Partner School Data Processing Addendum

01 Definitions and scope

This Partner School Data Processing Addendum (the "Addendum" or "DPA") supplements the Pathly Partner School Order Form between Pathly Labs, Inc., a Delaware corporation ("Pathly," "we," "us"), and the school, district, or educational organization named on that Order Form ("Partner School," "you"). It takes effect on execution of the Order Form.

1.1 Definitions

1.2 Two categories of data, two different roles

Pathly's school partnerships sit on top of student-owned accounts. That structure produces two distinct data relationships, and this Addendum treats them separately throughout. Getting this distinction right is the single most important thing to understand about how Pathly handles school data.

1.3 Scope

This Addendum applies to Student Data for students affiliated with Partner School. Students who sign up independently, without a school affiliation, are governed by the Privacy Policy and the Terms of Service alone.

A student may be affiliated with Partner School and also connect an independent counselor on a Pathly Counselor plan. Each sees only what their own role permits. Pathly does not disclose Partner School's institution analytics to an independent counselor, and does not disclose that counselor's notes, tags, or roster to Partner School.

1.4 Relationship to other documents

Where this Addendum conflicts with the Partner School Terms, the Order Form, the Terms of Service, or the Privacy Policy, this Addendum controls for Student Data processed in connection with Partner School. The full order of precedence is in Section 2 of the Partner School Terms.

Nothing in this Addendum, in an Order Form, or in any signed addendum reduces the protections Pathly owes students directly under the Privacy Policy and the Terms of Service.

The data inventory and the subprocessor list are maintained as part of this Addendum and are incorporated into it. They replace the static Exhibit A and Exhibit B that earlier versions of this document attached, so that what you review is the current record rather than a snapshot taken on the day you signed. Changes to either follow Section 10.2.

02 Data collection and permitted uses

2.1 Data minimization

Pathly collects only the Student Data necessary to provide the Platform.

A complete inventory of what is collected, the purpose of each field, its retention period, and who can see it is published and maintained at pathly.com/legal/data-inventory. That page is incorporated into this Addendum and is the authoritative statement of what the Platform collects.

2.2 What Partner School provides to Pathly

Partner School discloses a deliberately narrow set of information to Pathly. In most implementations it is nothing at all, because students create their own accounts and self-identify their school.

Section 4 of the data inventory states the same exclusions for every Pathly channel.

2.3 Academic data is self-reported

All academic data in Pathly is self-reported. A grade point average or standardized test score exists in a student's account only because the student entered it, or because a counselor connected to that student entered it on their profile. A number in Pathly is an assertion, not a verified record.

• The student can see any academic value on their profile, whoever entered it.
• The student can change it or delete it at any time.
• If a counselor entered a value and the student corrects it, the student's correction stands. Pathly will not restore a counselor-entered value over a student's correction, and will not notify the counselor to seek approval.
• A student never has to enter academic data. The Platform works without it.

Partner School is responsible for ensuring that its staff enter academic data only where the student, or their parent or guardian, has provided it, or where Partner School's own policies and applicable law authorize it.

2.4 Permitted uses of Student Data

Pathly will use Student Data solely for the following purposes.

Primary Platform services.

• Provide personalized college, career, course, and scholarship guidance to students
• Administer assessments and generate personalized recommendations
• Support student goal-setting and academic planning
• Enable counselor oversight and student progress monitoring, within the limits of Section 4
• Generate counselor analytics and institution-level insights

Platform operations and improvement.

• Improve Platform features, user experience, and guidance quality, using de-identified or aggregated data except where identifiable data is necessary to provide and support the services
• Troubleshoot technical issues and provide support
• Maintain Platform security and prevent fraud and abuse
• Conduct internal research and development using de-identified data

Legal and compliance.

• Comply with applicable laws, regulations, and legal process
• Enforce the Terms of Service and this Addendum
• Protect the rights, property, or safety of Pathly, its users, or the public

2.5 Ownership and control

Partner School retains all rights to School-Provided Data. Pathly processes it solely to provide the services described in the Order Form, and nothing in this Addendum transfers ownership of it to Pathly.

Student Account Data belongs to the student. It is not Partner School's property, and it is not Pathly's. Partner School's rights in respect of it are the access rights described in Section 4, for as long as the agreement is in effect, and the termination export described in Section 7.4. Pathly holds it as controller in a direct relationship with the student, subject to the commitments in the Privacy Policy.

Where a student is affiliated with Partner School and Partner School has FERPA obligations in respect of records it maintains about that student, this Addendum does not reduce those obligations, and Pathly will support Partner School in meeting them under Section 9.

2.6 Consent and notice responsibility

Partner School is responsible for providing any parent or guardian notice, and for obtaining any consent, that FERPA, COPPA, PPRA, or applicable state law requires before disclosing School-Provided Data to Pathly or directing students to the Platform as part of school programming.

Partner School confirms that it has authority to disclose School-Provided Data to Pathly as a "school official" with a "legitimate educational interest" under FERPA.

Pathly will provide supporting information, template notices, and assistance with parent and guardian requests on Partner School's reasonable request.

2.7 Prohibited uses

03 Security and confidentiality

3.1 Security measures

Pathly maintains administrative, physical, and technical safeguards designed to protect Student Data against unauthorized access, disclosure, alteration, and destruction.

Administrative safeguards.

• Background checks and written confidentiality agreements for personnel with access to Student Data
• Security awareness training for personnel with access to Student Data
• Documented incident response and notification procedures
• Access granted on a least-privilege basis and removed when no longer needed
• Regular review of security policies, and of subprocessor posture as the Platform changes

Technical safeguards.

• Encryption in transit using TLS 1.2 or higher
• Encryption at rest using AES-256 or equivalent
• Row-level security, so students reach only their own data and counselors reach only students at their own institution
• Role-based access control across student, counselor, and administrative roles
• Multi-factor authentication for administrative access to production systems
• Automated security monitoring and error tracking, with personal information scrubbed from traces
• Secure development practices, including code review and dependency monitoring

Physical and hosting safeguards.

• Student Data is hosted in data centers operated by Pathly's infrastructure subprocessors, which maintain industry-standard physical access controls
• Pathly configures every service to use United States regions where the provider offers them
• Pathly does not intentionally transfer Student Data outside the United States, though limited access from outside the United States may occur for vendor support or security operations

3.2 Personnel access and confidentiality

• Pathly personnel access Student Data only as needed to operate the Platform, resolve a support request, or investigate a security issue.
• Access requires unique credentials, is limited by role, and administrative access is logged.
• Everyone with access is bound by written confidentiality obligations.
• Unauthorized access or disclosure is grounds for immediate termination of employment or engagement.

Conversation content is a narrower case. Pathly personnel access it only where a documented support or security need requires it, as described in Section 5.6 and in Section 6 of the data inventory.

3.3 Subprocessor security requirements

Pathly requires every Subprocessor to maintain:

• A written data processing agreement limiting use to providing services to Pathly
• Encryption in transit using TLS 1.2 or higher, and at rest using AES-256 or equivalent
• Retention limited to what the service requires
• Prompt notification to Pathly of security incidents
• Deletion or return of data on termination
• Compliance with applicable privacy laws, including COPPA and applicable state student privacy laws
• Industry-standard security controls, verified against the provider's published documentation

The current list, what each provider touches, whether its data processing agreement is separately executed or incorporated, and a link to each provider's own trust center, are published at pathly.com/legal/subprocessors. That page is incorporated into this Addendum.

3.4 What Pathly does not hold

04 Counselor dashboard and data access

Counselor visibility is fixed by the Platform and enforced in the database. It is not configured per school, and it cannot be widened by agreement. Pathly may add fields to the visible set only in accordance with Section 10.2.

4.1 Roster view

4.2 Student detail view

4.3 What counselors never receive

4.4 Student conversation privacy

Conversation content is not shared with counselors, administrators, or parents, and is never used for advertising. It is processed by the subprocessors described in Sections 5 and 6 solely to provide the Platform.

• Counselors receive engagement signals derived from metadata only: message counts, timestamps, saved career interests, and assessment completion.
• The system that writes the engagement summary shown to a counselor does not read conversation content.
• Pathly's conversational AI uses the last 10 messages for continuity. That context serves the student's own experience and is never surfaced to a counselor.
• A student may choose to share a specific excerpt with a counselor. That is always a manual act by the student, it is never automatic, and it never happens by default.

This holds for school counselors exactly as it holds for independent counselors on a Pathly Counselor plan. It is not a setting, and Partner School cannot enable access to conversation content by agreement, by request, or by escalation.

4.5 Access controls

Technical safeguards.

• Row-level security restricts each counselor account to students at its assigned institution, enforced by a database function rather than by application logic alone
• Counselor accounts are role-restricted and cannot impersonate a student or view an account as the student sees it
• All counselor access to student detail views is logged for audit

Partner School responsibilities.

• Partner School designates which staff receive counselor dashboard access, and each is a named individual. Credentials are not shared.
• Partner School notifies Pathly promptly when access should be revoked, including when a staff member leaves.
• Partner School ensures its counselors comply with FERPA and its own data privacy policies.
• Partner School notifies Pathly at security@pathly.com within 24 hours of discovering that credentials may have been compromised.

4.6 Institution analytics

Partner School may view and export cohort analytics. These contain no student names and no individual student records. They are counts and percentages: enrollment, onboarding and milestone completion, milestone distribution, career interest categories, completion rates by grade level, exploration activity, and the colleges and scholarships saved most often across the cohort.

Every institution analytics export carries the institution name, the reporting period, and the timestamp it was generated, so any copy in circulation can be traced to a point in time.

05 AI processing

5.1 What Pathly uses AI for

Pathly uses third-party AI services by API to provide conversational guidance to students on colleges, careers, courses, and scholarships, and to retrieve information used in recommendations. Providers are selected in part on their security posture and are listed at pathly.com/legal/subprocessors.

5.2 What is sent to AI providers

Where Partner School has provided them, a request may also carry institutional reference information: the courses available at Partner School, state graduation requirements, and local or regional scholarship opportunities. This is information about the institution and the jurisdiction, not about any student, and it contains no Personal Information. It is listed here for completeness because a security review will ask what else travels with a request.

5.3 Training and retention

• Pathly does not permit AI providers to train their models on Student Data, and uses the provider settings and contractual terms available to it to disable training and minimize retention.
• AI providers use the contents of a request solely to generate a response to that request.
• Pathly does not train proprietary models on individual student conversations. De-identified, aggregated patterns may inform prompt design and product improvement.

5.4 Data minimization in AI requests

• Only the minimum necessary data is included in a request.
• Student identifiers are minimized while preserving personalization.
• Conversation history in a request is limited to the last 10 messages, never the full history.

5.5 Moving between listed providers

Pathly uses more than one AI provider, selected by task, performance, availability, security posture, and cost. A given request may route to any provider listed in Section 4 of the subprocessor list and suited to it. Routing between providers already listed is not the addition of a new Subprocessor. Adding a provider that is not listed follows Section 6.3.

5.6 What is stored

Pathly distinguishes between two things, and the difference comes up in every security review.

06 Subprocessors

6.1 The current list

Partner School authorizes Pathly to engage the Subprocessors published at pathly.com/legal/subprocessors, and their affiliates, to process data in providing the Platform. That page is the current list, is maintained as part of this Addendum, and replaces the static Exhibit B attached to earlier versions of this document.

For each provider it states the function, the data it touches, whether its data processing agreement is separately executed or incorporated into accepted terms, and a link to the provider's own trust center. Six categories and nine providers are listed as of the effective date of this version. All process data in United States regions.

6.2 Requirements

Every Subprocessor must meet the requirements in Section 3.3. In addition, every Subprocessor must:

• Use Student Data only to provide services to Pathly
• Not disclose Student Data to unauthorized parties
• Notify Pathly promptly of any security incident
• Delete or return Student Data on termination
• Comply with FERPA, COPPA, and applicable state student privacy laws

6.3 Changes

• Pathly gives at least 30 days' advance written notice before a new Subprocessor begins processing, by updating the subprocessor page and emailing the contacts on the Order Form.
• Partner School may object within 15 days, with a specific privacy or security concern.
• Pathly will work in good faith to address it.
• If the concern cannot be resolved, either party may terminate without penalty, and Pathly will refund any prepaid, unused fees on a pro-rata basis.

Routing a request to an AI provider already listed is not the addition of a new Subprocessor, as described in Section 5.5. Pathly reflects such changes on the subprocessor page. That notification is informational and does not require Partner School approval.

6.4 Documentation and audit of subprocessors

• Partner School may request Subprocessor data processing agreements, redacted for commercial confidentiality.
• Partner School may request Subprocessor security certifications. Some providers gate the full report behind a request; where Pathly holds a gated report, it is available to Partner School on request.
• Pathly provides requested documentation within 30 days.

07 Data retention and deletion

7.1 Student account ownership

Student accounts belong to students, not to Partner School. The Platform is designed to support a student across their whole educational path, including beyond their affiliation with any single institution.

• Students retain ownership and control of their accounts and their data.
• Students may access, export, or delete their own data at any time from account settings.
• Partner School's agreement governs Partner School's access to student data. It does not govern student account ownership.

7.2 During the agreement

• Students affiliated with Partner School may use the Platform.
• Designated counselors may access student data within the limits of Section 4.
• Student Data is retained to provide the Platform, on the schedule in Section 5 of the data inventory.

7.3 After termination

Effect on student accounts. When a Partner School agreement terminates, student accounts are not deleted.

• Students retain full access to their accounts and their data.
• Students may continue using Pathly independently, at no cost.
• Students may delete their accounts at any time if they choose.

Effect on Partner School access.

• Counselor dashboard access is terminated.
• Partner School can no longer view student data or institution analytics.
• Institutional affiliation is removed from student accounts.

7.4 The termination export

On termination, Pathly will provide Partner School with a school-level data export on written request to legal@pathly.com. This export is produced once, on request, and is distinct from the in-product exports described in Section 7 of the data inventory.

Timeline. The written request must be submitted within 30 days of termination. Pathly provides the export within 30 business days of the request. Partner School then has 30 days to download and verify it.

Partner School's continued use of exported data is governed by its own record retention policies, FERPA, and applicable state law. Pathly's obligations in respect of that copy end on delivery.

7.5 Individual student deletion

A student may delete their account at any time, regardless of the status of Partner School's agreement. Pathly will not delay, condition, or route a student's deletion request through Partner School.

• The request is made from account settings, or by writing to privacy@pathly.com.
• A 15-day grace period allows the student to restore the account.
• After the grace period, permanent deletion from production systems within 2 business days.
• Backup data is purged within the 7-day backup rotation.

Where a student is affiliated with Partner School and Partner School's policies or applicable law require coordination on a request, Pathly will tell the student that this applies. Coordination does not give Partner School a veto over a student's deletion of their own account.

7.6 De-identified and aggregated data

• De-identified and aggregated data that cannot reasonably be used to identify an individual may be retained indefinitely for platform improvement and research.
• It is not used for targeted advertising.
• Pathly does not re-identify de-identified data, and requires anyone who receives it to agree not to.

7.7 Legal holds

If Student Data is subject to a legal hold, litigation, or regulatory requirement, Pathly will notify Partner School where permitted, preserve the affected data beyond the periods above, and delete it promptly once the obligation lifts.

08 Security incident notification

8.1 Notice to Partner School

Pathly will notify Partner School without undue delay, and no later than 72 hours after confirming a Security Incident affecting School-Provided Data or the data of a student affiliated with Partner School. Notice goes to the primary contact on the Order Form and to any designated security contact.

8.2 What the notice will include

• The nature of the incident, the date or window, and its current status
• The categories of data and the approximate number of students affected
• Steps taken to investigate, contain, and prevent recurrence
• Whether law enforcement or a regulator has been notified
• What, if anything, Partner School should do

Pathly will provide updates at least every 7 days, and sooner on material developments, until the incident is resolved. Material developments include a significant change in scope or in the number of affected records, identification of root cause, completion of containment, regulatory or law enforcement involvement, and any information that would affect Partner School's own notification obligations.

8.3 Pathly's response obligations

• Promptly investigate to determine scope, cause, and impact
• Take immediate steps to contain the incident and prevent further unauthorized access
• Implement additional measures to prevent recurrence
• Reasonably cooperate with Partner School's own response activities

8.4 Who notifies whom

The two data categories in Section 1.2 produce two different notification duties, and it is worth being explicit about which falls where.

In practice an incident will often touch both, and the parties will coordinate so that a student does not receive two conflicting notices about the same event. Neither party should make a notification on the other's behalf without agreeing the content first. Partner School remains responsible for notifications arising from an incident in its own systems, including a compromise of Partner School's counselor credentials.

8.5 Liability

Liability for Security Incidents and privacy violations is governed by the limitation of liability in Section 7 of the Partner School Terms, including its stated exceptions and the enhanced cap applicable to unauthorized disclosure of Student Data. Nothing in this Section waives or limits either party's liability for an incident caused by its own gross negligence or willful misconduct.

09 Compliance and audit rights

9.1 Regulatory compliance

Pathly's practices are designed to meet the requirements of the following, and Pathly agrees to comply with each to the extent it applies to Pathly's processing under this Addendum.

Federal.

• Family Educational Rights and Privacy Act (FERPA), 20 U.S.C. § 1232g
• Children's Online Privacy Protection Act (COPPA), 15 U.S.C. §§ 6501 to 6506
• Protection of Pupil Rights Amendment (PPRA), 20 U.S.C. § 1232h

State.

• The South Carolina Student Data Privacy, Accessibility, and Transparency Act, as applicable
• Any other applicable state student privacy law

Pathly's compliance commitments.

• Act as a "school official" with a "legitimate educational interest" under FERPA in respect of School-Provided Data
• Use Student Data only for authorized educational purposes
• Not disclose Student Data without authorization, except as the law permits
• Maintain security safeguards appropriate to the sensitivity of the data
• Destroy Student Data when it is no longer needed for an authorized purpose, on the schedule in Section 7

9.2 Partner School audit rights

Partner School may request the following no more than once annually, and Pathly will provide it within 30 business days:

• A written attestation of Pathly's compliance with this Addendum
• A summary of security measures and controls
• The list of Subprocessors and their security certifications
• Confirmation of data deletion

Partner School may also request, at any time, the documentation described in Section 6.4, and a copy of the versions of this Addendum and the Partner School Terms in force on any date during the term.

9.3 Limits on audit rights

For security and operational reasons, Pathly is not required to provide direct access to production systems, source code, full penetration test reports, or customer lists.

9.4 Security certifications

Pathly maintains the technical and administrative controls described in Section 3 and requires the subprocessor controls described in Section 3.3. Pathly conducts regular internal security reviews and is working toward independent certification.

Pathly does not hold a SOC 2 Type II attestation of its own today, and does not claim one. The SOC 2 Type II and comparable attestations referenced in this Addendum and on the subprocessor list are held by Pathly's subprocessors. Each is linked to the provider's own trust center so Partner School can verify it directly. Certifications are as reported by providers and may change, which is why the subprocessor list links to the source rather than restating it.

Pathly will tell Partner School if it obtains an attestation of its own, and will update the subprocessor list and this section when it does.

9.5 Regulatory inquiries

If Partner School receives a regulatory inquiry concerning Student Data processed by Pathly, Partner School will notify Pathly promptly at legal@pathly.com. Pathly will cooperate reasonably and provide documentation as needed. The same applies in reverse: if Pathly receives an inquiry concerning students affiliated with Partner School, Pathly will notify Partner School where it is permitted to do so.

10 Term, changes, and survival

10.1 Term

This Addendum is effective as of the Order Form effective date and continues for the duration of the Order Form term, including renewals.

10.2 Changes

The version of this Addendum in force on the effective date of your Order Form is the version that applies to you for your initial term, under Section 11.1 of the Partner School Terms. A later version published on this page does not reach back into a signed agreement.

Two kinds of change reach a live agreement before renewal, and each carries its own process.

Every version is dated and retained. Current versions are listed in the version history, and every substantive change is listed in the changelog.

10.3 Survival

The following survive termination:

• Section 7, data retention and deletion, for ongoing student accounts and for the export window
• Section 8, security incident notification, as to incidents discovered during the term
• Section 9.5, regulatory inquiries, as to ongoing matters
• Confidentiality obligations, per Section 9.2 of the Partner School Terms
• Limitation of liability, per Section 7 of the Partner School Terms

10.4 Data handling after termination

• Partner School's access to student data ends on termination.
• Student accounts remain active, and students may continue using Pathly independently.
• Partner School's right to request the termination export continues for 30 days after termination, under Section 7.4.
• This Addendum's confidentiality and data protection obligations survive termination.

10.5 Acceptance and contact

By signing the Pathly Partner School Order Form, both parties accept this Addendum. It is incorporated into and made part of that Order Form. No separate signature is required, and on request Pathly will provide a PDF of the exact version in force on the date of signature.

Privacy and this Addendum: legal@pathly.com. Security matters: security@pathly.com. Privacy requests from students and families: privacy@pathly.com. Pathly Labs, Inc., 885 Gold Hill Rd #3142, Fort Mill, SC 29708.