Privacy Policy

RCR provides various services to clients in order to manage and care for individuals who suffer from behavioral illnesses, chemical dependencies or addiction disorders. Among other services, we offer partial hospitalization programs, and intensive outpatient programs (hereinafter collectively referred to as the “Services”).

RCR cares about your personal integrity. Therefore, this Privacy Policy is provided to equip you with information on how RCR processes the personal data that you share with us when using contact forms on our website.

As noted above, our Privacy Policy is designed to advise you about how we collect, use, protect, and disclose the information that we collect and/or receive about you. It also explains your privacy rights, and how you can manage the privacy of your Personal Information. Please note that this Privacy Policy does not govern the practices of third parties, including our partners, third party service providers, and/or advertisers, even when those services are branded as, or provided on behalf of, RCR. Information collected from you by others, such as third party websites that you access through links on the Website, are governed by those entities’ privacy policies.

I. Definitions

• Personal Information (also known as “Personal Data”): Personal Information means data about a particular individual or household that identifies, relates to, describes, could be reasonably linked with, or could be used to identify that person or household (or from those and other information either in our possession or likely to come into our possession). Personal Information includes medical and clinical information (Protected Health Information or PHI). It also includes other information that may be associated with your Personal Information, such as your Usage Data (defined below), location, preferences or interests, if that information can be used to identify you or your household.
• Services: As noted above, our Services include the website owned and operated by RCR as well as any services provided, including, but not limited to,(insert RCR services).
• Cookies: Cookies are small files stored on your device as more particularly described below (computer or mobile device).
• Data Controller: The natural or legal person who (either alone or jointly or in common with other persons) determines the purposes for which and the manner in which any personal information are, or are to be, processed. For the purpose of this Privacy Policy, we are a Data Controller of your Personal Information.
• Data Processors: Any natural person or legal entity who processes the data on behalf of the Data Controller. We may use the services of various Service Providers in order to process your data more effectively.
• User: Any individual who uses our Services and is the subject of Personal Information collected and/or processed.

II. Information Collection and Use

We use your information to provide the Services that you request, and to improve the Services we offer to you. By using our Services, you agree to the collection and use of information in accordance with this Privacy Policy.

Included below is a list of several different types of information for various purposes to provide and improve our Service to you.

• Personal Information. While using our Services, we may ask you to provide us with or otherwise obtain certain personally identifiable information that can be used to contact or identify you (“Personal Information,” as defined above). Such Personal Information may include, but is not limited to, your name, address, email address, username, and any other information that may identify you.
• Generic Information. Generic information is information that does not directly reveal the identity of a RCR customer, or visitor to the Website. This information may include Usage Data and other aggregate usage metrics such as total number of Website visitors, pages viewed, and usage patterns within the Website, etc. This may also include information about your device. We may automatically gather some Generic Information from our customers, and Website visitors. At times, the combination of various types of data, including Generic information and Usage Data, may enable you to be identified, and may therefore qualify as Personal Information.
• Usage Data: We may also collect information on how you access and use our Services (“Usage Data”). This Usage Data may include information such as your computer’s Internet Protocol address (e.g. IP address), browser type, browser version, the pages of our Services that you visit, the time and date of your visit, the time spent on those pages, unique device identifiers and other diagnostic data.
• Tracking & Cookies Data. We use cookies and similar tracking technologies to track the activity on our Website, and we hold certain information.

Cookies are files with a small amount of data which may include an anonymous unique identifier. Cookies are sent to your browser from a website and stored on your device. Other tracking technologies are also used such as beacons, tags and scripts to collect and track information and to improve and analyze our Services.

Examples of Cookies and other technologies we may use include, but are not limited to:

• Session Cookies – These are cookies that enable our website to keep track of movement from page to page so you do not get asked for information that you have already provided to the Website.
• First Party Cookies – This allows RCR to remember website configurations about out users (e.g. language preferences).
• Third Party Cookies – RCR permits third-party service providers, advertisers and other companies to use cookies or other similar technologies on our Website. These companies may collect your information, track your behavior on our Website, and gather information about your use of our Websites or Services and other online services over time and across different services. Additionally, some companies may use information collected to deliver targeted ads on behalf of us or other companies, including on other websites or online services. We are not responsible for the functioning of cookies and other technologies used and placed by third parties on your device.

Your Cookie Choices

You may set your browser to block or otherwise control what cookies your browser or mobile device accepts via your browser or mobile device settings. Additionally, you can choose to modify your settings and delete those cookies that are otherwise stored on your device. Please consult the instructions provided by your browser or your mobile device’s manufacturer to determine how you can limit the placement of and/or remove cookies or other technologies. Please note, however, that limiting or disabling the use of cookies and other technologies may impact or adversely affect your ability to perform certain transactions on, use certain functionalities of, and access certain content on our Website.

III. How We Collect Information

RCR collects and obtains your information in a few ways: there is information that you choose to give to us, information we obtain through your use of our Services – including our Website – and information we obtain from third parties.

a. Information You Give Us

We collect information that you decide to share with us. At times, we may require you to provide certain information – including Personal Information – in order to use certain parts of our Website, fulfill your requests with us, or provide you with certain Services. For instance, we may require you to provide your name, email address or other contact information when you contact us with a question or comment. Additionally, we may need you to provide certain Personal Information to use other portions of our Services.

b. Information We Obtain When You Use Our Services

As noted above, we collect certain information from you through your use of our Services, such as Usage Data. For instance, in using our Website, we may collect information about the device you use to log into, access, and use the Website. We may collect other Generic Information in relation to how you use our Website or other Services (for example, aggregate metrics on how often certain pages on our Website are accessed and viewed).
We also may collect information through the use of cookie, pixel tags, or other technologies, as described above.

c. Information We Obtain from Third Parties

We may also obtain information about you from our third party service providers who help us provide our Services to you.

IV. Purposes for Collecting, Processing, and Using Your Information

RCR collects, processes (or asks our service providers to process on our behalf), and uses your information to provide the Services we make available to you. We therefore will collect and use your information for a variety of reasons, including:

• To perform a contract with you, or provide those Services you have requested of RCR.
• You have otherwise given us your consent and permission to do so.
• The collection and processing is in our legitimate interests or the legitimate interests of a third party, and is not outweighed by any applicable rights you may have. For instance, we may use your information to assist with fraud prevention, improve the security of our networks, assist with enhancing the physical security of our customers, and reporting suspected criminal activity to law enforcement. We may also use your information in relation to certain direct marketing events.
• To comply with applicable laws, in response to a lawful and enforceable request by a law enforcement, judicial, or other public authority, or in connection with an applicable legal obligation.

V. How We Use Your Information

As noted elsewhere in this Privacy Policy, RCR uses your information to provide our Services to you.
Such general uses include, but are not limited to:

• Enhancing user experience and functionality on our Website;
• To provide and maintain our Services as useful or otherwise necessary, so long as such use is permitted by law or for any other purpose with your consent;
• To notify you about a change to our Services and to otherwise communicate with you;
• To provide appropriate information to ensure the health and wellness of our clients;

VI. How We Disclose or Share Your Information

RCR does not and will not sell your personal information. Please note that RCR may disclose your information in a number of ways in furtherance of our Services to you. For instance, we may share your information with other healthcare providers to ensure that all necessary information is transferred to facilitate necessary treatment and care.

We may also disclose or share your information for the following purposes:

• To comply with a legal obligation;
• To prevent or investigate wrongdoing or mistakes in connection with our Services;
• To protect against legal liability;
• When there is a good faith belief that such action is necessary to investigate or protect against harmful activities to our guests, visitors, associates, or property, or to others (including RCR itself). This may include disclosures to law enforcement to investigate potential criminal activity or other civil violations.

VII. Security of Data

RCR takes reasonable, technical, organization, and other measures to protect the personal information we collect from being subject to accidental or unlawful destruction, accidental loss or alteration, disclosure without authorization, and any other unlawful actions taken against otherwise protected information. Moreover, RCR takes all judicious legal, technical, and organizational measures reasonably necessary to ensure that all personal information is handled with a sufficient level of security. Furthermore, RCR takes all reasonable measures to protect personal information when it is shared with third parties.

Despite the security measures taken, RCR cannot guarantee the security of our online services, nor can we guarantee the security of any personal information you transmit to us over the Internet, including your use of email.  We are not liable for the illegal acts of third parties such as criminal hackers.

It is your responsibility to safeguard the devices you use to access our online services (such as laptops, tablets and mobile devices), and to use appropriate security settings on those devices. If those devices are lost, stolen or misplaced, others may be able to access your account and your personal Information using those devices. You should affirmatively log out of your account (i) prior to ending your session, or (ii) if you will be inactive on the online services for more than a few minutes; otherwise, the next user of that computer or device, particularly a public one or one not owned by you, may be able to access your account and the Information in your account if your session has not ended.

You agree that we are not responsible for any harm that may result from someone accessing your account or personal Information on any computer or device where you do not, for any reason, take the necessary steps to log out of your account prior to ending a session on such device or computer.

We retain your personally identifiable and  \Information for as long as necessary for the purpose for which it is collected, subject to a longer period if the Information is relevant to a legal challenge.

VIII. Additional Rights for California Residents.

California law permits our customers who are California residents to request certain information regarding the disclosure of certain personal information to third parties for their direct marketing purposes.

If we have disclosed any personal information to third parties for direct marketing purposes, we will provide a list of the categories of personal information, along with the names and addresses of these third parties to you at your request. To make such a request, write us at the postal or email address found in the Contact Us section of this Policy.

This request may be made no more than once per calendar year. We reserve our right not to respond to requests submitted other than to the specified email or postal address. You should put “California Privacy Rights-Direct Marketing” in the email subject line and in the body of your request. You must provide us with specific information regarding yourself so that we can accurately respond to the request.

California Minors Under 18

If you are a California resident under the age of 18 and are a registered user of our online services, you may request that we remove from our online services any content you post to our online Services that can be accessed by any other user (whether registered or not). Please note that any content that is removed from visibility on our online services may still remain on our servers and in our systems. To request removal of content under this provision, please write or email us at the postal or email address found in the Contact Information section of this Policy. When you write to us, please provide us with a description of the content and the location of the content on our online services, along with any other information that we may require to consider your request. Please note that removal of content under this provision does not ensure complete or comprehensive removal of the content or information posted on the online services by you.

IX. HIPAA Compliance

This section describes how medical and clinical information (Protected Health Information or PHI) about you may be used and disclosed and how you can get access to this information. Please review it carefully.

Your Rights

When it comes to your health information, you have certain rights. This section explains your rights and some of our responsibilities to help you.

1. Get an electronic or paper copy of your medical record

• You can ask to see or get an electronic or paper copy of your medical record and other health information we have about you. Ask us how to do this.
• We will provide a copy or a summary of your health information, usually within 30 days of your request. We may charge a reasonable, cost-based fee.

2. Ask us to correct your medical record

You can ask us to correct health information about you that you think is incorrect or incomplete. Ask us how to do this. We may say “no” to your request, but we’ll tell you why in writing within 60 days. Your request can be denied for the following reasons:

• If we did not create the PHI in question
• If the amendment would not be part of normal record keeping of PHI for us
• If the amendment would never be included for inspection by any other group or party
• If we believe the record is accurate and complete without the amendment
• Please note: If denied access to information you can appeal the denial

3. Request confidential communications

You can ask us to contact you in a specific way (for example, home or office phone) or to send mail to a different address. We will say “yes” to all reasonable requests.

4. Ask us to limit what we use or share

• You can ask us not to use or share certain health information for treatment, payment, or our operations. We are not required to agree to your request, and we may say “no” if it would affect your care.
• If you pay for a service or health care item out-of-pocket in full, you can ask us not to share that information for the purpose of payment or our operations with your health insurer. We will say “yes” unless a law requires us to share that information.

5. You have the right to receive confidential communications based on a reasonable requests by individuals to receive communications of PHI, from us, by alternative means

• We have an option to request the above details in writing.
• We have the option to condition the agreement for above communications with assurance that payment of special fees required will be handled.
• We have the option to condition the agreement for above communications that the alternative is specified and reasonable.
• We may NOT require an explanation for the request from you as a condition of agreeing to follow it.

6. Get a list of those with whom we’ve shared information

• You can ask for a list (accounting) of the times we’ve shared your health information for six years prior to the date you ask, who we shared it with, and why.
• We will include all the disclosures except for those about treatment, payment, and health care operations, and certain other disclosures (such as any you asked us to make). We’ll provide one accounting a year but may charge for additional requests.

7. Get a copy of this privacy notice

• You can ask for a paper copy of this notice at any time and we will provide you with a paper copy promptly.

8. Choose someone to act for you

• If you have given someone medical power of attorney or if someone is your legal guardian, that person can exercise your rights and make choices about your health information.
• We will make sure the person has this authority and can act for you before we take any action.

9. File a complaint if you feel your rights are violated

• You can complain if you feel we have violated your rights by contacting us using the contact information found at the very end of this document.
• You can file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights by sending a letter to 200 Independence Avenue, S.W., Washington, D.C. 20201, calling 1-877-696-6775, or visiting www.hhs.gov/ocr/privacy/hipaa/complaints/.
• We will not retaliate against you for filing a complaint.

Your Choices

For certain health information, you can tell us your choices about what we share. If you have a clear preference for how we share your information in the situations described below, talk to us. Tell us what you want us to do, and we will follow your instructions. In these cases, you have both the right and choice to tell us to:

• Share information with your family, close friends, or others involved in your care
• Share information in a disaster relief situation

If you are not able to tell us your preference we may go ahead and share your information if we believe it is in your best interest. We may also share your information when needed to lessen a serious and imminent threat to health or safety.

In the following cases, we never share your information unless you give us written permission:

• Marketing purposes
• Sale of your information
• Most sharing of therapy notes

Our Uses and Disclosures

How do we typically use or share your health information?

We typically use or share your health information in the following ways.

• Treat you

We can use your health information and share it with other professionals who are treating you.

• Run our facility

We can use and share your health information to run our facility, improve your care, and contact you when necessary.

• Bill for your services

We can use and share your health information to bill and get payment from health plans or other entities.

How else can we use or share your health information?

We are allowed or required to share your information in other ways – usually in ways that contribute to the public good, such as public health. We have to meet many conditions in the law before we can share your information for these purposes.

We can share health information about you for certain situations such as:

Help with public health and safety issues

• Preventing disease
• Helping with product recalls
• Reporting adverse reactions to medications
  Reporting suspected abuse, neglect, or domestic violence
• Preventing or reducing a serious threat to anyone’s health or safety

Comply with the law

• We will share information about you if state or federal laws require it, including with the Department of Health and Human Services if it wants to see that we’re complying with federal privacy law.

Work with a medical examiner or funeral director

• We can share health information with a coroner, medical examiner, or funeral director when an individual dies.

Address workers’ compensation, law enforcement, and other government requests

• For workers’ compensation claims
• For law enforcement purposes or with a law enforcement official
• With health oversight agencies for activities authorized by law
• For special government functions such as military, national security, and presidential protective services

Respond to lawsuits and legal actions

• We can share health information about you in response to a court or administrative order, or in response to a subpoena.

Our Responsibilities

• We are required by law to maintain the privacy and security of your protected health information.
• We will let you know promptly if a breach occurs that may have compromised the privacy or security of your information.
• We must follow the duties and privacy practices described in this notice and give you a copy of it.
• We will not use or share your information other than as described here unless you tell us we can in writing. If you tell us we can, you may change your mind at any time. Let us know in writing if you change your mind.

For more information see: https://www.hhs.gov/hipaa/for-individuals/notice-privacy-practices/index.html.

X. Links to Other Sites

Our Privacy Policy is designed to advise you about how we collect, use, protect, and disclose the information that we collect and/or receive about you. However, our website may also contain links that lead to websites neither owned nor operated by us. As such, this Privacy Policy does not govern the practices of third parties, including partners, third-party service providers, and/or advertisers, even when those services are provided on our behalf or in partnership with us. Information gathered about you by others is governed by those distinct entities’ privacy policies. Therefore, we strongly recommend that you review the privacy policy of every website you visit.

We exercise no control over and assume no responsibility for the content, privacy policies or practices of any third party site or services.

XI. Social Security Number Protection Policy

It is our policy to protect the confidentiality of Social Security numbers (“SSNs”) that we receive or collect in the course of business. We secure the confidentiality of SSNs through various means, including physical, technical, and administrative safeguards that are designed to protect against unauthorized access. It is our policy to limit access to SSNs to that which is lawful and to prohibit unlawful disclosure of SSNs.

XII. Children Under 13We will not intentionally collect any personal information (as that term is defined in the Children’s Online Privacy Protection Act) from children under the age of 13 through our online services without receiving parental consent. If you think that we have collected such personal information from a child under the age of 13 through our online services, please contact us immediately.

XIII. Changes to Our Privacy Policy

We reserve the right to amend this privacy notice at our discretion and at any time.

XIV. Contact Information

(Insert)

XV.  Effective Date

(insert)