floor
4365 Andromeda Loop N.
Orlando, FL 32816
Contact us online

XII. Updates to this Privacy Notice

Updates to this Privacy Notice occur periodically; this page was last updated on September 25, 2026.