Introduction

Compassion Recovery Centers ("CRC," "we," "us," or "our") is committed to protecting your privacy and maintaining the confidentiality of your personal and medical information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website, use our services, or interact with our digital content and advertisements.

Your health record contains personal information about you and your health. State and federal law protects the confidentiality of this information. "Protected health information" (PHI) is information about you, including demographic information, that may identify you and that relates to your past, present, or future physical or mental health condition and related health care services.

Special Protection for Substance Use Disorder Records: The confidentiality of alcohol and drug abuse patient records is specifically protected by Federal law (42 CFR Part 2) and regulations. Compassion Recovery Centers is required to comply with these additional restrictions. This includes a prohibition, with very few exceptions, on informing anyone outside the program that you attend the program or disclosing any information that identifies you as an alcohol or drug abuser. The violation of Federal laws or regulations by this program is a crime. If you suspect a violation you may file a report to the appropriate authorities in accordance with Federal regulations.

This policy applies to all visitors, users, and others who access or use our services, whether you are a prospective patient, current patient, family member, or general website visitor.

Information We Collect

Personal Information You Provide

We may collect the following information when you voluntarily provide it:

• Contact Information: Name, email address, phone number, mailing address
• Demographic Information: Age, date of birth, gender, location
• Medical and Treatment Information: Health history, treatment needs, substance use history, mental health information
• Insurance Information: Insurance provider details, policy numbers for verification and billing purposes
• Emergency Contact Information: Names and contact details of emergency contacts or family members
• Communication Preferences: How you prefer to be contacted and what information you want to receive
• Inquiry Details: Information about your treatment needs, questions, or concerns
• Feedback: Reviews, testimonials, survey responses, or satisfaction ratings

Information Collected Automatically

When you visit our website or interact with our online content, we may automatically collect:

• Device Information: IP address, browser type, operating system, device identifiers
• Usage Data: Pages visited, time spent on pages, click-through rates, referring websites
• Location Data: General geographic location based on IP address (not precise geolocation)
• Cookies and Tracking Technologies: As described in our Cookie Policy below

Information from Third Parties

We may receive information from:

• Healthcare Providers: Referring physicians, therapists, or other treatment facilities
• Insurance Providers: For coverage verification, prior authorization, and billing purposes
• Social Media Platforms: When you interact with our ads or content on platforms like Facebook and Instagram (aggregated data only, not PHI)
• Family Members or Emergency Contacts: Information provided with appropriate consent
• State Agencies: Referral information from courts or social services (when legally required)

How We Use Your Information

Treatment and Care Coordination

Your PHI may be used and disclosed by your physician, counselor, program staff and others outside of our program that are involved in your care for the purpose of:

• Providing, coordinating, or managing your health care treatment and related services
• Consultation with other health care providers
• Referral to another provider for health care treatment
• Coordination with state agencies that referred you to our program
• Following up on treatment progress and outcomes
• Maintaining comprehensive medical records and treatment plans
• Ensuring continuity of care during and after treatment

Payment and Billing

We will not use your PHI to obtain payment for your health care services without your written authorization. With your authorization, payment-related activities may include:

• Making determinations of eligibility or coverage for insurance benefits
• Processing claims with your insurance company
• Reviewing services provided to determine medical necessity
• Undertaking utilization review activities
• Billing for services rendered

Healthcare Operations

We may use or disclose your PHI as needed to support the business activities of our program including:

• Quality assessment and improvement activities
• Employee review and training activities
• Training of medical students, interns, or residents
• Licensing and accreditation processes
• Business planning and development
• Customer service and appointment reminders
• General administrative activities

We may use a sign-in sheet at the registration desk where you will be asked to sign your name and indicate your physician or counselor. We may also call you by name in the waiting room when it is time to be seen.

Communication and Support

• Respond to inquiries and provide customer support
• Send appointment reminders and treatment updates
• Provide educational resources about addiction and recovery
• Communicate about our services and programs
• Provide information about treatment alternatives or other health-related benefits and services that may be of interest to you

Marketing and Outreach

• Display advertisements on social media platforms (Facebook, Instagram) using aggregated, non-identifying data only
• Send newsletters and promotional materials about our services (with consent)
• Improve our marketing campaigns and measure effectiveness
• Conduct market research to better serve individuals seeking treatment

Important: We do NOT use or share Protected Health Information (PHI) for marketing or advertising purposes.

Legal and Operational Purposes

• Comply with legal obligations and regulatory requirements
• Protect our rights and prevent fraud or abuse
• Improve our website functionality and user experience
• Maintain security and prevent unauthorized access
• Respond to legal proceedings and government requests

Disclosures Without Your Authorization

Applicable law permits us to disclose information about you without your authorization in limited situations, including:

Required by Law

We may use or disclose your PHI to the extent required by law, made in compliance with the law, and limited to the relevant requirements of the law. You will be notified, as required by law, of any such uses or disclosures. Under the law, we must make disclosures of your PHI to you upon your request and to the Secretary of the Department of Health and Human Services for investigating or determining our compliance with the Privacy Rule.

Health Oversight Activities

We may disclose PHI to a health oversight agency for activities authorized by law, such as audits, investigations, inspections, and licensure. Oversight agencies seeking this information include government agencies and organizations that provide financial assistance to the program.

Medical Emergencies

We may use or disclose your protected health information in a medical emergency situation to medical personnel only. Our staff will try to provide you a copy of this notice as soon as reasonably practicable after the resolution of the emergency.

Child Abuse or Neglect

We may disclose your PHI to a state or local agency that is authorized by law to receive reports of child abuse or neglect. However, the information we disclose is limited to only that information which is necessary to make the initial mandated report.

Threat to Health or Safety

We may disclose your information if we believe it is necessary to prevent or lessen a serious and imminent threat to the health or safety of a person or the public.

Court Orders and Legal Proceedings

We may disclose your PHI if the court issues an appropriate order and follows required procedures. We may also respond to subpoenas, discovery requests, or other lawful processes with proper authorization.

Criminal Activity on Program Premises

We may disclose your PHI to law enforcement officials if you have committed a crime on program premises or against program personnel.

Deceased Patients

We may disclose PHI regarding deceased patients for the purpose of determining the cause of death, in connection with laws requiring the collection of death or other vital statistics, or permitting inquiry into the cause of death.

Research

We may disclose PHI to researchers if: (a) an Institutional Review Board reviews and approves the research and waiver to the authorization requirement; (b) the researchers establish protocols to ensure the privacy of your PHI; (c) the researchers agree to maintain the security of your PHI in accordance with applicable laws and regulations; and (d) the researchers agree not to redisclose your PHI except back to Compassion Recovery Centers.

Social Media and Digital Advertising Compliance

How We Advertise Our Services

We advertise our addiction treatment services on social media platforms including Meta (Facebook and Instagram). When you interact with our advertisements or website:

• No PHI in Advertisements: Our ads contain only general information about addiction treatment services
• Aggregated Targeting: We may target ads based on general demographics, interests, or geographic areas (not based on your medical information)
• Privacy-Safe Tracking: Any tracking pixels or cookies on our website are configured to exclude sensitive health data
• Opt-Out Options: You can opt out of targeted advertising through your social media ad preferences settings

Data We Share with Advertising Platforms

We may share only the following non-PHI information with advertising platforms:

• General website visit information (that you visited our site, but not what you viewed)
• De-identified demographic information (age range, general location)
• Aggregated user behavior patterns (not linked to individuals)

We DO NOT share:

• Your substance use or addiction history
• Your treatment status or participation in our programs
• Your medical or mental health information
• Your specific inquiries or communications with us
• Any other Protected Health Information

Information Sharing and Disclosure

Healthcare Providers and Insurance

With appropriate authorization, we may share your information with:

• Licensed healthcare professionals involved in your care
• Insurance companies for coverage verification and billing
• Laboratory services and medical testing facilities
• Other treatment facilities for continuity of care
• Referring physicians or therapists
• Specialists consulted for your treatment

Service Providers and Business Associates

We work with trusted third-party service providers who assist with:

• Website hosting and technical support
• Payment processing and billing services
• Electronic health record systems
• Marketing and advertising services (non-PHI only)
• Customer relationship management
• Data analytics and quality improvement

We share your PHI with these service providers only when we have a written Business Associate Agreement that requires them to safeguard your privacy and prohibits them from re-disclosing your PHI.

Business Transfers

In the event of a merger, acquisition, or sale of assets, your information may be transferred to the new entity, subject to the same privacy protections outlined in this policy and applicable law.

Your Privacy Rights

Right to Inspect and Copy Your PHI

You have the right, which may be restricted in certain circumstances, to inspect and copy PHI that may be used to make decisions about your care. Your request must be in writing. We typically provide copies within 30 days. We may charge a reasonable, cost-based fee for copies. We can deny you access to your PHI in certain circumstances, and in some of those cases, you will have a right to appeal the denial.

Right to Amend Your PHI

If you feel that the PHI we have about you is incorrect or incomplete, you may ask us to amend the information. Your request must be in writing and must include a reason that supports the request. We are not required to agree to the amendment, but if we deny your request, you have the right to file a statement of disagreement with us, and we may prepare a rebuttal to your statement.

Right to an Accounting of Disclosures

You have the right to request an accounting of certain disclosures we make of your PHI. This accounting will not include disclosures made to you, made for treatment purposes, made as a result of your authorization, or certain other disclosures. You may request an accounting of disclosures for a period of up to six years. We may charge a reasonable fee if you request more than one accounting in any 12-month period.

Right to Request Restrictions

You have the right to request a restriction or limitation on the use of your PHI for treatment, payment, or health care operations. You also have the right to request a limit on the PHI we disclose about you to someone who is involved in your care or the payment for your care, like a family member or friend. We are not required to agree to your request unless you are asking us to restrict disclosures to a health plan for payment or health care operations purposes and the information pertains solely to services for which you have paid out-of-pocket in full.

Right to Request Confidential Communications

You have the right to request that we communicate with you about medical matters in a certain way or at a certain location. For example, you can ask that we only contact you at work or by mail. We will accommodate all reasonable requests. Your request must specify how or where you wish to be contacted.

Right to a Copy of This Notice

You have a right to receive a paper copy of this notice at any time, even if you have agreed to receive the notice electronically. You may obtain a copy of this notice at our website or by requesting one from our Privacy Officer.

Right to Opt Out of Marketing Communications

You have the right to:

• Opt out of marketing emails by clicking unsubscribe links
• Update your communication preferences by contacting us
• Limit targeted advertising through social media platform settings
• Request removal from our marketing lists

California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have additional rights including:

• Right to Know: What personal information is collected and how it's used
• Right to Delete: Request deletion of personal information (with certain exceptions)
• Right to Opt Out: Of the sale or sharing of personal information
• Right to Non-Discrimination: For exercising your privacy rights

Do Not Sell or Share My Personal Information

Note: We do not sell personal information. However, some data sharing with advertising platforms may be considered a "sale" under CCPA. You can opt out using the link above.

Uses and Disclosures Requiring Your Written Authorization

Other uses and disclosures of your PHI will be made only with your written authorization, including:

• Marketing Communications: Using PHI to contact you about products or services (we primarily use non-PHI for marketing)
• Sale of PHI: We do not sell PHI
• Psychotherapy Notes: Most uses and disclosures of psychotherapy notes
• Other Purposes: Uses and disclosures not described in this notice

You may revoke any authorization at any time by submitting a written revocation to our Privacy Officer, except to the extent that we have already taken action in reliance on the authorization.

Data Security and Protection

We are committed to protecting your information through comprehensive security measures:

Technical Safeguards

• Encryption: Data encrypted in transit (SSL/TLS) and at rest
• Access Controls: Role-based access limiting who can view your information
• Secure Systems: HIPAA-compliant electronic health record systems
• Firewalls and Security Software: Protection against unauthorized access
• Regular Security Audits: Vulnerability assessments and penetration testing

Physical Safeguards

• Secure facilities with controlled access
• Locked medical record storage
• Visitor sign-in and identification procedures
• Secure disposal of physical records

Administrative Safeguards

• Staff Training: Regular privacy and security training for all employees
• Confidentiality Agreements: All staff sign confidentiality agreements
• Incident Response: Procedures for responding to potential data breaches
• Business Associate Agreements: Contracts with all vendors handling PHI

Data Retention

We retain your information for as long as necessary to:

• Provide ongoing treatment and care coordination
• Comply with legal and regulatory requirements
• Fulfill the purposes outlined in this policy
• Resolve disputes and enforce agreements

Medical records are retained according to state and federal requirements, typically 7-10 years after treatment completion or until the patient reaches age 25 (whichever is longer for minors).

Cookies and Tracking Technologies

Our website uses cookies and similar technologies to improve your experience:

Types of Cookies We Use

• Essential Cookies: Required for website functionality (login, navigation)
• Analytics Cookies: Help us understand how visitors use our site (Google Analytics)
• Marketing Cookies: Deliver relevant advertisements on social media platforms
• Preference Cookies: Remember your settings and preferences

Important: Our cookies and tracking technologies are configured to NOT collect or transmit Protected Health Information (PHI).

Managing Cookies

You can control cookies through:

• Your browser settings (disable, delete, or block cookies)
• Our cookie consent banner when you first visit the site
• Opt-out tools provided by advertising networks
• Privacy tools and browser extensions

Note: Disabling certain cookies may limit website functionality.

Special Protections for Minors

Children Under 13 (COPPA Compliance)

Our website's general content is not intended for children under 13. We do not knowingly collect personal information from children under 13 without parental consent. If we become aware that we have collected such information, we will take steps to delete it promptly.

Minors Aged 13-17

For minors seeking treatment:

• We require parental/guardian consent before providing treatment services
• Parents/guardians are involved in treatment decisions as appropriate
• Some states grant minors the right to consent to substance abuse treatment without parental consent
• We comply with state-specific laws regarding minor privacy rights

International Data Transfers

If you are located outside the United States, please note that:

• Your information may be transferred to and processed in the United States
• U.S. privacy laws may differ from those in your country
• We ensure appropriate safeguards are in place for international transfers
• By using our services, you consent to the transfer of information to the U.S.

Breach Notification

In the event of a breach of unsecured protected health information, we will notify affected individuals as required by law. Notification will include:

• A description of what happened
• The types of information involved
• Steps you should take to protect yourself
• What we are doing to investigate and prevent future breaches
• Contact information for further questions

Changes to This Privacy Policy

We reserve the right to change the terms of this Notice of Privacy Practices at any time. Any new Notice of Privacy Practices will be effective for all PHI that we maintain at that time. When we make material changes:

• We will post the updated policy on our website with a new effective date
• We will notify you via email or website notice for significant changes
• We will provide you with a copy at your next appointment
• Previous versions will be available upon request

You may obtain a copy of the current Notice of Privacy Practices at: www.compassionrecoverycenters.com/privacy

Contact Information

Privacy Questions and Requests

For questions about this Privacy Policy or to exercise your privacy rights, please contact our Privacy Officer:

Complaints and Concerns

If you believe your privacy rights have been violated, you have the right to file a complaint:

With Us

Submit a written complaint to our Privacy Officer at the address above. We will not retaliate against you for filing a complaint.

With the Government

42 CFR Part 2 Violations

For violations of Federal substance use disorder confidentiality regulations:

Legal Framework and Compliance

This Privacy Policy is designed to comply with:

• HIPAA: Health Insurance Portability and Accountability Act
• 42 CFR Part 2: Confidentiality of Substance Use Disorder Patient Records
• HITECH Act: Health Information Technology for Economic and Clinical Health Act
• State Privacy Laws: Including California CCPA/CPRA and other state-specific requirements
• COPPA: Children's Online Privacy Protection Act
• FTC Act: Federal Trade Commission Act regarding unfair or deceptive practices

Acknowledgment
By using our services or website, you acknowledge that you have read and understood this Privacy Policy.
If you have questions or concerns, please contact us before providing any personal information.

© 2025 Compassion Recovery Centers. All rights reserved.