Privacy Policy

Effective Date: April 1, 2026

Behavior Nation ("Behavior Nation," "we," "us," or "our") is an Applied Behavior Analysis (ABA) therapy provider committed to protecting the privacy of our clients, their families, and all visitors to our website. This Privacy Policy describes how we collect, use, disclose, and safeguard your information when you visit our website at behaviornation.com (the "Website"), use our services, or otherwise interact with us.

As a healthcare provider subject to the Health Insurance Portability and Accountability Act ("HIPAA") and applicable state privacy laws, we take the protection of your personal and health information seriously. By using our Website or engaging our services, you consent to the practices described in this Privacy Policy.

1. Definitions

For purposes of this Policy:

"Personal Information" means information that identifies a particular individual, including name, address, email address, phone number, date of birth, and IP address.
"Protected Health Information" or "PHI" means individually identifiable health information as defined under HIPAA (45 CFR § 160.103), including information about a client's health condition, the provision of healthcare services, and payment for those services.
"Sensitive Information" means information including race or ethnic origin, diagnosis or clinical information, insurance details, Social Security numbers, and communications between you and your clinical team.
"Client" means any individual receiving ABA therapy services from Behavior Nation, including minor children.
"Authorized Representative" means a parent, legal guardian, or other person legally authorized to act on behalf of a Client.

2. HIPAA Compliance

Behavior Nation is a covered entity under HIPAA. We are committed to full compliance with HIPAA and its implementing regulations, including the Privacy Rule, Security Rule, and Breach Notification Rule. This Policy supplements, but does not replace, our Notice of Privacy Practices, which describes in detail how your PHI may be used and disclosed in accordance with HIPAA and applicable state law.

Where there is a conflict between this Policy and our HIPAA Notice of Privacy Practices, the Notice of Privacy Practices will control with respect to PHI. You may request a copy of our Notice of Privacy Practices at any time by contacting us using the information provided below.

3. Information We Collect

a. Information You Provide Directly

Contact and intake information: Client name, parent/guardian name, address, email address, phone number, date of birth, and preferred language.
Clinical information: Diagnosis information, behavioral assessments, treatment plans, session notes, progress reports, and other clinical documentation related to ABA therapy services.
Insurance and billing information: Health insurance plan details, member/subscriber IDs, group numbers, authorization information, copayment amounts, and other billing-related data.
Referral information: Referring physician or provider information, referral documentation, and prescriptions for ABA services.
Employment inquiries: Resume, qualifications, certifications (e.g., BCBA, BCaBA, RBT), background check information, and professional references when you apply for a position.
Website inquiries: Name, email, phone number, and message content submitted through our contact forms, enrollment forms, or consultation request forms.

b. Information Collected Automatically

When you visit our Website, we may automatically collect:

Device and browser information (browser type, operating system, device type)
IP address and approximate geolocation
Pages visited, referring URLs, and time spent on pages
Cookies, session tokens, and similar tracking technologies
Anonymized analytics data to improve Website performance and user experience

c. Information from Third Parties

We may receive information from:

Referring physicians and healthcare providers
Insurance companies and payers
Schools and educational institutions (with appropriate consent or authorization)
Other healthcare providers involved in a Client's care

4. How We Use Your Information

Treatment: To provide, coordinate, and manage ABA therapy services, develop individualized treatment plans, conduct behavioral assessments, track progress, and communicate with your clinical team.
Payment: To bill for services, verify insurance coverage, process claims, obtain prior authorizations, and manage accounts.
Healthcare operations: To conduct quality improvement activities, train staff, conduct audits, and manage our practice.
Communication: To respond to inquiries, schedule appointments, send appointment reminders, and provide updates about our services.
Legal compliance: To comply with federal and state laws, including HIPAA, mandatory reporting requirements, and other regulatory obligations.
Website improvement: To analyze Website usage, improve content and functionality, and enhance user experience.
Employment: To evaluate job applications, conduct background checks, and manage the hiring process.
Marketing: To inform you about our services, events, and resources related to ABA therapy, with your consent where required by law. We will never use your PHI for marketing purposes without your written authorization.

5. Disclosure of Your Information

Behavior Nation does not sell your Personal Information or PHI. We may disclose your information in the following circumstances:

For treatment, payment, and healthcare operations: As permitted by HIPAA, we may share PHI with other healthcare providers involved in your care, insurance companies, and business associates who assist in our operations.
Business associates: We may share information with trusted third-party vendors who perform services on our behalf (e.g., electronic health records, billing platforms, IT services). All business associates are required to sign Business Associate Agreements (BAAs) and comply with HIPAA requirements.
With your authorization: We may disclose your PHI to third parties when you provide written authorization (e.g., sharing records with a school, another provider, or a family member).
As required by law: We may disclose information when required by federal, state, or local law, including mandatory child abuse reporting, court orders, and public health reporting.
For health and safety: We may disclose information to prevent or lessen a serious and imminent threat to the health or safety of a person or the public, as permitted by law.
Service providers: We may share Non-Personal Information with analytics providers, hosting services, and other technology partners to operate and improve our Website.
Business transfers: In the event of a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction, subject to applicable privacy obligations.

6. Your Rights Regarding Your Information

a. HIPAA Rights

Under HIPAA, you have the following rights with respect to your PHI:

Right to access: You may request a copy of your PHI maintained by Behavior Nation.
Right to amend: You may request that we amend your PHI if you believe it is inaccurate or incomplete.
Right to an accounting of disclosures: You may request a list of certain disclosures we have made of your PHI.
Right to request restrictions: You may request restrictions on how we use or disclose your PHI for treatment, payment, or healthcare operations.
Right to request confidential communications: You may request that we communicate with you in a specific way or at a specific location.
Right to a copy of the Notice of Privacy Practices: You may request a paper copy of our Notice of Privacy Practices at any time.
Right to file a complaint: You may file a complaint with Behavior Nation or with the U.S. Department of Health and Human Services if you believe your privacy rights have been violated. We will not retaliate against you for filing a complaint.

b. State Privacy Rights

If you are a California resident, you may have additional rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA), including:

The right to know what Personal Information we collect, use, and disclose about you
The right to request deletion of your Personal Information
The right to opt out of the sale or sharing of your Personal Information (Behavior Nation does not sell your Personal Information)
The right to non-discrimination for exercising your privacy rights
The right to correct inaccurate Personal Information

Certain health information regulated under HIPAA or the California Confidentiality of Medical Information Act (CMIA) may be exempt from CCPA/CPRA. Residents of other states with consumer privacy laws (Colorado, Connecticut, Virginia, etc.) may also have similar rights. To exercise any of these rights, please contact us using the information provided below.

7. Children's Privacy

Because ABA therapy frequently involves minor children, we take special care with children's information. We collect information about minor Clients only with the consent and involvement of their Authorized Representative (parent or legal guardian). All PHI related to minor Clients is protected under HIPAA and applicable state laws governing minors' health information.

Our Website is not directed at children under the age of 13, and we do not knowingly collect Personal Information from children under 13 through our Website. If you are a parent or guardian and believe your child has submitted Personal Information through our Website without your consent, please contact us so we can take appropriate action.

8. Cookies and Tracking Technologies

Our Website uses cookies and similar technologies to enhance your browsing experience and analyze Website traffic:

Essential cookies: Required for Website functionality (e.g., session management, security).
Analytics cookies: Help us understand how visitors interact with our Website. These collect aggregated, anonymized data.
Functional cookies: Remember your preferences and settings to improve your experience.

You can control cookies through your browser settings. Disabling certain cookies may limit your ability to use some features of our Website. We do not use cookies to collect PHI.

9. Data Security

We implement administrative, technical, and physical safeguards designed to protect your information in accordance with HIPAA Security Rule requirements and industry best practices:

Encryption of data in transit (TLS/SSL) and at rest
Access controls and role-based permissions for staff
Regular security assessments and risk analyses
Employee training on HIPAA privacy and security requirements
Business Associate Agreements with all third-party vendors who handle PHI
Secure disposal of records containing PHI

While we strive to protect your information, no method of electronic transmission or storage is 100% secure. If you have reason to believe that your information has been compromised, please contact us immediately.

10. Data Retention

We retain your information in accordance with applicable federal and state law, professional standards, and our internal retention policies:

Clinical records: Retained for a minimum of seven (7) years from the date of last service, or longer as required by state law. For minor Clients, records are retained for the applicable retention period or until the minor reaches the age of majority plus the applicable retention period, whichever is longer.
Billing records: Retained for a minimum of seven (7) years in accordance with federal and state requirements.
Website data: Non-Personal Information collected through the Website is retained for as long as necessary to fulfill the purposes described in this Policy.
Employment records: Retained in accordance with applicable employment laws and our internal policies.

11. Third-Party Links

Our Website may contain links to third-party websites, including insurance companies, professional organizations, and educational resources. We are not responsible for the privacy practices of these third parties. We encourage you to review the privacy policies of any third-party website you visit.

12. Telehealth and Remote Services

If we provide telehealth or remote ABA therapy services, additional privacy considerations may apply. We use HIPAA-compliant telehealth platforms and take appropriate measures to ensure the confidentiality of sessions conducted remotely. By participating in telehealth services, you acknowledge the inherent risks of electronic communication and consent to the use of approved telehealth platforms for service delivery.

13. Mandatory Reporting

As healthcare providers, our clinical staff are mandated reporters under applicable state law. We are required to report suspected child abuse, neglect, or exploitation to the appropriate authorities, regardless of any privacy obligations. Disclosures made for mandatory reporting purposes are permitted under HIPAA.

14. Changes to This Privacy Policy

We may update this Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will update the "Effective Date" at the top of this page. Your continued use of our Website or services after any changes constitutes your acceptance of the updated Policy. We encourage you to review this Policy periodically.

15. Contact Us

If you have any questions about this Privacy Policy, wish to exercise your privacy rights, or would like to request a copy of our HIPAA Notice of Privacy Practices, please contact us:

Behavior Nation

Attn: Privacy Officer

PO BOX 745
Diablo, CA 94528

Phone: 1-844-262-8466

Email: privacy@behaviornation.com

You may also file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights if you believe your privacy rights under HIPAA have been violated:

U.S. Department of Health and Human Services

Office for Civil Rights

Website: hhs.gov/ocr/complaints

Phone: 1-800-368-1019

16. Users Outside the United States

Behavior Nation is based in the United States and provides ABA therapy services within the United States. If you access our Website from outside the United States, you understand that your information may be transferred to and processed in the United States, and you consent to such transfer and processing.