Privacy Policy

The categories below describe information that may be processed. The information collected in a particular case depends on the Tribal VR program’s practices, the services requested, and applicable reporting requirements.

Participant and applicant information

This may include:

• Name, address, telephone number, email address, and other contact information.
• Date of birth, age, gender, and demographic information.
• Tribal affiliation, enrollment information, community, or geographic service-area information.
• Social Security number or other government-issued identifiers, when authorized and necessary.
• Emergency contacts, guardians, representatives, or family contacts.
• Application date, referral source, and program participation information.

Disability, medical, and eligibility information

This may include:

• Disability type, condition, or cause.
• Medical, psychological, functional, or vocational assessments.
• Eligibility determinations and supporting documentation.
• Information about barriers to employment and accommodation needs.
• Provider records or evaluations supplied to the Tribal VR program.

Disability, medical, psychological, and eligibility records are particularly sensitive and receive heightened confidentiality protections.

Case-management information

This may include:

• Applications and eligibility records.
• Individualized Plans for Employment and plan history.
• Employment goals and planned services.
• Case notes, progress notes, contacts, appointments, and activities.
• Referrals and services provided.
• Education, training, certifications, and employment history.
• Wage, employment, and outcome information.
• Case status, closure reasons, and follow-up information.
• Participant photographs, documents, attachments, and correspondence.

Financial and service information

This may include:

• Service authorizations.
• Vendor or provider information.
• Program budgets and participant-related expenses.
• Payments, invoices, and cost summaries.
• Comparable benefits and other funding sources.

TVR Software does not collect payment-card or banking information unless a specific feature or written agreement expressly provides for that processing.

Reporting and program-performance information

The software may process or generate:

• RSA/AIVRS compliance data.
• Annual and periodic program reports.
• Participant and case counts.
• Service-delivery and cost summaries.
• Application, eligibility, plan, employment, and closure metrics.
• Longitudinal trends and cohort analyses.
• Disability, demographic, tribal, community, and geographic summaries.
• Operational dashboards and performance indicators.

User-account information

For counselors, directors, administrators, and other authorized users, the software may process:

• Name and work contact information.
• Username and authentication information.
• Assigned organization, office, role, and permissions.
• Account status and preferences.
• Login history and security events.
• Training, help-desk, or support information.

Passwords should be stored using appropriate protective measures and should not be available to TVR Software personnel in readable form.

Device, system, and usage information

Depending on the deployment, TVR Software may automatically process:

• IP address.
• Browser and device type.
• Operating system and software version.
• Date and time of access.
• Session and authentication events.
• Features accessed and actions performed.
• Audit logs.
• Error, crash, and diagnostic information.
• Network and system-security events.

Information is collected and processed to:

• Administer Tribal Vocational Rehabilitation programs.
• Maintain complete and accurate records of services.
• Support intake, eligibility, planning, service delivery, case monitoring, and closure.
• Track services, expenses, employment outcomes, and program performance.
• Generate required RSA/AIVRS reports.
• Help Tribal VR programs meet applicable grant, audit, and reporting obligations.
• Provide real-time dashboards and operational reports.
• Authenticate users and enforce role-based access.
• Maintain audit trails and protect against unauthorized access.
• Provide training, technical assistance, and customer support.
• Diagnose errors and improve the reliability, usability, accessibility, and security of the software.
• Back up and restore information where included in the applicable deployment.
• Comply with lawful contractual, regulatory, judicial, or governmental requirements.

Participant information is not used for targeted advertising or unrelated commercial profiling.

Each Tribal VR program is responsible for informing applicants and eligible individuals of:

• The legal or program authority under which information is collected.
• The principal purposes for collecting and using the information.
• Whether providing each category of information is mandatory or voluntary.
• The possible effects of declining to provide requested information.
• When informed written consent is required before information may be released.
• The agencies or organizations to which information is routinely disclosed.

TVR Software does not independently establish these requirements. Questions about why particular information is requested should be directed to the Tribal VR program handling the individual’s case.

Personal information maintained through TVR Software must be used only for purposes directly connected with administering the applicable Tribal Vocational Rehabilitation program, except where another use or disclosure is authorized by law and applicable policy.

Identifiable participant information should be accessible only to authorized personnel with an official program responsibility and a legitimate need to access it.

Federal regulations require Tribal VR units to adopt safeguards for personal information and restrict its use and release. They also address access, amendments, written consent, written data-sharing agreements, audits, evaluations, research, legal disclosures, and safety-related disclosures. 34 C.F.R. § 371.44

Nothing in this policy is intended to reduce any protection provided by Tribal law, federal law, applicable state law, a Tribal VR program’s policies, or an agreement with a participating Tribe.

TVR Software does not sell participant personal information.

Information may be disclosed in the following circumstances, subject to applicable law, Tribal policy, consent requirements, and contractual restrictions.

At the direction of the Tribal VR program

TVR Software may process or disclose information when instructed by the Tribal VR program responsible for the records, including for authorized reporting, support, system administration, or data migration.

Authorized service providers and cooperating agencies

A Tribal VR program may disclose information to service providers or cooperating agencies when necessary to provide program services and when the disclosure is permitted by applicable law and policy.

Where required, disclosures must be supported by informed written consent and a written agreement that limits the recipient’s use and further disclosure of the information.

Technology service providers

For cloud-hosted systems, limited information may be processed by contracted providers supporting:

• Secure cloud hosting.
• Encrypted storage and backups.
• System monitoring and error logging.
• Authentication and security.
• Email or service notifications.
• Customer-support and ticketing functions.

These providers may process information only to provide contracted services and must be subject to appropriate confidentiality and security obligations.

Current subprocessors: [Insert or link to the current list of cloud, support, email, backup, and monitoring providers.]

RSA/AIVRS reporting

Authorized users may generate and submit reports required for AIVRS program administration, oversight, grant compliance, and performance reporting.

Where possible and appropriate, reports should use aggregate or de-identified information. Identifiable information should be included only when required and authorized.

Audits, evaluations, and research

Information may be released for an authorized audit, evaluation, or research activity only when applicable requirements are satisfied. These may include a written agreement limiting use, access, redisclosure, and publication of identifiable information.

Legal and safety requirements

Information may be disclosed when required by applicable federal law or regulation, an authorized judicial order, or a legally valid investigation involving fraud or abuse.

Information may also be disclosed when authorized and necessary to protect an individual or another person from a serious safety threat.

TVR Software will refer requests for participant records to the responsible Tribal VR program when legally and operationally appropriate.

TVR Software recognizes the importance of Tribal sovereignty and Tribal authority over program records and data governance.

Except as required by applicable law or expressly provided in a written agreement:

• A Tribe or Tribal VR program retains control over the participant and program data it enters into TVR Software.
• TVR Software does not claim ownership of Tribal participant records.
• Information from one Tribal VR program will not be made available to another program without authorization.
• Identifiable Tribal data will not be used to create unrelated commercial datasets.
• Identifiable Tribal data will not be published or used for unrelated research without required authorization and consent.
• Data exports, transfers, archival procedures, and deletion at contract termination will be handled according to the applicable agreement and Tribal instructions.

TVR Software uses administrative, technical, and organizational safeguards designed to protect information against unauthorized access, loss, alteration, misuse, or disclosure.

Depending on the deployment, safeguards may include:

• Encryption during transmission.
• Encryption of stored cloud data.
• Individual user accounts.
• Role-based access controls.
• Password and authentication protections.
• Audit logging.
• Session controls.
• Backups and recovery measures.
• Security monitoring.
• Software updates and vulnerability management.
• Personnel confidentiality requirements.
• Procedures for responding to suspected security incidents.

For on-premises installations, the Tribal VR program is responsible for safeguards under its control, including server security, endpoint security, network configuration, local backups, operating-system updates, physical security, and management of user accounts.

No electronic system can guarantee absolute security. Users must protect their credentials, use only authorized devices and networks, and promptly report suspected unauthorized access.

If TVR Software discovers a security incident involving information in a system it manages, TVR Software will investigate and notify the affected Tribal VR program in accordance with the applicable customer agreement and legal requirements.

The Tribal VR program is generally responsible for determining whether notice must be provided to participants, regulators, Tribal authorities, or other parties unless the applicable agreement provides otherwise.

Security concerns may be reported to support@tvrsoftware.com

Applicants, eligible individuals, and their authorized representatives may submit a written request to the Tribal VR program responsible for their case to:

• Access their record of services.
• Obtain a copy of information in the record.
• Request correction of information believed to be inaccurate or misleading.
• Request that a disputed amendment be documented if the program does not make the requested change.

Requests involving medical, psychological, or other information that could be harmful to the individual may be handled through a qualified third party chosen by the individual, as permitted or required by applicable rules.

Information obtained from another agency may be subject to that agency’s release conditions.

TVR Software cannot independently change, release, or delete a participant’s official case record unless authorized by the Tribal VR program controlling that record.

Authorized software users may be able to:

• Update their account information.
• Change their password.
• Manage accessibility or display preferences.
• Configure reports and dashboards.
• Manage certain system notifications.
• Request account deactivation through their program administrator.
• Contact support about technical or account-security concerns.

Program administrators are responsible for promptly updating or disabling access when a user changes roles, leaves employment, or no longer needs access.

The cloud-hosted software and public website may use cookies or similar technologies that are necessary to:

• Maintain authenticated sessions.
• Protect account security.
• Remember user preferences.
• Support accessibility settings.
• Diagnose errors and maintain system performance.

TVR Software does not use participant case data for behavioral advertising.

If optional website analytics or marketing cookies are used, they should be described in a separate cookie notice or consent tool.

If TVR Software is accessed through a mobile device or a feature requiring device permissions, the system may request access to features such as:

• Camera access for capturing authorized case documents or participant photographs.
• File access for uploading or downloading authorized records.
• Notifications for service or security messages.

Permissions should be requested only when needed for the selected function. Device permissions can generally be managed through device settings.

TVR Software does not collect precise device location unless a feature expressly requires it and the user or Tribal VR program has authorized that collection.

Privacy and confidentiality information should be made available to applicants and participants in an appropriate mode of communication and, when required, in the individual’s native language.

Individuals who need an accessible version of this policy or assistance understanding their privacy rights should contact their Tribal VR counselor or program office.

TVR Software may update this Privacy Policy to reflect changes in the software, security practices, legal requirements, or business operations.

The revised policy will be posted with an updated effective date. When appropriate, Tribal VR program administrators will be notified of material changes.

A policy update does not authorize a new use or disclosure of participant information when separate consent, Tribal authorization, or a written agreement is required.