Privacy Policy

Last updated: Jul 19, 2026

MyPath is built with privacy as our number-one value. This policy explains what we collect, what we do with it, and, just as importantly, what we don't do.

MyPath is one platform with modules for each season of a counselor's career: Graduation (practicum and internship hours), Licensure (post-master's supervised hours), and Renewal (CE credits and credentials). One account covers all of them. This policy covers the whole platform; where a detail applies to a single module, we say so.

In plain English

We collect the minimum information needed to help you track your hours and credentials. We don't sell your data, share it with advertisers, or train AI models on it. When you delete your account, your data is permanently deleted.

What we collect

Account information:

Email address (used for sign-in and to send you magic links)
Display name (provided by you at signup, or from Google when you sign in with Google)
Which modules your account has access to

Tracking data, entered by you. Depending on which modules you use, this includes:

Licensure: license track details (state, license type, degree date), weekly hour entries, supervisor records (name, credentials, agency, dates, and an optional email address, used only if you request a supervisor review), activities and notes you choose to add, and supervisor review records if you request a review
Graduation (when it launches): program details and practicum/internship hour entries
Renewal (when it launches): credentials, CE activity records, and certificates you upload

That's it. We don't collect IP-address-based location data, browsing history, device fingerprints, or anything beyond what's necessary to make the app work.

What we do with it

We use your data for one thing: to show your own data back to you, and to email you when needed.

Specifically:

Display your hours, supervisors, credentials, and progress in the app
Send you magic-link emails so you can sign in without a password
Send you support replies when you contact us
In the Licensure module, send a review link to a supervisor's email address when you explicitly request it, and email you their response
Generate the audit-ready exports you can download

We do not:

Sell your data, ever
Share it with advertisers or marketing platforms
Train AI models on it
Run analytics that track your behavior
Aggregate your data with other users' for any purpose during beta

Who can see your data

You can see your data. Your data is yours.

MyPath has technical access to the database for the purpose of maintaining the service and responding to support requests. We do not browse user data casually. We look only when you ask for help that requires it.

In the Licensure module, a supervisor you send a review link to can see, until the link expires or you cancel the request: your name, your license track type, the date range you chose, and weekly totals of the hours you attributed to them. They never see your notes, your activities, or anything outside that summary. Anyone the supervisor forwards the link to could view the same summary, because the link itself is the credential. This only happens when you explicitly request a review; if you never use supervisor review, nothing is ever shared.

No one else. The database uses Row-Level Security policies that prevent any user from accessing another user's data, even at the database level.

Where your data lives

MyPath runs on the following infrastructure providers, all based in the United States:

Supabase (database and authentication): stores your account and tracking data, hosted in US East
Vercel (application hosting): serves the app to your browser
Resend (email delivery): sends magic-link and support emails on our behalf
Google (OAuth, only if you sign in with Google): Google authenticates you and tells us your name and email; nothing else

These providers are bound by their own privacy policies. We've selected them specifically because of their privacy practices.

A note on HIPAA

MyPath is not a HIPAA-covered application. Here's why and what that means:

MyPath is intended for your personal record-keeping of hours and credentials. It tracks information about you (your hours, your supervisors, your CE activities), not about your clients.

You should not enter Protected Health Information (PHI) into this app. That includes client names, identifying details, diagnoses, session content, or anything that could identify a person you're treating. Activity and note fields are intended for general descriptions (e.g. "Individual therapy sessions" or "Group facilitation, treatment planning"), not for client-specific information.

If you keep your entries free of PHI, MyPath is a personal productivity tool, not a clinical record. We've designed the app around this assumption: it does not have the audit logging, business associate agreements, or other infrastructure that would be needed for a HIPAA-covered product.

If you have questions about what to write in your notes, err on the side of generality. Your licensing board cares about whether you logged the hours and worked with appropriate supervision, not about specific client details.

A note on AI

MyPath was built collaboratively with AI assistance, specifically Claude, an AI assistant by Anthropic. AI helped with code generation, design, and writing (including parts of this policy you're reading right now).

That said, here is our commitment regarding your data and AI:

We do not feed your data into AI tools for any purpose: not for product improvement, not for support troubleshooting, not for analytics, not for anything
We do not train AI models on your data: your entries are not part of any training set, ours or anyone else's
We have no AI features integrated into the app that read, analyze, or send your data anywhere
AI was used as a development tool only: the same way a developer might use a search engine or documentation. The code that handles your data runs on your behalf only.

If we ever add AI-powered features (for example, an AI assistant for compliance questions), we'll require explicit, opt-in consent, and we'll update this policy to disclose exactly what data the feature uses and how.

Cookies and tracking

We use a single session cookie set by Supabase to keep you signed in. We do not use Google Analytics, Facebook Pixel, or any third-party tracking scripts. We do not show ads.

How long we keep your data

Your data is kept as long as your account exists.

When you delete your account, your data is immediately and permanently deleted from our active database. Note that encrypted database backups maintained for disaster recovery may retain copies for up to 30 days, after which they are also permanently deleted. We cannot access these backups for any purpose other than restoring the database in a disaster.

Your rights

You can, at any time:

Access your data: everything we have on you is visible to you in the app
Export your data: download your records from the app anytime
Correct your data: edit your name, profile, entries, and records directly in the app
Delete your account: self-serve from Settings, effective immediately

Children's privacy

MyPath is intended for adult mental-health professionals and graduate students. We do not knowingly collect information from anyone under 18.

Changes to this policy

If we change this policy materially, we'll email registered users about it and post the change in the app before it takes effect. The "Last updated" date at the top always reflects the current version.

Contact

Questions about this policy, or want to request something not covered here?

Email: hello@mypathapps.com