Privacy
Who holds what
A practice is the entity that collects assessment data from its clients. CareerAlign processes that data on the practice’s behalf. A client’s responses belong to the client, are visible to their own practitioner, and are never visible to any other practice.
Consent
Consent is captured from the client, not the practitioner, and is recorded separately for each purpose: completing the assessment, the practitioner viewing results, report generation, and AI-assisted interpretation. Each consent is stored with the policy version in force when it was given, so consent under an earlier policy is not silently treated as consent to a later one.
Access and deletion
Clients can request a machine-readable export of everything held about them, and can request deletion. Deletion removes responses, scores, matches and reports. Aggregate counts already recorded for billing contain no identifying information.
AI disclosure
Language models phrase explanations of results that have already been calculated, and classify free-text answers into a fixed set of themes. Client responses are not used to train models. No model can alter a score.
Still to be settled
Data residency, retention period for completed assessments, the sub-processor list, and the notifiable data breach response procedure. These need decisions and legal review, not placeholder text.