Client Data Use Agreement

This agreement is between OnRamp To Independence ("OnRamp," "we," "us") and the individual client whose information is collected through enrollment in or application to OnRamp programs ("Client," "you").

OnRamp collects client data solely to fulfill our mission of supporting foster youth and young adults aging out of care. Specifically, we collect and use data to:

• Determine eligibility and match clients with appropriate programs and services
• Assign and support mentorship relationships
• Track client progress and tailor support to individual needs
• Communicate with clients about their program participation
• Fulfill reporting obligations to funders and grantors using de-identified or aggregate data
• Evaluate and improve the effectiveness of our programs

• Identity & Contact Data: Name, date of birth, phone, email, address
• Demographic Data: Gender identity, race/ethnicity, primary language (voluntary; collected for grant compliance)
• Foster Care & Housing History: Current/former foster care status, housing status, county/state of care
• Education & Employment Data: Educational history, current enrollment, employment status
• Needs Assessment Data: Self-reported needs, goals, and challenges documented during intake
• Program Records: Session notes, progress updates, service plans, referrals made
• Communication Records: Emails, text messages, and other communications with OnRamp staff or mentors
• Consent Records: Signed authorizations, consent forms, and release of information documents

Client data is stored in secure, access-controlled systems. OnRamp employs the following safeguards:

• Administrative controls: Access to client data is limited to staff and volunteers with a legitimate need to know.
• Technical controls: Data is stored in password-protected, encrypted databases and transmitted over secure (HTTPS) connections.
• Physical controls: Paper records, if any, are stored in locked filing systems accessible only to authorized personnel.

OnRamp uses Supabase (a SOC 2 compliant cloud database platform) and other reputable service providers for data storage. These providers are contractually obligated to maintain data security and may not use client data for any purpose other than providing services to OnRamp.

OnRamp will not share, sell, or rent client data to any third party except in the following limited circumstances:

• With your written authorization: When you sign a Release of Information form (ORI-ROI-01) authorizing a specific disclosure to a named party.
• Service providers: Trusted vendors under contract who assist us in operating our programs (e.g., database platforms, communication tools) may process your data only as needed to provide those services.
• Aggregate/de-identified reporting: We may report aggregate statistics (e.g., total participants served, demographic breakdowns, program outcomes) to funders. Individual clients are never identified in these reports without consent.
• Mandatory legal obligations: We may disclose data if required by court order, legal process, or mandatory reporting obligations under Georgia law (e.g., suspected child abuse or neglect).

Client records are retained for a minimum of seven (7) years following the closure of a case, after which records are securely destroyed unless a longer retention period is required by law or funder requirements. You may request access to or deletion of your records at any time subject to applicable retention obligations.

As a client, you have the right to:

• Access your personal records held by OnRamp — submit a written request to info@onramp-independence.org.
• Correct any inaccurate information in your records.
• Restrict certain uses of your data (note: some restrictions may affect our ability to provide services).
• Revoke consent for any specific data use at any time (except where we are legally required to retain records).
• Request deletion of your personal data, subject to applicable legal retention requirements.
• Receive a copy of data shared with third parties upon request, where records are available.

In the event of a security breach that compromises your personal data, OnRamp will notify affected clients in writing within a reasonable time period and in compliance with applicable Georgia law. Notification will include the nature of the breach, what data was affected, steps taken to address the breach, and recommendations for protective action.

By signing below, I acknowledge that I have received and reviewed this Data Use Agreement and understand how OnRamp To Independence collects and uses my personal information.

Signing this form is not a condition of receiving services. Questions? Contact us at info@onramp-independence.org.