What are the consequences if a Learningrx franchisee violates Privacy Laws?
Learningrx Franchise · 2025 FDDAnswer from 2025 FDD Document
In the operation of the LearningRx Franchised Business, Franchisee will receive "Customer Data." "Customer Data" is information, records, lists or data that contains "Personal Information." "Personal Information" includes information that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer, potential consumer, individual or household, as such term may be further defined or amended by applicable federal, state and local statutes, regulations, ordinances and requirements, including but not limited to, the California Consumer Privacy Act.
Personal Information is collected, maintained or generated in the operation of the LearningRx Franchised Business, including through the use of a point of sale system.
(a) Franchisee agrees, at its sole cost and expense, to at all times:
(b) comply with the data protection, collection, maintenance and use requirements for Customer Data set out in the Operations Manual and this Franchise Agreement, including all policies, procedures and controls that Franchisor implements now or in the future;
(c) comply with all applicable federal, state and local statutes, regulations, ordinances and requirements, including but not limited to, the California Consumer Privacy Act, relating to the data protection, collection, maintenance and use of Customer Data (collectively, "Privacy Laws");
(d) assist and otherwise cooperate with Franchisor to ensure Franchisor's and Franchisee's compliance with applicable Privacy Laws;
(e) promptly notify Franchisor in writing of any Security Incident (defined below) that Franchisee becomes aware of or discovers.
Franchisee will assist and otherwise cooperate with Franchisor to investigate any such Security Incident and will take all required steps, as determined by Franchisor, to remedy Franchisee's noncompliance with applicable Privacy Laws, this Agreement or the Operations Manual.
For purposes of this Section 12.03, "Security Incident" means any actual or suspected accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Data in violation of applicable Privacy Laws, this Agreement or the Operations Manual.
(f) promptly provide Franchisor with the ability to delete, access or copy Customer Data in Franchisee's possession or control;
(g) promptly notify Franchisor of any request regarding Customer Data received by the Franchisee from a "consumer" as defined by applicable Privacy Laws;
(h) adopt policies, procedures, and controls, including those set out in the Operations Manual, if any, that enable Franchisee to respond, and to cause its agents and employees to respond, promptly to any rights request made pursuant to applicable Privacy Laws, including any disclosure request, deletion request, or opt-out request;
(i) adopt policies, procedures, and controls, including those set out in the Operations Manual, if any, that limit access to Customer Data to only those employees that have a need-to-know basis based on specific job function or role.
Franchisee will provide data privacy and security training to employees who have access to Customer Data or who operate or have access to system controls and will require employees to adhere to data confidentiality terms providing for the protection of Customer Data in accordance with this Agreement and the Operations Manual; and
- (j) maintain Customer Data in confidence in accordance with Section 7 of this Franchise Agreement.
Source: Item 23 — RECEIPT (FDD pages 54–209)
What This Means (2025 FDD)
According to Learningrx's 2025 Franchise Disclosure Document, franchisees are responsible for complying with all applicable federal, state, and local statutes, regulations, ordinances, and requirements related to data protection, collection, maintenance, and use of customer data, which are collectively referred to as "Privacy Laws." This includes, but is not limited to, the California Consumer Privacy Act. Franchisees must also assist and cooperate with Learningrx to ensure both parties comply with these Privacy Laws.
If a Learningrx franchisee becomes aware of or discovers any Security Incident, defined as any actual or suspected accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Data in violation of applicable Privacy Laws, the Franchise Agreement, or the Operations Manual, they must promptly notify Learningrx in writing. The franchisee is obligated to assist and cooperate with Learningrx in investigating any such Security Incident and must take all required steps, as determined by Learningrx, to remedy their noncompliance with applicable Privacy Laws, the Franchise Agreement, or the Operations Manual.
Furthermore, Learningrx franchisees must provide Learningrx with the ability to delete, access, or copy Customer Data in their possession or control and promptly notify Learningrx of any request regarding Customer Data received from a consumer as defined by applicable Privacy Laws. Franchisees are also required to adopt policies, procedures, and controls that enable them and their agents/employees to respond promptly to any rights request made pursuant to applicable Privacy Laws, including disclosure, deletion, or opt-out requests. They must also implement policies that limit access to Customer Data to employees with a need-to-know based on their job function. Franchisees must provide data privacy and security training to employees who handle Customer Data and ensure they adhere to data confidentiality terms. Customer Data must be maintained in confidence, as outlined in the Franchise Agreement.
In summary, a Learningrx franchisee's failure to comply with Privacy Laws can lead to required remedial actions determined by Learningrx, potential investigations, and the need to implement or update data protection policies and training programs. The franchisee bears the costs associated with these corrective measures. The agreement emphasizes the importance of data protection and outlines specific steps franchisees must take to ensure compliance and address any security incidents.