Cross-university platform portalShow a desktop notification when the AI TA finishes replying
Notify me when classmates post messages in the forum
Play an alert sound whenever there is a new notification
Explain Uedu's data export process, triple-consent framework, and data governance architecture, for researchers to describe data protection measures in IRB applications.
Data Export is Uedu's data export and data governance module, forming the core implementation of the Ethicomics (ethical norms) dimension within the Educational Omics framework.
The design goal of this module is to enable teachers and researchers to export educational data for academic research on the premise of ensuring data security and compliance. The system establishes a complete data governance framework through a three-tier consent form system, an encrypted export process and a strict permissions model.
This page is written specifically for researchers preparing IRB (Institutional Review Board) applications, describing the data protection measures required. We recommend listing this article as an IRB appendix to explain the technical safeguards on the platform side.
Uedu's data governance framework follows the 'least privilege principle' and the 'principle of responsibility transfer':
The Uedu platform provides three separate consent documents, forming a complete data protection responsibility chain. All consent documents are managed with version control; electronic signatures record the timestamp, IP address and browser information.
| Item | Content |
|---|---|
| Version | v2026-03-03 |
| Signing time | When an Instructor claims or creates a Course |
| Number of signatures | One time (per version) |
The responsibility document covers 8 major sections:
| Item | Content |
|---|---|
| Version | v2026-03-02 |
| Signing time | Before each export |
| Number of signatures | Each export requires re-signing |
The consent form covers 11 major sections:
Once data are exported, the exporter becomes an independent data controller. Uedu platform no longer has control over the exported data, nor does it bear subsequent responsibility. The exporter must ensure compliance with IRB and personal data protection law requirements.
| Item | Content |
|---|---|
| Version | v2026-03-02 (consent form + confidentiality undertaking) |
| Signatory | Instructor signs the authorisation consent form, TA signs the confidentiality undertaking |
| Signing time | When the instructor authorises a TA as a super TA |
This document set contains two items:
All consent signatures record the following information as legal evidence preservation:
| Field | Description |
|---|---|
| Signature timestamp | UTC time, precise to the second |
| IP address | Signatory source IP |
| Browser information | User-Agent string |
| Consent form version | Version number of the document at the time of signing |
| Signatory identity | Associated user_id |
Data export uses an asynchronous processing architecture to avoid blocking the web server when exporting large volumes of data:
cron_export_processor.py handles export tasks| Format | Description | Applicable scenarios |
|---|---|---|
| JSON | Structured data, with all fields retained | Programmatic analysis (Python / R) |
| Excel | Includes sanitisation of illegal characters | Manual browsing, quick statistics |
The Excel format automatically cleans control characters and invisible characters to avoid errors when opening the file. The JSON format preserves the original content, making it suitable for research analysis that requires complete data.
To avoid overloading the system, exports are rate limited. Each Instructor can have only one export task in progress at any time; new tasks are queued and wait to be processed.
Export file passwords are protected with Fernet symmetric encryption:
SECRET_KEY via SHA-256Access to the data export function is strictly restricted:
| role | Export permissions | Prerequisites |
|---|---|---|
| Instructor | Can export data from your own Course | Data Protection Responsibility Letter signed + consent form signed on each export |
| Super TA | Data for authorised Courses can be exported | Instructor signs the authorisation consent form + TA signs the confidentiality undertaking + consent form signed for each export |
| General TA | No export permission | — |
| Student | No export permission | — |
Super TA export permissions require a complete chain of consent: teacher authorisation (authorisation consent form) → TA acceptance (confidentiality undertaking) → export consent (export use consent form). If any link is missing, the system will reject the export request.
The Uedu platform's data governance framework complies with the Republic of China's Personal Data Protection Act; key statutory provisions are cited below:
| Clause | Content summary | Platform corresponding measures |
|---|---|---|
| Article 41 | Where a person, for their own or a third party's unlawful benefit, acts in breach of this Act and causes harm, they shall be sentenced to imprisonment for no more than five years | The consent form clearly states criminal liability |
| Article 318-1 of the Criminal Code | Anyone who unlawfully leaks another person's secrets through use of a computer shall be sentenced to imprisonment of not more than two years | Cited in the confidentiality undertaking |
Even if the Instructor has lawfully exported the data, you still need to take care when using the data for academic publication:
All consent forms are version-controlled to ensure legal traceability:
Educational data used in this study are exported through Uedu’s Data Export module. The platform establishes a three-tier consent framework: when an Instructor claims a Course, they sign a Data Protection Responsibility Statement (v2026-03-03, covering eight major sections including data scope, confidentiality obligations, security measures, Personal Data Protection Act compliance, and criminal penalties); before each export, they sign an Educational Data Export Use Consent Form (v2026-03-02, covering eleven major sections including purpose limitation, AES-256 encryption requirements, retention and destruction, and transfer of responsibility). The export process uses asynchronous processing (cron_export_processor.py), and the exported results are provided as an encrypted ZIP, with the password protected by Fernet (SHA-256-derived key) encryption. Once downloaded, the exporter becomes an independent data controller. Only student data covered by IRB-informed consent may be used for academic publication. All consent forms are electronically signed and record timestamps, IP addresses and browser information, and are managed with version control. See https://uedu.tw/doc/data-export for a detailed explanation of the data governance methodology.
It is recommended to provide the following: