Last updated: PLACEHOLDER — set the real publication date

Who this policy covers

This policy describes how Community Horizons ABA (“we”, “us”) handles information submitted through this website, including the general inquiry form on the Contact page and any optional resource sign-up.

PLACEHOLDER — insert the legal entity name, state of incorporation, and any parent organization. If the organization is a covered entity or business associate under HIPAA, this policy must be replaced by or coordinated with a HIPAA Notice of Privacy Practices; a general website privacy policy is not a substitute for one.

What the inquiry form collects

The form is intentionally minimal. We ask only for what is needed to route an inquiry and reply:

  • Parent or caregiver name
  • Email address and, if you choose to provide it, a phone number
  • Your preferred method of contact
  • A general area or ZIP code, so we can speak to service availability
  • The type of support you are interested in, and any optional message you choose to write

What we ask you not to send

Please do not include your child’s full name together with their date of birth, diagnosis, medical records, assessment reports, medication details, or insurance member numbers in this form. If a clinician needs that information, we will arrange a secure method for it.

The reason is practical as well as legal: general contact forms and the email systems behind them are usually not designed to hold clinical information, and sending it there creates risk your family did not agree to.

How we use information

We use submitted information to:

  • Respond to your inquiry and arrange an initial conversation
  • Determine whether your location falls within our service area
  • Keep a record of our contact with you for continuity of the conversation
  • Send optional family resources, only where you have opted in

PLACEHOLDER — depending on your jurisdiction you may need to state lawful bases (GDPR/UK GDPR), sale/share disclosures (CCPA/CPRA), or state privacy law rights. Include a mechanism for access, deletion, and objection requests with a real contact address and a stated response window.

Who we share it with

We do not sell personal information. We share it only with service providers who help us operate the website and reply to inquiries, who are bound by contract to use it for that purpose alone.

Clinical information is shared with schools, other therapists, or payers only with your written authorization and only the minimum needed for that purpose.

How long we keep it

PLACEHOLDER — state real retention periods, for example: “Inquiries that do not become clients are deleted after 12 months; clinical records are retained for the period required by state law and payer rules.” Never publish a retention promise the team does not actually operate.

Cookies and analytics

This site currently sets no advertising or cross-site tracking cookies. PLACEHOLDER — if analytics are added, they must be configured with IP anonymization, a documented retention period, and a consent mechanism appropriate to your jurisdiction. Describe the exact tool you use here.

Functional storage, if any, is limited to the essentials required to keep the menu and preferences working.

How we protect it

The website is served over HTTPS. Access to submitted inquiries is limited to staff who need it. PLACEHOLDER — describe your real controls: where submissions land, who can read them, encryption in transit and at rest, and how deletions are carried out and verified.

Children’s information

This website is directed to adults. We ask that no child submits information about themselves; inquiries come from a parent or caregiver. We do not knowingly collect information directly from children through this site.

Questions about privacy

PLACEHOLDER — add a real privacy contact (email, and a postal address if required by law) and a stated response timeframe before launch.

Pre-launch review required. This is a structural template, not legal advice. Have it reviewed by qualified counsel and completed with the organization’s real practices, entity name, jurisdiction, and retention periods before launch.