Privacy Policy

SCOPE

This Privacy Policy (“Policy”) describes how BrightView, LLC (“BrightView”) treats personal information on our websites where the Policy is located (the “Platform”). This Platform is operated in the United States and intended for use by individuals who are located in the United States.

Note that this Policy does not apply to our collection of any personal information, medical information, or other protected health information (“PHI”) covered by the Health Insurance Portability and Accountability Act (“HIPAA”) or 42 CFR Part 2. For more information on our treatment of PHI, please review of HIPAA Notice of Privacy Practices.

­­­NOTICE AT COLLECTION

We collect, and in the past 12 months have collected, the following categories of information from and about you: identifiers; commercial information; internet or similar network activity; inferences drawn from other personal information; and sensitive personal information. We collect these categories of information from you in order to provide our services to you, to run our business, to communicate with you, and as required by law. We may have disclosed each of these categories of personal information for a business purpose as described below. We do not “sell” or “share” personal information, as those terms are defined by applicable state privacy laws.  For a description of your rights under state privacy laws, and instructions on how to exercise your rights, please see the Your Privacy Rights section below.

We will retain each of these categories of personal information based on several factors, including as reasonably necessary to (i) provide our products and services or administer our relationship with a consumer; (ii) protect our business, employees, organization, and others; (iii) fulfill our legal and regulatory obligations; and (iv) investigate and address issues which may include safety concerns, potential security incidents or policy violations.

TYPES OF INFORMATION WE COLLECT

We collect information from you and about you. Here are some examples of the information we may collect:

• Contact Information. For example, we may collect your name, mailing address, telephone number and email address. We may also collect your mobile phone number.
• Identification Information. This may include your Social Security number.
• Information You Submit. We may collect information when you send us a message through the “Contact Us” page, refer a patient, or use similar features on our Platform. This includes any information that you submit via our online chatbot.
• Consumer Health Data. This may include information that you submit via our Platform that relates to your past, present, or future physical or mental health status, but that we do not collect as a covered entity under HIPAA or 42 CFR Part 2. For more information on our treatment of PHI, please review of HIPAA Notice of Privacy Practices
• Demographic Information. For example, we may collect your age, date of birth, gender, and zip code.
• Payment Information. We, or our third-party vendors, may collect your payment information, such as your credit card information.
• Commercial Information. We may collect personal information that could identify you and relates to the services or programs which you are interested or have considered.
• Other Information. If you use our website, we may collect information about the browser or device you are using. We might look at what site you came from, or what site you visit when you leave us. We may also collect your device identifier, IP address, or operating system.

HOW WE COLLECT YOUR INFORMATION

We collect your information in different ways. Below are some examples of how we may collect your information.

• Directly From You. For example, when you:
  • submit an inquiry to us;
  • fill out a form or survey;
  • submit a referral;
  • use our chat Help Bot; and
  • otherwise contact us or interact with us.
• For example, when you visit and navigate our Platform on any device. We may also collect information about users over time and across different websites and devices when you use the Platform.
• From Third Parties. We may receive information about you from other sources. For example, this may include receiving information from our business partners, including analytics vendors. It may also include referrals from our partners, your friends or family, or social workers or medical professionals.
• By Combining Information. For example, we may combine information that we collect offline with information we collect through our Platform. We may also combine information we collect about you from the different devices you use to access our Platform.

HOW WE USE YOUR INFORMATION

Examples of how we may use your information include:

• To Run and Improve Our Platform and Business. We may use your information to make our Platform and business better. We may also use your information to provide you with information about our business.
• To Respond to Your Requests or Questions. This may include responding to your feedback or referral.
• To Communicate With You. We may communicate with you about your account or our relationship. We may also contact you about this Policy or our Platform terms and conditions.
• For Security Purposes. This could include protecting our company and consumers who use our products and services. It may also include protecting our Platform.
• As Otherwise Permitted By Law or As We May Notify You.
• As Requested or Directed By You.

HOW WE SHARE YOUR INFORMATION

We may share your information in the following ways:

• We may share your information with our parent, subsidiary, and affiliate entities.
• With Our Service Providers. We may share your information with third parties who perform services on our behalf. For example, this may include companies that send emails on our behalf or help us run our Platform.
• With Any Successors to All or Part of Our Business. For example, if we merge with, are acquired by, or sell part of our business to another entity. This may include asset sales, corporate reorganization or other change of control.
• To Comply With the Law or To Protect Ourselves. For example, this could include responding to a court order or subpoena. It could also include sharing information if a government agency or investigatory body requests. We might share information when we are investigating potential fraud.
• For Other Reasons We May Describe to You.
• As Requested or Directed By You.

CHILDREN UNDER 13

The Platform where this Policy is located is meant for adults. We do not knowingly collect personally identifiable data from persons under the age of 13, and strive to comply with the provisions of COPPA (The Children’s Online Privacy Protection Act). If you are a parent or legal guardian and think your child under 13 has provided us with information, please contact us at legal@brightviewhealth.com. You can also write to us at the address listed at the end of this website Policy. Please mark your inquiries “COPPA Information Request.” Parents, you can learn more about how to protect children’s privacy on-line here.

CHOICES REGARDING YOUR INFORMATION

You have certain choices about how we use your information. Certain choices you make are browser and device specific.

Cookies & Other Tracking Technologies:

• Cookies: You can adjust your browser to control cookies to require your affirmative acceptance for new cookies, automatically reject cookies and/or delete or disable existing cookies. How you do so depends on the type of cookie and the browser that you are using. For more information on how to control browser cookies, click here. If information about your browser is not available through this page, please search your browser for instructions about how to opt-out of cookie collection.
• Google Analytics: We may use Google Analytics on our Platform to help us understand how you use our Platform. You can learn about how to opt-out of Google Analytics here.
• Email Tools: You can also change your email settings to block the automatic download of images in email messages, as such images may contain technologies that help us understand how you interact with the message.
• Note that deleting or blocking cookies may impact your experience on our website, as some features may not be available. Certain options you select are browser and device specific.

Our Do Not Track Policy:

• Some browsers have “do not track” features that allow you to tell a website not to track you. These features are not all uniform. We do not currently respond to those signals. If you block cookies, certain features on our sites may not work.  If you block or reject cookies, not all of the tracking described here will stop.
• Options you select are browser and device specific.

YOUR PRIVACY RIGHTS

Based on your state of residence, you may have the rights listed below with respect to the personal information and consumer health data that we maintain about you. We may take steps to verify your identity, as permitted or required under applicable law, before we process your request. Verification may include asking you to provide information about yourself that we can match against information already in our possession.

• Notice. This means that you can request that we disclose what personal information we have collected about you, including the categories of personal information, the categories of sources from which the personal information is collected, the business or commercial purpose for collecting, selling, or sharing personal information, the categories of third parties to whom we have disclosed personal information, and the specific pieces of personal information we have collected about you.
• Deletion. This means that you can request that we delete personal information about you which we have collected from you.
• This means that you can request that we correct inaccurate personal information that we maintain about you.
• Limit the Use or Disclosure of Sensitive Personal Information. The California Consumer Privacy Act (“CCPA”) provides a right for consumers to request that business limit the use or disclosure of their “sensitive” personal information. We do not process sensitive personal information other than as necessary to provide our services.
• Withdraw Consent. Where the collection or use of your personal information or consumer health data is necessary for us to provide a product or service you have requested from us, we may process your information without your consent. However, if we obtain your consent to process your information for other purposes, where required by applicable law, you have the right to withdraw your consent at any time. 
• Opt-Out of the Sale or Sharing of Personal Information. You may have the right to opt out of the “sale” or sharing of personal information with third parties for cross-contextual marketing purposes. We do not knowingly “sell” or “share” any personal information, including any personal information relating to consumers under the age of 16, as we understand those terms to be defined under applicable law.

Agents that you have authorized to act on your behalf may also submit requests as instructed below. The agent must also provide evidence that they have your written permission to submit a request on your behalf. If we are unable to verify the authenticity of a request, we may ask you for more information or may deny the request.

Individuals who wish to exercise their rights under this section can contact us at legal@brightviewhealth.com. Please include your name, email address, state of residence, and indicate you are making a “Privacy Rights” request. If we deny your rights request and you would like to appeal, you may contact us at legal@brightviewhealth.com or contact the appropriate regulator(s) in your state of residence.

SECURITY

The Internet is not 100% secure. We cannot promise that your use of our Platform will be completely safe. We encourage you to use caution when using the Internet. We use reasonable means to safeguard personal information under our control.

STORAGE OF INFORMATION

Information we maintain may be stored in or outside of the United States. If you live outside of the United States, you understand and agree that we may transfer your personal information to the United States. This Platform is intended for use in the United States and is subject to the laws of the United States, which may not provide the same level of protections as those in your own country.

LINKS

Our Platform may contain links to other third-party sites that are not governed by this Policy. If you click on a link to a third-party site, you will be taken to a site we do not control.  We are not responsible for the privacy practices used by third-party sites. We suggest that you read the privacy policies of those sites carefully.

HOW TO CONTACT US

If you have any questions, comments or concerns with respect to our privacy practices or this Policy, or wish to update your information, please feel free to contact us at legal@brightviewhealth.com.

CHANGES IN POLICY

From time to time, we may change our Policy. We will notify you of any material changes to our Policy as required by law. We will also post an updated copy on our Platform. Please check our Platform periodically for updates.

BRIGHTVIEW, LLC NOTICE OF PRIVACY PRACTICES

Effective Date: 3/4/2019

Publication Date: 3/4/2019

Our Privacy Policy

BrightView is committed to providing you with quality behavioral healthcare services.

An important part of that commitment is protecting your health information according to applicable law. This notice (“Notice of Privacy Practices”) describes your rights and our duties under Federal Law. Protected health information (“PHI”) is information about you, including demographic information, that may identify you and that relates to your past, present or future physical or mental health or condition; the provision of healthcare services; or the past, present or future payment for the provision of healthcare services to you.

Our Duties

We are required by law to maintain the privacy of your PHI, provide you with notice of our

legal duties and privacy practices with respect to your PHI, and to notify you following a breach of unsecured PHI related to you. We are required to abide by the terms of this Notice of Privacy Practices. This Notice of Privacy Practices is effective as of the date listed on the first page of this Notice of Privacy Practices. This Notice of Privacy Practices will remain in effect until it is revised. We are required to modify this Notice of Privacy Practices when there are material changes to your rights, our duties, or other practices contained herein.

We reserve the right to change our privacy policy and practices and the terms of this Notice of Privacy Practices, consistent with applicable law and our current business processes, at any time. Any new Notice of Privacy Practices will be effective for all PHI that we maintain at that time.

Notification of revisions of this Notice of Privacy Practices will be provided as follows upon request, electronically via our website or via other electronic means, or as posted in our place of business.

In addition to the above, we have a duty to respond to your requests (e.g. those corresponding to your rights) in a timely and appropriate manner. We support and value your right to privacy and are committed to maintaining reasonable and appropriate safeguards for your PHI.

Confidentiality of Substance Use Disorder Patient Records

The confidentiality of substance use disorder patient records maintained by us is also protected by Federal law and regulations. Generally, the law and regulations provide that:

1. We may not disclose to a person outside the treatment center that you are present in the treatment center, that you are a patient of the treatment center, or any information identifying you as having or having had a substance use
2. Except in specific, limited circumstances described in the federal regulations, we will not disclose any of your substance use disorder patient information to any person outside of the treatment center unless you consent in writing (as discussed below in “Authorization to use or Disclose Confidential Information”).
3. Information related to your commission of a crime on the premises of the treatment center or against personnel of the treatment center is not protected; and
4. Reports of suspected child abuse and neglect made under state law to appropriate state or local authorities is not

See 42 U.S.C. 290dd-3 and 42 U.S.C. 290ee-3 for Federal laws and 42 CFR part 2 for Federal regulations.

Violation of the federal law and regulations by the treatment center is a crime. Suspected violations may be reported to United States Attorney for the judicial district in which the violation occurs as well as to the Substance Abuse and Mental Health Services (SAMHSA) office responsible for oversight of the treatment center.

Uses and Disclosures

Uses and disclosures of your PHI may be permitted, required, or authorized. The following categories describe various ways that we use and disclose PHI.

Among BrightView Personnel: We may use or disclose information between or among personnel having a need for the information in connection with their duties that arise out of the provision

of diagnosis, treatment, or referral for treatment of alcohol or drug abuse, provided such communication is (i) within the treatment center; or (ii) between the treatment center and BrightView. For example, our staff, including doctors, nurses, and clinicians, will use your PHI to provide your treatment care. Your PHI may be used in connection with billing statements we send you and in connection with tracking charges and credits to your account. Your PHI will be used to check for eligibility for insurance coverage and prepare claims for your insurance company where appropriate. We may use and disclose your PHI to conduct our healthcare business and to perform functions associated with our business activities, including accreditation and licensing.

Secretary of Health and Human Services: We are required to disclose PHI to the Secretary of the

U.S. Department of Health and Human Services when the Secretary is investigating or determining

our compliance with the HIPAA Privacy Rules.

Business Associates: We may disclose your PHI to Business Associates that are contracted by us to perform services on our behalf which may involve receipt, use or disclose of your PHI. All of our Business Associates must agree to:

(i) protect the privacy of your PHI; (ii) use and disclose the information only for the purposes for which the Business Associate was engaged; (iii) be bound by 42 CFR Part 2; and (iv) if necessary, resist in judicial proceedings any efforts to obtain access to patient records except as permitted by law.

Crimes on premises: We may disclose to law enforcement officers information that is directly related to the commission of a crime on the premises or against our personnel or to a threat to commit such a crime.

Reports of suspected child abuse and neglect: We may disclose information required to report under state law incidents of suspected child abuse and neglect to the appropriate state or local authorities. However, we may not disclose the original patient records, including for civil or criminal proceedings which may arise out of the report of suspected child abuse and neglect, without consent.

Court order: We may disclose information required by a court order, provided certain regulatory requirements are met.

Emergency situations: We may disclose information to medical personnel for the purpose of treating you in an emergency.

Research: We may use and disclose your information for research if certain requirements are met, such as approval by an Institutional Review Board.

Audit and Evaluation Activities: We may disclose your information to persons conducting certain audit and evaluation activities, provided the person agrees to certain restrictions on disclosure of information.

Reporting of Death: We may disclose your information related to cause of death to a public health authority that is authorized to receive such information.

Central Registry: By enrolling for Medication Assisted Treatment Services at this facility, your health information may be released to the Central Registry within the State of Ohio.

Authorization to use or disclose PHI

Other than as stated above, we will not use or disclose your PHI other than with your written authorization. Subject to compliance with limited exceptions, we will not use or disclose psy-chotherapy notes, use or disclose your PHI for marketing purposes or sell your PHI unless you have signed an authorization. If you or your representative authorizes us to use or disclose your PHI, you may revoke that authorization in writing at any time to stop future uses or disclosures. We will honor oral revocations upon authenticating your identity until a written revocation is obtained. Your revocation will not affect any use or disclosures permitted by your authorization while it was in effect.

Patient/Client Rights

The following are the rights that you have regarding PHI that we maintain about you. Information regarding how to exercise those rights is also provided. Protecting your PHI is an important part of the services we provide you. We want to ensure that you have access to your PHI when you need it and that you clearly understand your rights as described below.

Right to Notice

You have the right to adequate notice of the uses and disclosures of your PHI, and our duties and responsibilities regarding same, as provided for herein. You have the right to request both a paper and electronic copy of this Notice. You may ask us to provide a copy of this notice at any time. You may obtain this notice on our website at www.americanaddictioncenters.org or from facility staff or our Privacy Official.

Right of Access to Inspect and Copy

You have the right to access, inspect and obtain a copy of your PHI for as long as we maintain it as required by law. This right may be restricted only in certain limited circumstances as dictated by applicable law. All requests for access to your PHI must be made in writing. Under a limit-

ed set of circumstances, we may deny your request. Any denial of a request to access will be communicated to you in writing. If you are denied access to your PHI, you may request that the denial be reviewed. Another licensed health care professional chosen by BrightView will review your request and the denial. The person conducting the review will not be the person who de-nied your request. We will comply with the decision made by the designated professional. If you are further denied, you have a right to have a denial reviewed by a licensed third-party health-care professional (i.e. one not affiliated with us). We will comply with the decision made by the designated professional.

We may charge a reasonable, cost-based fee for the copying and/or mailing process of your request. As to PHI which may be maintained in electronic form and format, you may request a copy to which you are otherwise entitled in that electronic form and format if it is readily pro-ducible, but if not, then in any readable form and format as we may agree (e.g. PDF). Your re-quest may also include transmittal directions to another individual or entity.

Right to Amend

If you believe the PHI we have about you is incorrect or incomplete, you have the right to re-quest that we amend your PHI for as long as it is maintained by us. The request must be made in writing, and you must provide a reason to support the requested amendment. Under certain circumstances we may deny your request to amend, including but not limited to, when the PHI: 1. was not created by us; 2. is excluded from access and inspection under applicable law; or 3. is accurate and complete. If we deny amendment, we will provide the rationale for deni-al to you in writing. You may write a statement of disagreement if your request is denied. This statement will be maintained as part of your PHI and will be included with any disclosure. If we accept the amendment, we will work with you to identify other healthcare stakeholders that require notification and provide the notification.

Right to Request an Accounting of Disclosures

We are required to create and maintain an accounting (list) of certain disclosures we make of your PHI. You have the right to request a copy of such an accounting during a time period specified by applicable law prior to the date on which the accounting is requested (up to six years). You must make any request for an accounting in writing.

We are not required by law to record certain types of disclosures (such as disclosures made pursuant to an authorization signed by you), and a listing of these disclosures will not be pro-vided. If you request this accounting more than once in a 12-month period, we may charge you a reasonable, cost-based fee for responding to these additional requests. We will notify you of the fee to be charged (if any) at the time of the request.

Right to Request Restrictions

You have the right to request restrictions or limitations on how we use and disclose your PHI for treatment, payment and operations. We are not required to agree to restrictions for treat-ment, payment and healthcare operations except in limited circumstances as described below. This request must be in writing. If we do agree to the restriction, we will comply with restriction going forward, unless you take affirmative steps to revoke it or we believe, in our professional judgment, that an emergency warrants circumventing the restriction in order to provide the appropriate care or unless the use or disclosure is otherwise permitted by law. In rare circum-stances, we reserve the right to terminate a restriction that we have previously agreed to, but only after providing you notice of termination.

Out-of-Pocket Payments

If you have paid out-of-pocket (or in other words, you or someone besides your health plan has paid for your care) in full for a specific item or service, you have the right to request that your PHI with respect to that item or service not be disclosed to a health plan for purposes of payment or healthcare operations, and we are required by law to honor that request unless affirmatively terminated by you in writing and when the disclosures are not required by law. This request must be made in writing.

Right to Confidential Communications

You have the right to request that we communicate with you about your PHI and health matters by alternative means or alternative locations. Your request must be made in writing and must specify the alternative means or location. We will accommodate all reasonable requests consis-tent with our duty to ensure that your PHI is appropriately protected.

Right to Notification of a Breach

You have the right to be notified if we (or one of our Business Associates) discover a breach involving unsecured PHI.

Right to Voice Concerns

You have the right to file a complaint in writing with us or with the U.S. Department of Health and Human Services if you believe we have violated your privacy rights. Any complaints to us should be made in writing to our Privacy Official at the address listed below. We will not retali-ate against you for filing a complaint.

Questions, Requests for Information and Complaints

For questions, requests for information, more information about our privacy policy or concerns, please contact us. Our company Privacy Official can be contacted at:

BrightView

Attn: Privacy Officer

4600 Montgomery Road, Ste. 4000

Cincinnati, OH 45212

513.834.7063

We support your right to privacy of your protected health information. You will not be retaliated against in any way if you choose to file a complaint with us or with the U.S. Department of Health and Human Services.

If you believe your rights have been violated and would like to submit a complaint directly to the U.S. Department of Health & Human Services, then you may submit a formal written complaint to the following address:

U.S. Department of Health & Human Services Office for Civil Rights 200 Independence Avenue, S.W.

Washington, D.C. 20201

877.696.6775

OCRMail@hhs.gov https://ocrportal.hhs.gov/ocr/smartscreen/main.jsf