Two settings decide how much personal data your organisation holds, and both are set at organisation level rather than per participant.
How much identity you collect
Your organisation runs in one of three participant modes. It is chosen in Profile & public page and applies to everyone.
- Standard — participants have named accounts.
- Privacy-first — participants are identified minimally.
- Guest — people can take an assessment without creating an account at all.
Choose deliberately. A school assessing a whole year group has different obligations from a practice working with adults who chose to be there.
When a guardian has to approve
Your organisation can require parental consent. With it switched on, a young participant signs up, and a guardian is emailed an approval link. The account waits until the guardian approves it.
Consent requests expire if nobody acts on them.
If a guardian says the approval link did not work, contact NexPath rather than asking them to try again. An administrator can approve the account directly, and we would want to know about the failure.
Under-16s are never emailed directly about their plan. Reminders and follow-ups go to the registered guardian instead.
What "My account & data" covers — and what it does not
The My account & data page in your sidebar manages your own counselor account: your consent preferences, a download of your own data, and deletion of your own account.
It was called "Privacy & Data", which read like the place you would go to handle a participant's privacy request. It is not, which is why it was renamed.
It does not manage participant data. There is no participant export or erasure on that page, and nothing there affects the people you guide.
Deleting your account does not delete your assessments
If you created assessments inside an organisation, they belong to the organisation's work rather than to you, so deleting your account hands them to an organisation administrator instead of removing them. Participants keep access to what they have taken.
One consequence to know before you try: if you created assessments in an organisation that has no other administrator, deletion is refused until one exists. The message names the organisation. Appoint another administrator, then request deletion again.
Participant data requests
A participant — or their guardian — has the right to a copy of their data and to have it erased. Both are supported, but neither is self-service from your counselor account.
If you receive such a request, pass it to NexPath. Erasure is thorough when it runs: it removes the person's profile, their assessment responses, their signed plans, their AI conversations and the generated interpretations about them.
Erasure is permanent and includes signed plans. If a plan is needed as an institutional record, take a printed copy before requesting erasure — see The plan document.
What the AI sees
This is the question you will actually be asked. It has its own article: What the AI sees, and what it does not.
The short version: names, usernames and email addresses are removed before anything reaches the AI provider, your private notes are never sent, and no participant data is used to train any model.
Related
- What the AI sees, and what it does not
- Your public page — including the address privacy switch
- What you cannot do