Privacy
Policy

Valley Spring Recovery Center ("we," "us," or "our") is committed to protecting the privacy of every individual who visits our website, contacts our admissions team, or receives treatment through our outpatient programs. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you interact with our website, services, and treatment programs.

By accessing our website at valleyspringrecovery.com, calling our admissions line, submitting any online form, or enrolling in one of our programs, you acknowledge that you have read and understand this Privacy Policy. If you do not agree with the practices described herein, please discontinue use of our website and services.

This policy applies to all information collected through our website, phone communications, in-person interactions at our facility, electronic health records, and any related services or communications.

Personal Information You Provide

When you contact us, submit a form, verify your insurance, or enroll in a treatment program, we may collect the following:

• Full name, date of birth, and contact information (phone number, email address, mailing address)
• Insurance information, including provider name, policy number, and group number
• Medical and behavioral health history, including substance use history, mental health diagnoses, medications, and prior treatment records
• Emergency contact information
• Financial and billing information necessary for processing payments or verifying insurance coverage
• Any information you voluntarily provide through contact forms, phone calls, live chat, or email correspondence

Information Collected Automatically

When you visit our website, certain information is collected automatically through cookies and similar technologies:

• IP address and approximate geographic location
• Browser type, operating system, and device information
• Pages visited, time spent on pages, and navigation patterns
• Referring website or search terms that led you to our site
• Date and time of your visit

We use the information we collect for the following purposes:

• Treatment and Care: To provide, coordinate, and manage your addiction treatment and mental health care, including assessments, treatment planning, and continuity of care
• Insurance Verification: To verify your insurance coverage, process claims, and determine your financial responsibility for services
• Communication: To respond to your inquiries, provide information about our programs (Partial Hospitalization, Intensive Outpatient, Virtual IOP, Alumni), and follow up on admissions requests
• Operations: To manage our facility operations, maintain records, conduct quality improvement activities, and ensure compliance with licensing and accreditation standards
• Legal Compliance: To comply with applicable laws, regulations, court orders, and legal proceedings, including HIPAA, 42 CFR Part 2, and state behavioral health regulations
• Website Improvement: To analyze website usage patterns, improve user experience, and optimize our digital content and services
• Safety: To protect the health and safety of our patients, staff, and community as permitted or required by law

We do not sell your personal information to third parties. We may share your information only in the following circumstances:

• With Your Consent: We may share your protected health information (PHI) with other healthcare providers, family members, or third parties when you have provided a valid, written authorization
• For Treatment, Payment, and Operations: As permitted by HIPAA, we may share information with other healthcare providers involved in your care, insurance companies for payment purposes, and for our own healthcare operations
• Service Providers: We may share non-clinical information with trusted third-party vendors who assist with website hosting, analytics, marketing, and operational support, subject to confidentiality agreements
• Legal Requirements: We may disclose information when required by law, including responses to court orders, subpoenas, or government investigations
• Emergency Situations: We may disclose information to prevent or lessen a serious and imminent threat to the health or safety of a person or the public

Substance use disorder patient records are additionally protected under federal regulation 42 CFR Part 2, which imposes stricter requirements on the disclosure of such records. We comply fully with these enhanced protections.

Valley Spring Recovery Center is a covered entity under the Health Insurance Portability and Accountability Act of 1996 (HIPAA). We maintain strict administrative, technical, and physical safeguards to protect your Protected Health Information (PHI) in accordance with the HIPAA Privacy Rule and Security Rule.

Our HIPAA compliance practices include:

• Maintaining a designated Privacy Officer responsible for overseeing all privacy-related policies and procedures
• Training all workforce members on HIPAA privacy and security requirements upon hire and annually thereafter
• Using encrypted electronic health records (EHR) systems that meet federal security standards
• Implementing access controls that limit PHI access to authorized personnel on a need-to-know basis
• Conducting regular risk assessments and security audits to identify and address vulnerabilities
• Maintaining Business Associate Agreements (BAAs) with all third-party vendors who may access PHI

A separate Notice of Privacy Practices (NPP) is provided to all patients at the time of intake, which describes in detail how your medical information may be used and disclosed and how you can access this information. You may request a copy of our NPP at any time by contacting our Privacy Officer.

Under HIPAA and applicable state laws, you have the following rights regarding your health information:

• Right to Access: You may request access to your medical records and other protected health information we maintain about you
• Right to Amend: You may request that we amend your health information if you believe it is inaccurate or incomplete
• Right to an Accounting of Disclosures: You may request a list of certain disclosures we have made of your health information
• Right to Request Restrictions: You may request restrictions on how we use or disclose your health information for treatment, payment, or operations
• Right to Confidential Communications: You may request that we communicate with you about health matters through a particular method or at a specific location
• Right to a Paper Copy: You may request a paper copy of our Notice of Privacy Practices at any time
• Right to Revoke Authorization: If you have provided written authorization for the use or disclosure of your health information, you may revoke that authorization in writing at any time
• Right to File a Complaint: You may file a complaint with us or with the U.S. Department of Health and Human Services if you believe your privacy rights have been violated. We will not retaliate against you for filing a complaint

To exercise any of these rights, please contact our Privacy Officer using the contact information provided in Section 11 of this policy.

Our website uses cookies and similar tracking technologies to enhance your browsing experience and analyze site traffic. These include:

• Essential Cookies: Required for the website to function properly, including session management and security features. These cannot be disabled
• Analytics Cookies: Used to understand how visitors interact with our website, which pages are visited most frequently, and how users navigate through the site. We use Google Analytics for this purpose
• Marketing Cookies: Used to deliver relevant advertisements and track the effectiveness of our marketing campaigns. These may be set by third-party advertising partners

You can control cookie preferences through your browser settings. Most browsers allow you to block or delete cookies, though this may affect website functionality. Please note that our website does not currently respond to "Do Not Track" browser signals.

We do not use cookies or tracking technologies to collect protected health information. Website analytics data is maintained separately from clinical and patient records.

We implement industry-standard security measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. Our security practices include:

• SSL/TLS encryption for all data transmitted between your browser and our website
• Encrypted storage of sensitive data including health records and financial information
• Multi-factor authentication for staff access to clinical and administrative systems
• Regular security assessments, penetration testing, and vulnerability scanning
• Physical security controls at our facility, including restricted access to records storage areas
• Incident response procedures for promptly addressing any suspected data breaches

While we take reasonable precautions to protect your information, no method of electronic transmission or storage is completely secure. We cannot guarantee absolute security, but we are committed to maintaining and improving our safeguards to protect your data.

Our website and services are intended for individuals aged 18 and older. We do not knowingly collect personal information from children under the age of 13 through our website. If we become aware that we have inadvertently collected personal information from a child under 13, we will take immediate steps to delete that information from our records.

If you are a parent or guardian and believe your child has provided personal information through our website, please contact us immediately using the information in Section 11, and we will work to remove the data promptly.

We reserve the right to update or modify this Privacy Policy at any time. When we make changes, we will revise the "Last Updated" date at the top of this page. For significant changes that materially affect how we handle your personal information, we may provide additional notice through our website or via email.

We encourage you to review this Privacy Policy periodically to stay informed about how we are protecting your information. Your continued use of our website and services after any changes to this policy constitutes your acceptance of the updated terms.

If you have any questions about this Privacy Policy, wish to exercise your rights regarding your personal information, or need to file a privacy-related complaint, please contact us:

You may also file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights by visiting hhs.gov/hipaa/filing-a-complaint or by calling 1-800-368-1019.