Lifewise Academy - No Security on Student Data

A Lifewise local board member/public school teacher asked a Lifewise teacher to expose the files containing the student rosters, IEP, and medical information to the internet.

Mar 13, 2026

Lifewise Academy is a fundamentalist Christian ministry whose mission is to remove students from public schools to attend bible study during the school day. In 7 years, the ministry has grown to over 1,000 public schools across 500+ districts and over 60,000 students.

Lifewise Academy, in the Patrick Henry Local Schools, uses a spreadsheet in Google Drive to track enrollment and share attendance information with the school. These documents for the 2024-25 and 2025-26 school years have contained student name, teacher’s name, medical, IEP, and allergy information. At the request of a Lifewise local board member who is also a Patrick Henry teacher, the spreadsheet was made available to anyone with the link. See the email below.

This same scenario occurred in the Elmwood School District (Bloomdale, Ohio). The forms that parents had filled out were shared in a spreadsheet, which was made public via the link. This document contains contact info and private information for over 100 families.

Lifewise student enrollment information was made public online.

Lifewise Academy has 1,750 employees and 10,000 volunteers, according to CEO Joel Penton in a September 2025 interview. That creates a very wide scope for potential problems. This demonstrates how easily this mistake could happen. I am not familiar with the organization’s hierarchy, from corporate staff to classroom volunteers, but if a board member asks, someone will respond. Training staff and volunteers on all these security issues is a monumental challenge. Fortunately, Google offers tools to prevent such issues, but it’s clear Lifewise has not put them in place.

The Lifewise enrollment forms ask for personal information and allow parents to authorize the school to share any data it deems appropriate with Lifewise.

Lifewise enrollment forms request personnel information and allow the parents to authorize the school to release personal information to Lifewise.

Technical Details

The security setting “anyone with the link” means the file is accessible to anyone on the internet who knows the URL. This seems secure initially. Lifewise and the school shared the link with a few dozen teachers and staff members who need it. However, the reality of data security on the internet is more complicated. All private information should be protected with authentication and be auditable. Once a file is set to “anyone,” there’s no way to know who is accessing it.

Here is a short list of common ways data can be

If an email account is compromised through a phishing attack, password list, or any other method, the file will be exposed. Millions of email accounts are compromised daily.
Staff could accidentally or on purpose email the link to the wrong people. With no authentication required, anyone could access it.
Individuals with access may be fired or leave, but they could still access the file via the link.
Clicking the link could log the URL on every network or server device through which the data passes. Any number of people could attempt to access it, and with no authentication required, they would see the information.
Google, Bing, and all other search engines could index the file and make it available, increasing people's ability to see it.
The security issue was found through a public records request, which anyone can do. It is not uncommon.

This isn’t an exhaustive list of how the data could be compromised, but it's the most common ways.

It is disappointing that Lifewise has not commented on the online exposure of students' private information. Using Google Drive links appears to be Lifewise's preferred method for sharing enrollment lists with schools.

Lifewise has plans to expand to 10% of schools by 2030. This would be a 10-fold increase from their current size. Potentially requiring the management of over half a million students’ records by a company with very relaxed security protocols for data privacy.

Here are more emails showing Lifewise using shared Google Drive spreadsheets to distribute data to the schools.