School-Age Technical Assistance Resource Center (SATARC)
OST Tracker (OSTT) Data Privacy & Security Overview

The School-Age Technical Assistance Resource Center (SATARC) provides the Out-of-School Time Tracker (OSTT) as the statewide data collection and reporting system for LEAPS and BOOST grantees under contract with the New York State Office of Children and Family Services (OCFS).

To protect participant information, SATARC has established contractual, administrative, and technical safeguards with its software provider, Pathwise (TransAct Communications).

Privacy & Security Framework

SATARC maintains the following protections for data collected through OSTT:

• An executed Data Processing Agreement (DPA) with Pathwise (TransAct Communications) that includes New York supplemental privacy terms.
• Security controls maintained by Pathwise (TransAct Communications) that align with recognized industry standards, including:
  • Cloud Security Alliance (CSA) STAR
  • NIST security frameworks
  • ISO/IEC 27001
• Encryption and other administrative, technical, and physical safeguards as described in the executed DPA and supporting security documentation.
• Contractual requirements governing confidentiality, appropriate use of data, incident response, and secure data disposition.

Confidentiality

Individuals with access to confidential participant information are required to comply with applicable confidentiality requirements established by the OCFS SATARC contract, including execution of the required confidentiality agreements before being granted access to client-identifiable information.

Data Ownership

Data collected through OSTT is collected solely for purposes of administering and reporting on the LEAPS and BOOST programs in accordance with the SATARC contract with OCFS.

Additional Information

Additional documentation is available:

• Executed Data Processing Agreement
• Pathwise Security Controls Certification
• Pathwise Privacy Policy

For questions regarding data privacy or security, please contact: Amanda Martineau, Customer Success Team Lead at Pathwise: Amanda.Martineau@pathwisek12.com.

• View on Pathwise

SATARC Privacy & Security FAQ

Frequently Asked Questions

Why doesn’t SATARC sign our district’s Software Agreement or Data Security & Privacy Plan?

OST Tracker is provided as a statewide service through the New York State Office of Children and Family Services (OCFS) SATARC contract. Rather than entering into separate agreements with individual grantees, SATARC maintains a statewide Data Processing Agreement with its software provider, Pathwise (TransAct Communications), that governs the privacy and security of data processed through OSTT.

Is there a Data Processing Agreement (DPA)?

Yes. SATARC has an executed Data Processing Agreement with Pathwise (TransAct Communications) that establishes contractual requirements for data privacy, security, confidentiality, incident response, subcontractors, and secure handling of participant information.

Is the system compliant with New York Education Law § 2-d?

The executed Data Processing Agreement incorporates New York supplemental privacy terms designed to address applicable New York student data privacy requirements. 

What information is collected?

OST Tracker collects participant and program information necessary to administer the LEAPS and BOOST programs and to fulfill reporting requirements established by OCFS. Data collection is limited to information required for program administration and reporting.

Who has access to the data?

Access is role-based and limited to authorized users who require access to perform their responsibilities. Individuals with access to confidential participant information are subject to applicable confidentiality requirements.

How is the data protected?

Pathwise (TransAct Communications) maintains security controls aligned with CSA STAR, NIST, and ISO/IEC 27001 standards. Additional privacy and security obligations are established through the executed Data Processing Agreement.

What happens if there is a security incident?

The Data Processing Agreement requires Pathwise (TransAct Communications) to maintain incident response procedures and to provide notice of security incidents in accordance with the agreement and applicable law.

Who should we contact with privacy questions?

Questions regarding OST Tracker privacy or security may be directed to: Amanda Martineau, Customer Success Team Lead at Pathwise: Amanda.Martineau@pathwisek12.com.