Privacy Policy

DRH Academic Pathways ("DRH," "we," "us," or "our") is an academic consulting firm providing college and medical school admissions advisory services to students and their families. Our principal place of business is in Dearborn Heights, Michigan.

This Privacy Policy applies to information collected through our website, client portal, consultation intake forms, and any related services (collectively, the "Services").

Questions or requests regarding this Policy may be directed to: [email protected]

2.1 Information You Provide Directly

• Account registration: name, email address, phone number, and password (stored as a hashed credential — we never store your plaintext password).
• Consultation intake: academic history, standardized test scores, extracurricular activities, clinical hours, research experience, personal narrative materials, and target program information.
• Payment information: billing name and address. Card numbers and financial account details are collected and processed directly by Stripe, Inc. and are never transmitted to or stored on our servers.
• Electronic agreement signatures: your typed name, role (student or parent/guardian), age confirmation, IP address, and user-agent string, recorded at the time you execute a service agreement.
• Communications: emails, portal messages, and any other correspondence you send to us.

2.2 Information Collected Automatically

• Server logs: IP address, browser type, operating system, referring URL, pages visited, and timestamps — collected for security monitoring and operational diagnostics only.
• Session authentication: a JSON Web Token (JWT) stored in an HttpOnly cookie to maintain your authenticated portal session. This token contains only your user ID and role; it is not used for advertising or cross-site tracking.
• No advertising or analytics cookies: we do not deploy Google Analytics, Meta Pixel, or any third-party advertising or behavioral-tracking scripts on our website or portal.

2.3 Session Recording

DRH Academic Pathways may record Zoom advising sessions for quality assurance, internal training, and continuity of advising. By scheduling and attending a session, you consent to such recording. Recordings are the sole property of DRH Academic Pathways. When made available to clients through the portal, recordings are accessible for a limited period only and may be removed at any time. Clients may not independently audio-record, video-record, or screen-capture any session without the express prior written consent of DRH Academic Pathways. Session recordings are retained for a maximum of ninety (90) days from the session date, after which they are permanently deleted unless a longer retention period is required by applicable law or an active legal dispute.

We use the information we collect to:

• Provide, administer, and improve our advisory services;
• Create and manage your client portal account;
• Process payments and send billing communications;
• Schedule and conduct advising sessions via Zoom;
• Send transactional emails (booking confirmations, session reminders, agreement copies, portal welcome messages);
• Maintain records of executed service agreements;
• Respond to your inquiries and provide client support;
• Comply with applicable law, enforce our Terms & Conditions, and protect the rights and safety of DRH, our clients, and the public; and
• Detect and prevent fraud, unauthorized access, and other harmful activity.

We do not use your information for behavioral advertising, sell your data to data brokers, or share it with third parties for their own marketing purposes.

We share your information only as described below. We do not sell, rent, or trade your personal information.

4.1 Service Providers

We engage the following third-party service providers who process personal data on our behalf under contractual obligations of confidentiality and data protection:

• Stripe, Inc. — payment processing. Stripe collects and stores payment card data directly. See Stripe's Privacy Policy.
• Zoom Video Communications, Inc. — video conferencing for advising sessions. See Zoom's Privacy Statement.
• Airo (GoDaddy Operating Company, LLC) — website hosting and application infrastructure. See GoDaddy's Privacy Policy.

4.2 Professional Advisers

We may share information with our attorneys, accountants, and other professional advisers where necessary for the provision of their services to us, subject to professional confidentiality obligations.

4.3 Legal Requirements

We may disclose your information if required to do so by law or in the good-faith belief that such action is necessary to: (a) comply with a legal obligation or valid legal process; (b) protect and defend the rights or property of DRH Academic Pathways; or (c) protect the personal safety of our clients or the public.

4.4 Business Transfers

In the event of a merger, acquisition, reorganization, or sale of all or substantially all of our assets, your information may be transferred as part of that transaction. We will notify you via email and/or a prominent notice on our website of any such change in ownership or control of your personal information.

Where applicable law requires a legal basis for processing personal data, we rely on the following:

• Contract performance: processing necessary to provide the advisory services you have purchased or requested.
• Legitimate interests: security monitoring, fraud prevention, and improving our services, where these interests are not overridden by your rights.
• Legal obligation: compliance with applicable law and legal process.
• Consent: where we have obtained your consent (e.g., session recording, if applicable).

We implement reasonable administrative, technical, and physical safeguards to protect your personal information against unauthorized access, disclosure, alteration, and destruction. These measures include:

• HTTPS/TLS encryption for all data in transit;
• Hashed storage of passwords (bcrypt);
• HttpOnly, Secure JWT session cookies;
• Role-based access controls limiting data access to authorized personnel; and
• Regular review of our security practices.

No method of transmission over the Internet or electronic storage is 100% secure. While we strive to protect your personal information, we cannot guarantee its absolute security. If you believe your account has been compromised, please contact us immediately at [email protected].

We retain personal information for as long as necessary to fulfill the purposes described in this Policy, unless a longer retention period is required or permitted by law.

Retention periods marked [ATTORNEY REVIEW PENDING] will be finalized prior to this policy going live.

Depending on your location and applicable law, you may have the following rights with respect to your personal information:

• Access: request a copy of the personal information we hold about you.
• Correction: request that we correct inaccurate or incomplete information.
• Deletion: request that we delete your personal information, subject to our legal obligations to retain certain records.
• Portability: request that we provide your personal information in a structured, machine-readable format.
• Objection / Restriction: object to or request restriction of certain processing activities.
• Withdraw consent: where processing is based on consent, withdraw that consent at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, please contact us at [email protected]. We will respond within 30 days. We may need to verify your identity before processing your request.

You will not be discriminated against for exercising your privacy rights.

Our Services are available to students under the age of 18 when a parent or legal guardian executes the applicable service agreement on their behalf. In such cases:

• The parent or guardian is the contracting party and is responsible for all financial obligations.
• The student remains the sole client for purposes of strategic advisory communications and coaching direction.
• Personal information about the student (academic records, application materials, etc.) is collected and used solely to provide the purchased services.
• Parents or guardians may request access to, correction of, or deletion of their minor child's personal information by contacting us at [email protected].

[ATTORNEY REVIEW PENDING — Minor consent procedures, COPPA applicability (if any), and state-specific minor privacy rights to be confirmed.]

Residents of certain U.S. states have additional privacy rights under applicable state law. This section supplements the rights described in Section 8.

California Residents

If you are a California resident, you may have rights under the California Consumer Privacy Act (CCPA) / California Privacy Rights Act (CPRA), including the right to know, delete, correct, and opt out of the sale or sharing of personal information. We do not sell or share personal information as defined under California law.

[ATTORNEY REVIEW PENDING — Full CCPA/CPRA disclosure, categories of personal information collected, and applicable exemptions to be confirmed.]

Other States

Residents of Virginia, Colorado, Connecticut, Texas, and other states with comprehensive privacy laws may have similar rights. Please contact us at [email protected] to exercise any applicable rights.

[ATTORNEY REVIEW PENDING — State-specific rights matrix and applicable exemptions to be confirmed.]

Our website and portal may contain links to third-party websites or services (including Stripe's hosted payment pages and Zoom's video platform). This Privacy Policy does not apply to those third-party services. We encourage you to review the privacy policies of any third-party services you use in connection with our Services.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will:

• Update the "Last Updated" date at the top of this page;
• Notify active clients via email at the address associated with their portal account; and
• Post a notice on our website for a reasonable period.

Your continued use of our Services after the effective date of any updated Policy constitutes your acceptance of the changes.

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

We will respond to all privacy-related inquiries within 30 days of receipt.