Who holds the medical record
PATH is offered to members through their healthcare provider. Visit notes, prescription consultations, telehealth encounters and orders form part of the member's medical record, which is held by the provider's organization.
The provider is the covered entity under HIPAA for that record. PATH processes it on the provider's behalf and only as the provider directs. Members ask their provider for access to, or corrections of, their record.
Business associate agreements
If your organization is a covered entity, or works on behalf of one, tell us when you request a demo and we will discuss a business associate agreement as part of setting up your program.
Where information is kept
PATH runs on Amazon Web Services, which provides hosting, storage and encryption. Member sign-in is handled by Amazon Cognito. Connections between the apps and PATH's servers are encrypted.
Identity checks
Members verify their identity for telehealth services with a government-issued ID, captured in the app.
Service providers
PATH uses these companies to run the service. Each handles personal information only as needed for its part.
- Amazon Web Services: hosting, storage, encryption and account sign-in.
- Ditto: keeps a member's records in step between the app and PATH's servers.
- Zoom: audio and video for telehealth visits.
- Stripe: payments. Card details are entered directly with Stripe, and PATH does not store card numbers.
- Google: map display and nearby pharmacy search.
- Shopify: checkout for orthotic product orders.
The apps use no third-party analytics or advertising services.
This website
This site sets no cookies and loads no analytics, advertising or other third-party scripts. The forms on this site send what you enter to PATH staff by email. The website keeps no copy.
Deleting an account
Members can remove their account in the app or request removal from this site. Removing an account deletes the member's sign-in. The medical record stays with the provider, who is required by HIPAA and state law to keep it for a minimum period.
The full policy
The privacy policy sets out everything PATH collects and how it is used. No method of transmission or storage is completely secure, and the policy says so plainly.