As per SBIR/STTR guidelines, the Federal Government may, use, modify, reproduce, perform, display,release, or disclose SBIR/STTR Data that are Technical Data within the Government. However, they will not use, release, or disclose any of that data for procurement, manufacturing, or commercial purposes; or release or disclose the SBIR/STTR Data outside the Government except as permitted by paragraph 10(B) of the SBIR/STTR Policy Directive’s Data Rights Clause or by written permission of the Awardee.
Furthermore, with NSF Phase I SBIR/STTR proposals, the standard Data Management Plan states that “all data generated in this SBIR Phase I project is considered proprietary”.
A more extensive write-up on SBIR/STTR and Data Rights by sbir.gov can be found here.
As for ownership between the Small Business and the University, this will depend on the ownership guidelines from the University and in what capacity the University is involved with the IP management.
Hope this helps!