Encryption: am I doing it right?
It all has to do with your requirements. If you want the server to have access to the data when the user logs in but not allow the server offline access. Then this scheme seems reasonable. 
You have a second key which may or may not be needed. If each user has exactly one password and exactly one random key then you could use the password derived key directly.
You did specify how you encrypt the data, but AES GCM again would be reasonable.
You want to make sure you can verify they password. Use of GCM for the key or use of GCM for the data would suffice.
If the data encrypted is large, a second key allows changing password without reencrypting all of it. For small data I may recommend skipping the second key.
Be sure you use secure random number generators.
Be sure the password is sent to the server over a secure line(e.g SSL). 
Some would advocate for doing hashing client side, which makes the server never have the clear text, and the client does the heavy computation, preventing some DOS attacks and some timing attacks.