Privacy Policy
How we handle your data. Short version: we don't sell it, we don't track you across the web, and we protect what families share with us.
Guiding Pathways Foundation · Effective Date: August 9, 2026 · Last Updated: August 9, 2026
The short version: We built Guiding Pathways Foundation and its apps to help families — not to collect or profit from your data. Information you enter in our apps is stored securely so you can access it across devices. We never sell your data. Read on for the full picture.
1. Who we are
Guiding Pathways Foundation (“Guiding Pathways,” “we,” “us,” or “our”) is a nonprofit organization that builds free web and mobile applications to help families navigate developmental disability services, autism care, adult transition, and related support systems. Our current apps include Autism Pathways, Disability Pathways, and Adult Pathways.
Guiding Pathways Foundation is operated from Colorado, United States. 501(c)(3) status is pending.
If you have any questions about this Privacy Policy or how we handle your information, please contact us at hello@guidingpathways.help.
2. What information we collect
We collect several categories of information depending on how you interact with us.
A. Information you provide when creating an account
When you create an account in one of our apps, we collect your email address, a username, and a password for authentication purposes. This is handled securely through AWS Cognito, Amazon Web Services’ authentication service. AWS Cognito stores your email address, a unique account identifier, your account status, and authentication metadata such as login timestamps. Your password is never stored in plain text.
B. Information you enter in our apps (sensitive information)
When you use our tools — including profile setup, pathway guides, observation logs, and related features — you may enter information including your child’s or loved one’s first name, date of birth, diagnosis status, therapy history, school documentation status, Medicaid application history, and notes about your family’s situation.
This information is stored on our secure servers. We use AWS DynamoDB, a cloud database service provided by Amazon Web Services, to store your profile data, observations, and progress notes. This server-side storage allows your data to be available when you log in from any device or browser. Data is encrypted in transit (TLS) and at rest (AES-256).
Some of this information — specifically health data and diagnosis data — is considered sensitive personal information under applicable privacy laws. We process this sensitive information only as necessary to provide the app’s features to you, or as otherwise permitted by applicable law and with your consent.
C. Push notifications
If you use our mobile applications, we may request permission to send you push notifications regarding your account or certain features. If you wish to opt out from receiving these communications, you may turn them off in your device’s settings.
D. Phone number and text-message (SMS) / voice verification
If you choose to sign up or sign in using your phone number, we collect your mobile phone number to send you a one-time verification code by SMS text message or automated voice call.
E. Information collected automatically
When you visit or use our services, we automatically collect certain technical information. This information does not reveal your specific identity but may include log and usage data (IP address, browser type, device settings, date/time stamps, pages accessed, error reports), device data (hardware model, operating system, ISP), and general location data based on IP address (country or state level). We do not collect precise GPS location.
F. Newsletter and marketing email signups
If you sign up for our newsletter or updates, we collect your email address and any optional information you provide. This is managed through Mailchimp and is used only to send you the communications you signed up for.
3. How we use your information
We use the information we collect to create and manage your account, authenticate you when you log in, send transactional emails such as password resets, personalize your experience within our apps, save your progress across devices, generate your personalized guidance and recommendations, and send you product updates if you have agreed to receive them.
We do not use the health-related information you enter in our apps for advertising, profiling, or any commercial purpose beyond providing our services to you.
We do not sell your personal information. We have not sold or shared any personal information to third parties for a business or commercial purpose in the preceding twelve (12) months.
4. How your information is stored
Health-related and personal information you enter inside our apps is stored in AWS DynamoDB, a cloud database service provided by Amazon Web Services, located in the United States. Data is encrypted in transit (TLS) and at rest (AES-256). AWS is a HIPAA-eligible service provider and we have a Business Associate Agreement (BAA) in place with AWS.
Email addresses collected through newsletter signups are stored by Mailchimp (Intuit Inc.).
5. How long we keep your information
We will only keep your personal information for as long as it is necessary for the purposes set out in this Privacy Policy, unless a longer retention period is required or permitted by law. You may request deletion of your data at any time.
6. Third-party services and sharing
We use a small number of third-party services to operate our apps and website. We may share data with these vendors, service providers, or contractors who perform services on our behalf. The categories include: cloud computing services, data storage service providers, authentication services, website hosting, data analytics, AI service providers, sales and marketing tools, and payment processors.
- AWS Cognito — account authentication and login
- AWS DynamoDB — our secure cloud database
- AWS Amplify — hosts our web applications
- Twilio — SMS and voice verification only
- Mixpanel — product analytics inside our mobile apps
- Firebase Crashlytics — crash and error reporting
- Anthropic — powers AI features (e.g., Ask Me Anything in Adult Pathways). Under Anthropic’s commercial terms, inputs and outputs are not used to train their models
- Google Analytics — anonymized usage data on our marketing website only
- Mailchimp — manages our newsletter list
We do not share health-related information entered in our apps with any third party for advertising, targeting, or any commercial purpose.
7. Cookies and tracking technologies
We use cookies and similar tracking technologies for essential functionality (keeping you logged in), analytics on our marketing website only (Google Analytics), and to maintain the security of our services. We do not place analytics or advertising cookies on authenticated app pages.
8. Do-Not-Track and Global Privacy Control
Because there currently is not a uniform industry or legal standard for recognizing DNT signals, we do not respond to them at this time. However, we recognize and honor Global Privacy Control (GPC) signals. If you use a browser or extension that supports GPC, we will treat this as a valid request to opt out of the sale or sharing of your personal information for targeted advertising purposes under applicable state privacy laws.
9. Your rights and choices
Regardless of where you live, we want to make it easy for you to control your information.
- Access and correct your account information via your account settings in any of our apps
- Delete your app data by emailing hello@guidingpathways.help
- Delete your account from within your account settings in any of our apps, or by emailing us with the subject line “Account Deletion Request”
- Withdraw consent at any time by contacting us
- Unsubscribe from marketing emails using the link in every email
We will process account deletion requests within 30 days.
10. U.S. state-specific privacy rights
If you are a resident of California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, Virginia, or Washington, you may have specific rights regarding your personal information under your state’s privacy law, including the right to know, access, correct, delete, obtain a copy of, and opt out of certain processing of your personal data.
To exercise any of these rights, email us at hello@guidingpathways.help. We will respond within 45 days as required by law. We honor Global Privacy Control (GPC) opt-out signals from your browser.
11. Children and minors
Our apps are intended for use by adults — parents, caregivers, and individuals 18 years of age and older. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has created an account, please contact us immediately at hello@guidingpathways.help and we will delete that information promptly.
The information that parents and caregivers enter about their children is entered by the adult user on behalf of their child and is stored securely under the adult user’s account.
12. Data security
- All data in transit between your browser or device and our servers is encrypted using HTTPS/TLS
- Account authentication is handled by AWS Cognito, using industry-standard security practices
- App data stored in AWS DynamoDB is encrypted at rest using AES-256 encryption
- We have a Business Associate Agreement (BAA) in place with Amazon Web Services
- Access to server-side data is restricted to authenticated users and authorized Guiding Pathways personnel only
However, despite our safeguards, no electronic transmission over the Internet can be guaranteed to be 100% secure. If you become aware of any security concern, please contact us at hello@guidingpathways.help immediately.
13. Changes to this policy
We may update this Privacy Policy from time to time as our practices change or as laws require. The updated version will be indicated by an updated “Last Updated” date at the top of this page. Your continued use of our apps and website after a policy update means you accept the updated policy.
14. How to contact us
If you have questions, concerns, or requests related to this Privacy Policy or how we handle your information, please reach out. We are a small team and we genuinely read and respond to every privacy inquiry.
Email: hello@guidingpathways.help
Operating location: Colorado, United States
We will respond to all privacy requests within 30 days. For state-specific requests, we will respond within the timeframes required by applicable law.