Privacy Policy & Terms of Service

Full Policy 

Every Child Matters ABA LLC ("ECM," "we," "our," or "us") is committed to protecting the privacy, confidentiality, security, and dignity of clients, parents and guardians, caregivers, employees, applicants, referral sources, community partners, and website visitors.

Because ECM provides Applied Behavior Analysis (ABA) and related behavioral health services, communications may involve personal, employment, healthcare, behavioral, family, insurance, and other sensitive information.

This Privacy Policy explains how ECM may collect, use, maintain, disclose, and protect information obtained through our website, online forms, telephone calls, SMS/text messages, email, company-managed telephone numbers, CallTrackingMetrics ("CTM") or another ECM-approved communication system, and other authorized electronic channels.

This Privacy Policy supplements, and does not replace, ECM's HIPAA Notice of Privacy Practices, client consent forms, clinical documentation policies, employment policies, or other privacy notices that may apply to a specific relationship or service.

Information We May Collect

Depending on your relationship with ECM and how you interact with us, we may collect:

• Name

• Telephone number

• Mobile telephone number

• Email address

• Mailing address

• Communication preferences

• Client demographic information

• Parent, guardian, or caregiver information

• Referral and intake information

• Scheduling information

• Insurance and authorization information

• Service coordination information

• Employment and applicant information

• Human resources and training information

• Call and text-message history

• Voicemail

• Date and time of communications

• Call duration

• Sender and recipient information

• Message delivery status

• Communication routing information

• Website and device information such as IP address, browser type, device type, pages visited, and access times

• Other information voluntarily provided to ECM

Protected Health Information and HIPAA

Some information collected or maintained in connection with ABA services may constitute Protected Health Information ("PHI") under the Health Insurance Portability and Accountability Act ("HIPAA") or other applicable law.

When HIPAA applies, ECM handles PHI in accordance with its HIPAA policies and Notice of Privacy Practices.

This website Privacy Policy does not replace ECM's HIPAA Notice of Privacy Practices.

ECM personnel are expected to limit the use or disclosure of PHI to the amount reasonably necessary for the permitted purpose, except where a different standard applies under law.

Highly sensitive clinical information should be communicated through the appropriate secure clinical or administrative system whenever practicable.

How We Use Information

ECM may use information to:

• Respond to inquiries and requests for information

• Coordinate referrals, intake, scheduling, and ABA services

• Communicate with clients, parents, guardians, caregivers, employees, applicants, and authorized business partners

• Provide appointment reminders and scheduling updates

• Provide administrative and operational notifications

• Support employment and human resources communications

• Maintain business and communication records

• Support billing, insurance, authorization, and payer requirements

• Investigate complaints or communication disputes

• Conduct quality assurance and compliance activities

• Protect the safety of clients, families, employees, and ECM systems

• Meet legal, regulatory, contractual, payer, or accreditation obligations

• Improve website functionality and communication workflows

ECM-Approved Telephone and Messaging Systems

ECM may provide employees with company-managed telephone numbers, messaging accounts, or other communication tools through CTM or another approved vendor.

These systems are intended to create a consistent, professional, documented, and controlled method of communication between ECM personnel and clients, families, caregivers, referral sources, and other authorized individuals.

Where ECM provides an official communication method, employees may be required to use that method for work-related communications rather than personal telephone numbers, personal messaging applications, or personal accounts.

SMS/Text Messaging

Individuals who provide a mobile telephone number may receive SMS/text messages from ECM when appropriate and when consent is obtained or another lawful basis applies.

Messages may include:

• Appointment reminders

• Scheduling information

• Appointment changes

• Cancellations

• Service coordination

• Intake or referral follow-up

• Administrative notices

• Requested information

• Employment-related messages

• Operational communications

• Other communications reasonably related to the individual's relationship with ECM

Message frequency may vary.

Message and data rates may apply.

Reply STOP to opt out of optional SMS messages.

Reply HELP for assistance.

Consent to receive optional or marketing SMS messages is not a condition of receiving ABA services from ECM.

Mobile Number and SMS Consent Privacy

ECM does not sell or rent mobile telephone numbers, SMS opt-in information, or SMS consent information.

Mobile telephone numbers, SMS opt-in information, and SMS consent information will not be shared with third parties or affiliates for their own marketing or promotional purposes.

ECM may disclose information to service providers that help operate ECM's communications, technology, security, scheduling, or business systems, but only as reasonably necessary for those providers to perform services for ECM and subject to applicable confidentiality, privacy, security, contractual, and legal requirements.

SMS and Sensitive Health Information

Standard SMS/text messaging may not be appropriate for detailed or highly sensitive clinical information.

Clients, families, caregivers, and employees should avoid sending:

• Social Security numbers

• Full insurance identifiers

• Detailed treatment plans

• Detailed clinical records

• Highly sensitive behavioral information

• Passwords

• Financial credentials

• Other unnecessary confidential information

by standard SMS unless specifically instructed to use an approved method.

ECM employees are expected to use the minimum information reasonably necessary for routine scheduling or coordination and to move sensitive clinical conversations to the appropriate approved system.

Call Logs, Text Logs, Voicemail, and Communication Records

ECM may retain business communication records generated through ECM-managed systems, including:

• Call logs

• Text-message history

• Voicemail

• Date and time

• Call duration

• Telephone numbers

• Sender and recipient information

• Routing data

• Delivery status

• Other system-generated metadata

Authorized ECM personnel may review these records when reasonably necessary for:

• Client safety

• Employee safety

• Continuity of services

• Quality assurance

• Supervision

• Compliance

• Complaint investigation

• Dispute resolution

• Documentation review

• Fraud prevention

• Security

• Legal obligations

Access to communication records should be limited to personnel with an appropriate business, clinical, supervisory, compliance, privacy, security, or legal need.

Call Recording, Monitoring, Transcription, and Similar Features

ECM communication technology may include capabilities for call recording, monitoring, transcription, or other conversation-management features.

ECM will activate or use such features only when authorized by ECM and in accordance with applicable law, consent requirements, healthcare privacy obligations, contractual requirements, and ECM policy.

Where notice or consent is legally required, ECM will take reasonable steps to provide appropriate notice or obtain required consent.

Employees are not authorized to independently record, transcribe, download, distribute, or retain ECM-related communications unless expressly authorized and legally permitted.

Third-Party Service Providers and Business Associates

ECM may use third-party vendors for:

• Telecommunications

• Messaging

• Website hosting

• Electronic health records

• Scheduling

• Payroll

• Human resources

• Analytics

• Security

• Data storage

• Other business operations

When a vendor creates, receives, maintains, or transmits PHI on ECM's behalf and HIPAA requires a Business Associate Agreement ("BAA"), ECM will seek to maintain an appropriate written agreement and require applicable safeguards.

Integrations, exports, automated notifications, or external applications involving PHI must be approved by ECM and configured in accordance with ECM privacy and security requirements.

Security Safeguards

ECM uses reasonable administrative, technical, and physical safeguards designed to protect confidential information from unauthorized access, use, disclosure, alteration, loss, or destruction.

Safeguards may include:

• Unique user accounts

• Role-based access

• Password protection

• Multi-factor authentication where available or required

• Automatic logout or session controls

• Encryption and secure transmission controls where supported

• Restricted access to recordings, transcripts, and exports

• Employee privacy and security training

• Device-security requirements

• Incident reporting procedures

• Vendor security review

No electronic communication or storage method can be guaranteed to be completely secure.

Security and Privacy Incidents

Employees and authorized users are expected to report suspected privacy or security incidents promptly, including:

• Unauthorized access

• Misdirected messages

• Lost or stolen devices

• Compromised credentials

• Phishing

• Inappropriate disclosure

• Suspicious communication activity

• Other suspected privacy or security events

ECM may investigate incidents, take mitigation steps, preserve relevant records, restrict access, and provide notifications when required by applicable law or contract.

Minors, Parents, Guardians, and Authorized Representatives

ECM primarily serves children and adolescents.

Communications concerning minor clients will ordinarily occur through a parent, legal guardian, authorized caregiver, or other authorized representative unless direct communication with the minor is clinically appropriate, professionally appropriate, legally permitted, and consistent with ECM policy.

ECM may take reasonable steps to verify a person's identity or authority before disclosing sensitive client information.

Personal Telephone Numbers and Professional Boundaries

Where an ECM-approved business number or messaging account is provided, ECM may require employees to use that channel for client- and family-related communication.

Separating business and personal communication helps protect:

• Employee privacy

• Client privacy

• Professional boundaries

• Continuity of care

• Organizational records

• Communication documentation

• Security and confidentiality

Data Retention

ECM may retain website, communication, clinical, employment, and business records for the period reasonably necessary to:

• Provide services

• Meet healthcare documentation requirements

• Satisfy payer obligations

• Meet employment obligations

• Resolve disputes

• Conduct investigations

• Meet legal or regulatory requirements

• Preserve records subject to legal holds

• Protect ECM's rights and systems

Records may be archived, de-identified, or deleted when retention is no longer required or appropriate, subject to applicable law and ECM policy.

Disclosure of Information

ECM may disclose information when reasonably necessary and legally permitted to:

• Provide services

• Coordinate treatment

• Support payment or healthcare operations

• Perform business functions

• Comply with law

• Respond to valid legal process

• Investigate suspected misconduct or security incidents

• Protect safety

• Enforce ECM policies

• Protect ECM's rights and systems

Any use or disclosure of PHI remains subject to applicable healthcare privacy requirements.

Cookies and Website Analytics

ECM's website may use cookies, server logs, or similar technologies for website functionality, security, accessibility, performance, and analytics.

Website visitors may be able to manage certain cookie settings through their browser or device.

Communication Choices and Opt-Outs

Individuals may contact ECM to update contact information or communication preferences.

Where applicable, replying STOP will opt the mobile number out of optional SMS messages.

An SMS opt-out does not necessarily prevent ECM from contacting an individual by telephone, email, mail, an approved clinical platform, or another lawful method when communication is necessary for treatment, scheduling, safety, employment, legal obligations, or another legitimate purpose.

Emergencies

ECM's website, email, SMS/text messaging, voicemail, and routine telephone channels are not emergency services.

Do not rely on these systems for immediate medical, psychiatric, safety, or life-threatening emergencies.

Call 911 or seek appropriate emergency assistance when immediate help is required.

Changes to This Privacy Policy

ECM may update this Privacy Policy to reflect changes in technology, communication systems, services, business practices, privacy requirements, or law.

The current version will be posted on ECM's website with the applicable effective or revision date.

Contact ECM

Questions about this Privacy Policy, communication preferences, or ECM's privacy practices may be directed to: