Privacy Policy

1. Information We Collect

Reclaim Hope Foundation may collect the following categories of personal information depending on the nature of your interaction with our organization:

• Contact Information: Name, mailing address, email address, telephone number, and emergency contact details provided during program enrollment, volunteer registration, donation processing, or website inquiry forms.
• Demographic Information: Age, gender identity, race, ethnicity, primary language, and veteran status collected during intake assessments to ensure culturally responsive service delivery and to fulfill grant reporting requirements (always reported in aggregate, never individually identifiable).
• Health & Recovery Information: Substance use history, treatment history, co-occurring mental health conditions, current medications, and recovery milestones shared during clinical intake, peer support sessions, or program participation. This information receives the highest level of protection under federal law.
• Employment & Housing Information: Employment history, educational background, vocational interests, housing status, and income level provided during enrollment in Workforce Reintegration, Recovery Housing Navigation, or financial assistance programs.
• Website Usage Data: Standard server logs including IP address, browser type, pages visited, and visit duration. We do not use this data to identify individual users or link it to program participation records.

2. How We Use Your Information

Personal information collected by Reclaim Hope Foundation is used exclusively for the following purposes:

• Delivering direct services including peer support, recovery navigation, workforce reintegration, family reunification counseling, and harm reduction programming.
• Coordinating referrals to treatment providers, housing agencies, legal aid organizations, and other community partners with your explicit written consent.
• Communicating with you regarding program schedules, appointment reminders, follow-up care, and organizational updates you have opted into.
• Fulfilling reporting obligations to federal, state, and private funders using only de-identified aggregate data that cannot be traced to any individual participant.
• Improving our programs through anonymized outcome analysis and quality improvement initiatives.
• Processing tax-deductible donations and issuing acknowledgment receipts.

3. Zero Third-Party Data Selling Guarantee

Reclaim Hope Foundation will never sell, rent, trade, or otherwise commercially transfer your personal information to any third party for marketing, advertising, or any other purpose. This prohibition is absolute and applies to all categories of data we hold, including contact information, demographic data, health and recovery records, and website usage data. We do not participate in data brokerage, behavioral advertising networks, or any commercial data exchange programs. This guarantee is a foundational commitment of our organization and is not subject to change without explicit notification and renewed consent.

4. Data Sharing & Disclosure

We share personal information only under the following narrowly defined circumstances:

• With Your Written Consent: When you sign a Release of Information (ROI) authorizing us to share specific information with a named recipient for a stated purpose and time period. You may revoke consent at any time in writing.
• Medical Emergencies: When disclosure is necessary to prevent an immediate threat to your health or safety, as permitted by 42 CFR Part 2 regulations.
• Mandatory Reporting: When required by Colorado law regarding suspected child abuse, elder abuse, or imminent danger to self or others. Even in these cases, we disclose only the minimum information necessary.
• Aggregate Reporting: De-identified, aggregate statistics shared with funders and the public that cannot be used to identify any individual participant.
• Court Orders: Only in response to a court order meeting the specific requirements of 42 CFR Part 2, which imposes stricter standards than a standard subpoena.

5. 42 CFR Part 2: Substance Use Disorder Record Confidentiality

As a program that provides substance use disorder services, Reclaim Hope Foundation is subject to 42 CFR Part 2, the federal regulation governing the confidentiality of substance use disorder patient records. This regulation provides protections that exceed standard HIPAA requirements. Under 42 CFR Part 2:

• We cannot acknowledge to any outside party that an individual attends, has attended, or has applied to attend our programs without their specific written consent.
• Records cannot be disclosed in civil, criminal, administrative, or legislative proceedings conducted by any federal, state, or local authority without a court order meeting Part 2 criteria.
• Information received from us may not be re-disclosed by the recipient without additional written consent from the individual.
• Violations of 42 CFR Part 2 are subject to federal criminal penalties including fines of up to five hundred dollars for a first offense and up to five thousand dollars for subsequent offenses.

6. HIPAA Compliance

Reclaim Hope Foundation maintains compliance with the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule and Security Rule for all protected health information (PHI) we create, receive, maintain, or transmit. Our HIPAA compliance program includes a designated Privacy Officer, annual staff training, documented policies and procedures, regular risk assessments, and a breach notification protocol. Participants have the right to request access to their records, request corrections, receive an accounting of disclosures, and file complaints with our Privacy Officer or the U.S. Department of Health and Human Services.

7. Data Security Measures

We implement comprehensive administrative, physical, and technical safeguards to protect your personal information against unauthorized access, alteration, disclosure, or destruction:

• Encryption: All electronic records are encrypted at rest using AES-256 encryption and in transit using TLS 1.3 protocols.
• Access Controls: Role-based access ensures staff members can only view information necessary for their specific job functions. Multi-factor authentication is required for all system access.
• Physical Security: Paper records are stored in locked file cabinets within secured offices. Electronic systems are hosted in SOC 2 Type II certified data centers.
• Staff Training: All employees and volunteers complete comprehensive confidentiality training during onboarding and annually thereafter. Staff sign binding non-disclosure agreements.
• Incident Response: We maintain a documented data breach response plan and will notify affected individuals within sixty days of discovering a breach, as required by federal and state law.

8. GDPR Compliance (European Economic Area Residents)

If you are located in the European Economic Area (EEA), you have rights under the General Data Protection Regulation (GDPR). We process your personal data based on legitimate interest or explicit consent. You have the right to access, rectify, erase, restrict processing, or port your data. You also have the right to withdraw consent and lodge a complaint with a supervisory authority. To exercise these rights, contact our Privacy Officer at privacy@reclaimhopefoundation.org. We will respond within thirty days.

9. CCPA Compliance (California Residents)

California residents have additional rights under the California Consumer Privacy Act (CCPA) and its successor, the California Privacy Rights Act (CPRA). You have the right to know what personal information we collect and how it is used, the right to request deletion, the right to opt out of the sale of personal information (we never sell personal information), and the right to non-discrimination for exercising your privacy rights. To make a CCPA request, contact our Privacy Officer at privacy@reclaimhopefoundation.org or call (720) 555-0147.

10. Cookies & Website Analytics

The Reclaim Hope Foundation website uses only essential technical cookies required for basic site functionality such as session management and security. We do not use advertising cookies, retargeting pixels, social media tracking widgets, or third-party analytics platforms that profile individual visitors. Our Recovery Readiness Assessment processes all user input entirely within your browser using client-side JavaScript and does not transmit any assessment responses to our servers. No cookies or local storage data are set by the assessment tool.

11. Data Retention

We retain personal information only for as long as necessary to fulfill the purposes for which it was collected or as required by law. Program participation records are retained for seven years following the last date of service, consistent with Colorado state record retention requirements and federal grant conditions. Donor records are retained for the duration required by IRS regulations. Website inquiry form submissions are retained for one year and then permanently deleted. You may request earlier deletion of your non-legally-mandated records by contacting our Privacy Officer.

12. Children’s Privacy

Our website is not directed to children under the age of thirteen, and we do not knowingly collect personal information online from children under thirteen. Our in-person Children and Youth Support Services program does serve minors aged six through seventeen, but enrollment requires written parental or guardian consent, and all records are maintained under the parent or guardian account with the same 42 CFR Part 2 and HIPAA protections described in this policy. If you believe we have inadvertently collected information from a child under thirteen through our website, please contact us immediately and we will delete it.

13. Changes to This Policy

Reclaim Hope Foundation reserves the right to update this Privacy Policy as needed to reflect changes in our practices, legal requirements, or organizational structure. Material changes will be communicated through a prominent notice on our website and, where applicable, direct notification to active program participants. The “Last Updated” date at the top of this page indicates the most recent revision. We encourage you to review this policy periodically.

14. Contact for Privacy Concerns

If you have questions, concerns, or requests related to this Privacy Policy or your personal information, please contact:

You also have the right to file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights if you believe your privacy rights have been violated. Information about filing a complaint is available at hhs.gov/hipaa/filing-a-complaint.