Privacy Policy

This Privacy Policy explains how Steps of Care ABA Services LLC ("Steps of Care ABA," "we," "us") collects, uses, and protects information when you visit our website or reach out to us through it.

In short: we collect only what we need to respond to you and provide care, we never sell your information, and health information shared during treatment is protected by additional federal safeguards described in our HIPAA Notice of Privacy Practices.

Information we collect

Information you give us

When you use our contact or appointment request forms, you may share your name, email address, optional phone number, the general reason for your inquiry, and an optional brief message. Your submission travels by HTTPS from your browser directly into our own Google Workspace account, where it is stored as a single row in a private intake spreadsheet that only designated Steps of Care staff can open. The company that hosts our website pages never receives or stores the contents of your message. Our intake mailbox receives an alert that a new inquiry arrived, with the date and time and a link to that private spreadsheet; the alert itself carries no personal details. Our public forms are intended for parents, guardians, and other adults. Please do not submit diagnoses, medical records, or other detailed health information through them; we will gather the details we need through a separate intake process once we connect.

Usage information

Like most websites, we may receive basic technical information when you visit, such as your browser type, device type, IP address, and the pages you view. We use this information to operate, protect, and improve the site. To tell real families apart from automated submissions, our forms use Cloudflare Turnstile, which processes limited technical signals from your browser. Turnstile receives only that anti-abuse check. It never receives the name, email address, phone number, or message you type.

How we use your information

We use the information you share with us to:

• Respond to your questions and requests
• Check insurance coverage and eligibility when you ask us to
• Schedule consultations and appointments
• Improve our website and the way we communicate
• Meet our legal and regulatory obligations

We do not use your information for advertising, and we never sell it.

Sharing and disclosure

We do not sell, rent, or trade your personal information. We share it only in these limited situations:

• Service providers. Companies that help us operate this website and respond to inquiries may process information on our behalf. Google Workspace services, including Apps Script, Sheets, and Gmail, receive and store form submissions inside our own Google account under a signed Business Associate Amendment. Cloudflare hosts the pages of this website and provides the anti-abuse check described above; it does not receive the contents of your inquiry. These providers may use the information only to provide their contracted services or as required by law.
• Legal requirements. We may disclose information when the law requires it, for example, in response to a valid court order or to protect someone's safety.

Children's privacy

This website is written for parents, guardians, and professionals. It is not directed at children, and we do not knowingly collect personal information from children through it. Information about children reaches us because a parent or guardian chooses to share it. If you believe a child has submitted information through our website, please contact us and we will delete it.

Health information and HIPAA

This policy covers our website. When information we receive or maintain is protected health information under HIPAA, including health information submitted during intake or created during treatment, it is also governed by our HIPAA Notice of Privacy Practices, which describes your family's rights in detail.

Data security

We use reasonable administrative and technical safeguards to protect the information you share with us. Form submissions travel over HTTPS directly to our own Google Workspace account. The intake spreadsheet is private, is not shared by link, and is open only to named staff. The service that receives each submission checks it against required fields, maximum lengths, an automated-submission check, and rate limits, and it does not keep a log of your message. Alerts sent to our mailbox contain no personal information. No method of transmission over the internet is completely secure, so we ask that you avoid sending detailed medical records through our general contact form; we will collect that information through our separate intake process.

Data retention

We keep website inquiries in our private intake spreadsheet only as long as we need them. Inquiries that do not lead to services are deleted within 12 months of the date we receive them. If an inquiry becomes part of intake or care, the information incorporated into the clinical record is kept for the retention period required by law and clinic policy.

Your rights and choices

You may ask us at any time to access, correct, or delete the personal information you submitted through this website. To make a request, email us at [email protected] or call (914) 677-2888. Your rights regarding treatment records are described in our HIPAA Notice of Privacy Practices.

Third-party links

Our website may link to other sites, for example, insurance plan websites. We are not responsible for the privacy practices of other sites, and we encourage you to review their policies when you visit them.

Changes to this policy

If we update this policy, we will post the new version on this page with a new "Last updated" date. Significant changes will be noted clearly at the top of the policy.

Contact us

If you have questions about this policy or how we handle your information, please reach out:

Steps of Care ABA Services LLC
135 38th St.
Union City, NJ 07087
[email protected]
(914) 677-2888