Effective starting: August 19, 2024 (view archived versions)
POLICY:
Gateway Rehabilitation Centers (“GRC”, “we”, “our”, “us”) values and respects the privacy of individuals. This Privacy Policy (“Privacy Policy”) describes the types of information, including Personal Data, that GRC processes as part of our websites, including https://gatewayrehab.org/, https://greenbriar.net/, https://productivitypartners.net/ and other related online GRC owned sites (collectively, the “Services”). Services also include content that a User submits to our websites, which include social media or social networking websites operated by GRC. This Privacy Policy outlines individual rights regarding GRC’s collection, use and disclosure of Personal Data related to the Services.
As used in this Privacy Policy, the term “Personal Data” means information that identifies an individual or a household directly or indirectly, by reference to identifier(s) such as name, identification number, location data, online identifier or one or more factors specific to an individual’s physical, physiological, genetic, mental, economic, cultural, educational, commercial, professional or social identity.
The terms of this Privacy Notice are not intended to supersede any corporate agreements in place with your employer or other organization that you are affiliated which has contracted to use GRC services (“Agreement(s)”). In the event of conflict between this Privacy Notice and such Agreement(s), the terms of the Agreement(s) will prevail.
If there are questions about our privacy practices, please refer to the end of this Privacy Policy for information about how to contact us. If you do not agree with this Privacy Policy, do not access or use our Services or interact with any aspect of our business.
PROCEDURE:
1. Personal Data Collection:
GRC collects information about a User whenever a User provides it to GRC, when a User uses GRC’s Services, and when other sources provide information to GRC, as further described below.
a. Some Personal Data is collected from Users through the Services.
b. Types of Personal Data Collected.
Among the types of Personal Data collected through the Services, by GRC
itself or through third parties, are: Cookies; Usage Data; email address;
first name; last name; phone number; and IP address.
Details of each type of Personal Data collected are provided in the
dedicated sections of this Privacy Policy or through explanatory messages
displayed prior to the data collection.
Personal Data may be freely provided by the User, or, in case of Usage
Data, collected automatically when using the Services. This includes information provided to GRC by a User when a User registers for an account, create or modifies a profile, sets preferences, or signs up for certain Services. For example, a User provides contact information, and, in some cases, billing information, when a User registers for Services. GRC may also keep track of a User’s preferences when a User selects settings within the Service.
GRC also collects additional information that a User chooses to provide to GRC. This information includes any feedback that a User may provide to GRC and we collect information using analytics techniques that hash, filter or otherwise scrub information to exclude information that might identify a User; and we collect clickstream data about how a User interacts with and uses features in the Services.
GRC collects payment and billing payment information provided by a User. For example, you may provide payment information, such as payment card details, which we collect via secure payment processing services.
Unless specified otherwise, all Personal Data requested by the Services is required for a User to use the Services and failure to provide this data may make it impossible for GRC to provide the Services. In cases where the Services indicate that some Personal Data is not required, Users are free not to communicate this data without impact to the availability or the functionality of the Services.
GRC collects phone numbers for SMS communication purposes. Information obtained specifically as part of the SMS consent process will not be shared with third parties. SMS communication for existing and prospective patients may include appointment reminders, follow-up to appointment requests and GRC location information (i.e., site addresses.) SMS communication for potential job applicants may include information about application status, training schedules and other employment relatedupdates. SMS communication with established vendors may include project status updates, requests for service and requests for quotes. Message and data rates may apply. You can opt-out at any time by texting 'STOP.' For assistance, text 'HELP' or visit our website at https://www.gatewayrehab.org.
c. GRC automatically collects information about a User’s computer, phone, tablet, or other devices a User uses to access the Services. This includes a User’s connection type and settings when a User installs, accesses, updates or uses GRC’s Services. GRC also collects information through a User’s device about the User’s operating system, browser type, IP address, URLs or referring/exit pages, device identifiers, and crash data. GRC may use a User’s IP address in order to approximate a User’s location to provide such User with a better Service experience. How much information GRC collects depends on the type and settings of the User’s device being used to access the Services. Users and/or their Server and data center service administrators can disable collection of this information via the administrator settings or prevent this information from being disclosed to GRC by blocking transmission at the local network level.
GRC also automatically collects information via GRC’s advertising and analytics partners, use of cookies and other tracking technologies such as web beacons, device identifiers, and pixels. For more information, please see our Cookies Policy, which includes information about how to control or opt out of these cookies and tracking technologies.
GRC may also receive information about a User from GRC’s affiliates, GRC’s business partners, other third party providers or from publicly available sources (such as social media platforms), including a User’s physical mailing address, job titles, email addresses, phone numbers, intent data or user behavior data, IP addresses and social media profiles for the purposes of advertising GRC’s services, delivering personalized communications, community events, community outreach programs, other assistance programs, and profiling.
Users who are uncertain about which Personal Data is required for the Services are welcome to contact GRC.
Users are solely responsible for any third-party Personal Data obtained, published or shared by such Users through the Services and confirm that they have the third party’s consent to provide such data to GRC.
In addition to the information contained in this Privacy Policy, GRC may provide the User with additional and contextual information concerning particular Services or the collection and processing of Personal Data upon request.
2. Use of Personal Data and Purpose Of Processing
GRC processes Personal Data, including sharing it with third parties, where
processing is necessary for the purposes of our legitimate commercial interests and performance of the Services as further described in this Section. GRC does not sell Personal Data that we collect.
The purposes for which each type of Personal Data is collected through the Services are as follows:
Providing the Services to Users
Performing analytics on the Services
Contacting the User. Such contact may include communicating with the User via email, SMS notification, phone call or such other methods as approved by a User.
Displaying content from external platforms
Managing contacts and sending messages
Performing platform services and hosting
Managing registration and authentication
Managing system logs and maintenance
Performing internal operations, such as improving the effectiveness of our Services
Conducting audits
Providing information to our representatives and advisors, such as our attorneys, accountants, and others to help us comply with legal, accounting, or security requirements
Transferring information as part of a merger or sale of the business
Resolving disputes between Users, customers and GRC
Protecting the rights, safety, and information of GRC, our customers and their members, and third parties
Complying with our legal obligations, responding to enforcement requests, protecting GRC’s rights and interests (or those of its Users or third parties) and detecting any malicious or fraudulent activity
Using information for research and development to improve or otherwise modify GRC by identifying trends, usage, activity patterns, areas of integration, and to improve our Services and to develop new functionalities, products, services, features and technologies to benefit GRC’s Users and the public.
Improving communication with Users and depending on a User’s chosen method of contact, GRC may send a User SMS notifications or call you.
Using information to resolve technical issues a User encounters, to response to a User’s request for assistance, to analyze crash information, and to repair and improve Services. Where a User provides express permission, we may disclose information to a third party expert for the purpose of responding to support-related requests.
Interacting with or disclosing information to third parties through the Services. For example, GRC may offer Users access embedded maps through Google Maps, log in to the Services via a third party service or interact with social media networks via links on the Services. When a User intentionally interacts with these third parties, GRC may disclose certain information to those third parties or receive information with those third parties, consistent with a User’s privacy settings on the third party services. A User should always check the privacy settings and notice these third party services to understand how those third parties may use a User’s information.
c. A User’s Personal Data may be used for legal purposes by GRC in court or in the stages leading to possible legal action arising from improper use of the Services. The User acknowledges and agrees that GRC may be required to reveal Personal Data upon request of public authorities.
GRC may use a User’s Personal Data to send a User communications (via email, SMS notification, phone call or such other methods as approved by a User).
GRC may aggregate, combine, anonymize and/or pseudonymize any data that we collect and process, including Personal Data. This may be done for the purpose of performing the Services, correcting data currently held by GRC, expanding data sets and research.
3. Who Can Access Personal Data Collected
GRC will only disclose Personal Data as set forth in this Privacy Policy, as permitted by law, or with the User’s consent. Where third parties are processing Personal Data on our behalf, they will be required to agree, by contractual means or otherwise, to process the Personal Data in accordance with applicable law and to act only on GRC’s instructions. Please note that information about a User, a User’s device, and a User’s behavior collected through third party cookies, pixels, tags, or other tracking technologies for purposes of cross-context behavioral advertising may be considered a “sale” or “share” under certain US state laws. However, GRC is not a data broker and GRC does not sell personal information for monetary consideration.
In addition to being accessible by GRC, in some cases, Personal Data may be accessible to certain types of persons involved with the operation of the Services (administration, sales, marketing, legal, system administration) or external parties (such as third party technical service providers, mail carriers, hosting providers, IT companies, communications agencies) appointed, if necessary, as Data Processors by GRC.
c. GRC may disclose Personal Data to the following entities and for the listed purposes:
Customers and Other Authorized Business Partners. For the purpose of providing the Services, GRC will share Personal Data with a User’s designated organization (i.e., GRC’s customer).
Employees. Only authorized employees have access to Personal Data.
Contractors and Service Providers. GRC employs other companies and individuals to perform functions on our behalf. Examples of such functions include fulfillment activities, sending postal mail and e-mail, removing repetitive information from customer lists, analyzing data, providing technical support and providing customer service. GRC may share Personal Data with these contractors and service providers as GRC deems necessary for such third parties to perform their functions related to the Services.
To Comply with Legal Process, Protect Company, or Enforce our Rights. GRC may further disclose Personal Data when it is necessary to: (i) conform to legal requirements or comply with legal processes; (ii) enforce or apply our conditions of use and other agreements; (iii) protect the rights, safety or property of GRC, our affiliates, our customers, service providers, Users or the public, or (iv) prevent a crime or protect national security (including exchanging information with other companies and organizations for fraud protection and credit risk reduction).
As Part of a Merger or Sale of Business. GRC may disclose or transfer Personal Data in connection with a substantial corporate transaction, such as the sale of our business, a divestiture, merger, consolidation, or asset sale, or in the unlikely event of bankruptcy.
4. Mode and Place of Processing Data
a. GRC takes appropriate security measures to prevent unauthorized access, disclosure, modification, or unauthorized destruction of Personal Data. GRC utilizes industry-accepted reasonable security practices and has implemented reasonable technical and organizational measures to protect the confidentiality, security and integrity of User’s Personal Data. The measures that GRC has implemented take into account the current available security technologies, cost, and risk presented by the type of Personal Data GRC processes. Although GRC uses reasonable security measures to help protect Personal Data against unauthorized disclosure or loss, GRC cannot guarantee the security of Personal Data transmitted to GRC over the Internet. While GRC strives to use commercially acceptable means to protect Personal Data, there is no guarantee that information may not be accessed, disclosed, altered or destroyed. If a User uses our server or data center, responsibility for securing storage and access to the information a User inputs into the Services rests solely with the User and not GRC. GRC strongly recommends that a User configures SSL to prevent interception of information transmitted over networks and to restrict access to the databases and other storage points used.
The processing of Personal Data is carried out using computers and/or IT-enabled tools, following organizational procedures and modes strictly related to the purposes indicated herein or through the Services.
GRC may process Personal Data relating to Users if one of the following applies:
Users have given their consent for one or more specific purposes. Note: Under some legislation, GRC may be allowed to process Personal Data
until the User objects to such processing (“opt-out”), without having to rely on consent or any of the other legal bases specified herein. This, however, does not apply whenever the processing of Personal Data is subject to European data protection law;
provision of data is necessary for the performance of an agreement with the User and/or for any pre-contractual obligations thereof;
• processing is necessary for compliance with a legal obligation to which GRC is subject;
processing is related to a task that is carried out in the public interest or in the exercise of official authority vested in GRC; or
processing is necessary for the purposes of the legitimate interests pursued by GRC or by a third party.
In any case, GRC will gladly help to clarify the specific legal basis that applies to the processing of a User’s Personal Data, and in particular whether the processing of Personal Data is a statutory or contractual requirement, or a requirement necessary to enter into a contract.
The Personal Data is processed at GRC’s operating offices and in any other places where the parties involved in the processing are located.
Depending on the User’s location, data transfers may involve transferring the User’s Personal Data to a country other than their own.
Users are entitled to learn about the legal basis of Personal Data transfers to a country outside the European Union or to any international organization governed by public international law or set up by two or more countries, such as the UN, and about the security measures taken by GRC to safeguard their Personal Data. 5. Retention of Personal Data
a. Personal Data shall be processed and stored for as long as required by the purpose(s) it has been collected for.
Personal Data collected for purposes related to the performance of a contract between GRC and the User (or User’s employer) shall be retained until such contract has been fully performed. Provided, however, GRC may also retain some of the User’s information as necessary to comply with GRC’s legal obligations, to resolve disputes, to enforce agreements, to support business operations, and to continue to develop and improve our Services. Where GRC retains information for Service improvement and development, GRC takes reasonable steps to eliminate information that directly identifies the User, and GRC does not use such information to specifically analyze personal characteristics about the User.
Personal Data collected for the purposes of GRC’s legitimate business interests shall be retained as long as needed to fulfill such purposes.
GRC may be allowed to retain Personal Data for a longer period whenever the User has given consent to such processing, as long as such consent is not withdrawn.
GRC may be obliged to retain Personal Data for a longer period whenever required to do so for the performance of a legal obligation or upon order of an authority.
Once the applicable retention period expires, Personal Data shall be deleted or de-identified. Therefore, the right to access, the right to erasure, the right to correct and the right to data portability cannot be enforced after expiration of the applicable retention period. Provided, however, it may not be possible to delete Personal Data. If deletion or de- identification is not possible (for example, because the information is stored in backup archives), then GRC will store a User’s information and isolate it from any further use until deletion is possible.
6. Rights of Users
Users may exercise certain rights regarding their Personal Data processed by GRC. A Users request may be limited in certain cases, for example, if fulfilling a User’s request would reveal information about another person or if a User asks to delete information that GRC is permitted by law or has compelling business reasons to keep.
In particular, Users have the right to do the following:
Withdraw their consent at any time. Users have the right to withdraw consent where they have previously given their consent to the processing of their Personal Data.
Object to processing of their Personal Data. Users have the right to object to the processing of their Personal Data if the processing is carried out on a legal basis other than consent.
Access their Personal Data. Users have the right to learn if their Personal Data is being processed by GRC, obtain disclosures regarding certain aspects of such processing and obtain a copy of the Personal Data undergoing processing.
Verify and seek rectification. Users have the right to verify the accuracy of their Personal Data and ask for it to be updated or corrected.
Restrict the processing of their Personal Data. Users have the right, under certain circumstances, to restrict the processing of their Personal Data. Where Users have and exercise such right, GRC will not process a User’s Personal Data for any purpose other than storing it.
Have their Personal Data deleted or otherwise removed. Users have the right, under certain circumstances, to obtain the erasure of their Personal Data from GRC. Please note, however, that GRC may retain certain information for record keeping purposes, to complete transactions, or to comply with GRC’s legal obligations.
Receive their Personal Data and have it transferred to another controller. Users have the right to receive their Personal Data in a structured, commonly used and machine readable format and, if technically feasible, to have it transmitted to another controller without any hindrance. This provision is applicable provided that the Personal Data is processed by automated means and that the processing is based on the User’s consent, on a contract which the User is part of or on pre-contractual obligations thereof.
Lodge a complaint. Users have the right to bring a claim before their competent data protection authority.
c. Where Personal Data is processed for a public interest, in the exercise of an official authority vested in GRC or for the purposes of the legitimate interests pursued by GRC, Users may object to such processing by providing grounds related to their particular situation to justify the objection.
d. Should a User’s Personal Data be processed for direct marketing purposes, they can object to that processing at any time without providing any justification. GRC does not process Personal Data collected for direct marketing purposes.
e. Any requests to exercise User rights can be directed to GRC through the contact details provided in this Privacy Policy.
7. Cookie Policy
a. When a User first accesses the Services from certain jurisdictions, the User will receive a message advising the User that cookies are in use. By clicking “accept”, the User agrees to GRC’s use of cookies as described in this Privacy Policy. If the User does not wish to receive cookies, the User may withdraw their consent or set their browser to reject cookies or to alert the User when a cookie is placed on their device. If the User withdraws consent, limits or disables the use of cookies when the User visits or uses the Services, the User may not be unable to use the full functionality of the Services. For more information about our specific use of cookies, please reference our “Cookie Policy,” which is attached as Schedule 1 (Cookie Policy) and incorporated herein by reference. GRC may also permit select third parties to use cookies to collect information about Users’ online activities across other websites or over time in order to assist us with Services analytics.
8. How “Do Not Track” Requests are Handled
a. The Services do not support “Do Not Track” requests. To determine whether any third-party services used by or linked to the Services honor “Do Not Track” requests, please read the privacy policies for those services.
9. Third Party Services
a. The Services may contain links to third party websites, applications and services not operated by GRC. These links are provided as a service and do not imply any endorsement by GRC of the activities or content of these websites, applications or services nor any association with their operators. GRC is not responsible for the privacy policies or practices of any third party including websites or services directly linked to or from our Services.
10. Information For Californian Consumers
a. The California Consumer Privacy Act of 2018 (“CCPA”) provides several rights to California residents with regards to the collection, disclosure, sale, and deletion of their Personal Data. The Campaign Registry California Privacy Notice set forth in Schedule 2 (California Privacy Notice) describes in more detail GRC’s compliance with CCPA and how residents of California may exercise their CCPA Rights. If a User has questions about exercising their CCPA Rights, please contact us as set out below.
11. Minors and Children’s Privacy
a. GRC does not knowingly collect Personal Data from children under the age of 18.
If GRC learns that Personal Data of persons younger than 18 years-of-age has been collected through the Services, GRC will take the appropriate steps to delete this information. If you are a parent or guardian and discover that your child or a minor under the age of 13 has posted, submitted or otherwise communicated Personal Data to GRC without your consent, then you may alert us at info@campaignregistry.com so that we may take appropriate action to remove the minor’s Personal Data from our systems.
12. Definitions
“Data Processor”: The natural or legal person, public authority, agency or other body which processes Personal Data on behalf of the controller, as described in this privacy policy.
“Data Subject”: The natural person to whom the Personal Data refers.
“Usage Data”: Information collected automatically through the Services (or third-party services utilized for the Services), which can include: the IP addresses or domain names of the computers utilized by the Users who use the Services, the URI addresses (Uniform Resource Identifier), the time of the request, the method utilized to submit the request to the server, the size of the file received in response, the numerical code indicating the status of the server’s answer (successful outcome, error, etc.), the country of origin, the features of the browser and the operating system utilized by the User, the various time details per visit (e.g., the time spent on each page within the Services) and the details about the path followed within the Services with special reference to the sequence of pages visited, and other parameters about the device operating system and/or the User’s IT environment.
“User”: The individual using the Services who, unless otherwise specified, coincides with the Data Subject.
13. Miscellaneous
This privacy statement has been prepared based on provisions of multiple legislation, including Art. 13/14 of Regulation (EU) 2016/679 (General Data Protection Regulation).
More details concerning the collection or processing of Personal Data may be requested from GRC at any time. Please see our contact information for inquiries.
Changes to this Privacy Policy
i. GRC reserves the right to make changes to this Privacy Policy at any time and we will make changes to this Privacy Policy as we determine to be necessary and appropriate from time to time. We always indicate the date the last changes were published and we offer access to archived versions for your review. If changes are significant, we will provide a more prominent notice (including, for certain services, email notification of
Privacy Policy changes – as far as technically and legally feasible – and provided that the User’s email contact information has been provided and is available to GRC. Users are strongly recommended to check the Services often, referring to the date at the top of this Privacy Policy for the last modification date.
Should changes to this Privacy Policy affect processing activities performed on the basis of the User’s consent, GRC will attempt to collect a new consent from the User, where required and to the extent GRC has been provided the User’s email address and such email address remains valid at the time of such changes. However, the User is encouraged to review GRC’s Privacy Policy whenever the User uses the Services to stay informed about our information practices and the ways you can help protect your privacy.
If the User disagrees with any changes to this Privacy Policy, the User will need to stop using the Services and deactivate the User’s account(s).
d. Contact Information for GRC/Data Controller
Gateway Rehabilitation Centers, 311 Rouser Rd, Moon Township, PA 15108
GRC contact email: info@gatewayrehab.org