See Pathwright Privacy Policy

This policy applies to all team members — employees and contractors — who may come across sensitive data created in the course of our work.

Sensitive data includes personally identifiable information (PII) or any information shared in confidence between one or more users (for instance, feedback on a submission from a teacher or mentor or an answer to a reflection question). By default, Pathwright only requires minimal personal data from users: a first name, last name, and email address are all that’s required to use Pathwright.

Customers may use Pathwright to collect other sensitive data at their discretion and according with their own internal policies. For example, they may create learning paths that include surveys, projects, or reflection questions that collect private information. However, customers are prohibited from collecting:

• Personal health information (PHI)
• Personal data from children under 13.

Pathwright isn’t responsible for how our customers use data they collect, but we are responsible for how we secure it from unauthorized access.

How we secure sensitive data

Access to sensitive data is only granted to team members who need it to perform their role. All members are expected to abide by the following:

• “Super Admin” access permits accessing any user’s data and is only granted to team members who must access it in order to perform their jobs.
• Whenever possible, use test users and mocked data instead of accessing a real user’s information.
• If necessary, we may access a user’s data if required for performing a specific task. For example, diagnosing a bug, evaluating a user interface issue, or assisting a customer in designing a course or learning how to use their account. In all such cases, we should only access the minimum data required to perform the task and promptly discard it once completed.
• Live user data should never be altered unless it’s required to solve an issue. If we need to test adding/editing/deleting data, we use our staging server.

Password Policy

If you have access to user data, you must use a password that meets the minimum requirements:

• Is not used for any other login.