Legal
Effective July 14, 2026. This policy explains how Pathways Pro handles information, with confidentiality practices aligned to the APA and CRCC ethics codes and to HIPAA, WIOA Title IV, FERPA, and ADA confidentiality requirements.
This is a working policy for the pilot program and is provided for transparency, not as legal advice; it will be finalized with counsel before general availability. Where an agency or employer using Pathways Pro has its own privacy notice, that notice also applies to its records.
Pathways Pro is a case-management and career-development platform used by vocational rehabilitation (VR) counselors, the people they serve, and the employers, vendors, and community partners who support competitive integrated employment. Much of what moves through this platform is sensitive: disability information, health history, assessment results, and case notes.
We treat that information according to the same confidentiality principles that govern the professionals who use Pathways Pro. Our practices are designed to be consistent with the American Psychological Association (APA) Ethical Principles of Psychologists and Code of Conduct, the Commission on Rehabilitation Counselor Certification (CRCC) Code of Professional Ethics for Rehabilitation Counselors, and applicable health-information and rehabilitation laws including HIPAA, the confidentiality provisions of the Rehabilitation Act / WIOA Title IV, FERPA (for student services), and the confidentiality requirements of the Americans with Disabilities Act (ADA).
Pathways Pro is a tool that supports licensed and certified professionals; it does not replace their independent judgment or their own obligations under their licensing boards, certifying bodies, funding agencies, and law.
We collect only what is needed to provide the service:
Some information is stored only in your browser (for example, in-progress intake and assessment answers held in local storage on your own device) and is never transmitted to us unless you submit it.
Consistent with the HIPAA “minimum necessary” standard and with APA Standard 4.04 (minimizing intrusions on privacy), we use and disclose the least information needed for a given purpose. We use information to:
We do not sell personal information, and we do not use case content for advertising.
Our handling of confidential information is built to align with the following standards:
Where these standards differ, we apply the most protective requirement that applies to the information at issue.
Pathways Pro is built on a HIPAA-aligned, role-based architecture. Clinical and disability-related information entered into a case file is visible only to the person the case concerns and the counselor of record.
Business, vendor, and employment-partner users receive only the specific deliverables a counselor explicitly releases to them — never raw case notes, screener responses, or health history. Access is scoped to role, and actions on records are logged.
Consistent with APA Standard 4.02 and the CRCC Code, confidentiality has limits. Information may be used or disclosed without separate authorization where permitted or required by law or professional duty, including:
Counselors are responsible for discussing these limits with the people they serve at the outset of services, as their ethics codes require.
Important: no technology is perfectly secure, and using any online service carries risk.
We use reasonable administrative, physical, and technical safeguards — encryption in transit, access controls, role-based permissions, and activity logging — to protect the information in Pathways Pro. But no method of transmitting information over the Internet, and no method of electronic storage, is 100% secure. We cannot and do not guarantee absolute security, and confidentiality cannot be guaranteed for anything transmitted or stored electronically.
Real risks exist and are outside any single provider's complete control: interception on a network, unauthorized access, data breaches, malware, phishing, a lost or shared device, weak or reused passwords, and the practices of the third-party services that help operate the platform. This is the same limitation the CRCC Code (Section J) and APA guidance require professionals to disclose when they use technology or distance services.
To protect yourself and the people you serve, we ask that you:
By using Pathways Pro you acknowledge these inherent limits of technology and that you use the service with them in mind.
Drafting features (for example IPEs, assessment interpretations, service deliverables, and letters) send the minimum necessary case context to our AI provider to generate a draft for a qualified professional to review.
AI output is a draft, not a decision. It is never released to another party without counselor review, editing where needed, approval, and signature. AI is not used to make eligibility, benefit, clinical, or legal determinations on its own.
We rely on a limited set of vetted providers to host the platform, process AI drafts, and connect to public labor-market resources (for example, hosting/infrastructure, our AI provider, and public job- and apprenticeship-search services). These providers may process information only to perform services for us and under obligations of confidentiality and security. Where a provider handles protected health information on our behalf, that relationship is governed by an appropriate agreement (such as a HIPAA Business Associate Agreement).
Case and service records are retained for the period required by the applicable funding agency, records-retention schedule, and law, and are then securely disposed of — consistent with APA Standard 6.02 and the CRCC Code's record-keeping provisions. You may request export or deletion of your account data as described below; some records must be retained for a required period even after an account closes.
Depending on your role and the law that applies, you may:
Where information is held by a counselor or agency as part of a VR case record, some requests are directed to that counselor or agency as the record's custodian; we will help route your request appropriately.
If a breach of unsecured personal or protected health information occurs, we will act consistent with the HIPAA Breach Notification Rule and applicable state breach-notification laws — investigating, mitigating, and notifying affected parties and any required agencies without unreasonable delay.
Some services support students with disabilities, including minors (for example, Pre-Employment Transition Services). Where education records are involved, we handle them consistent with FERPA and with the consent requirements that apply to minors, and we look to the counselor, school, or agency of record for the appropriate authorizations.
We may update this policy as the platform, our providers, or the law evolves. Material changes will be reflected in the effective date above and, where appropriate, communicated to account holders.
Questions about this policy, or a privacy or data request, can be sent to privacy@pathwayspro.app. Questions about a specific VR case record may also be directed to the counselor or agency of record.