Legal

Privacy Policy

How Archways ABA collects, uses, and protects your information.

Effective Date: March 1, 2025  |  Last Updated: April 12, 2026

This Privacy Policy describes how Archways ABA, LLC ("Archways ABA," "we," "us," or "our") collects, uses, discloses, and safeguards information when you visit our website at archwaysaba.com (the "Site") or contact us about our Applied Behavior Analysis (ABA) therapy services. Please read this policy carefully. If you disagree with its terms, please discontinue use of the Site.

1. Information We Collect

1.1 Information You Provide Directly

When you use our contact forms, intake request form, provider referral form, or newsletter subscription, we may collect:

  • Your name and the name of the child or patient you are inquiring about
  • Email address, phone number, and mailing address
  • county of residence
  • Child's age range and, if applicable, diagnosis or ICD-10 code
  • Insurance carrier and coverage information
  • Preferred service type (in-home, center-based, telehealth)
  • Clinical notes or reason for referral (provider referrals)
  • How you heard about us
  • Any other information you voluntarily include in a message or form field

1.2 Information Collected Automatically

When you visit our Site, certain information is collected automatically by our analytics provider (Google Analytics). This may include:

  • IP address (anonymized)
  • Browser type and version
  • Device type and operating system
  • Pages visited and time spent on each page
  • Referring URL (how you arrived at our Site)
  • General geographic region (city/state level, not precise location)

We do not collect precise geolocation data. See Section 6 for details on Google Analytics.

1.3 Information We Do Not Collect Through This Site

Our public website does not collect, store, or transmit formal Protected Health Information (PHI) as defined under HIPAA. Clinical and treatment records are maintained in separate, HIPAA-compliant systems used directly with active clients and their authorized caregivers. See Section 4 for more on HIPAA.

2. How We Use Your Information

We use the information we collect to:

  • Respond to intake requests, provider referrals, and general inquiries
  • Contact you regarding your interest in Archways ABA services
  • Verify insurance eligibility and coordinate the onboarding process
  • Send the newsletter you requested (you may unsubscribe at any time)
  • Improve the content, functionality, and user experience of our Site
  • Monitor and analyze Site traffic and usage patterns (via Google Analytics)
  • Prevent fraud and ensure the security of our Site
  • Comply with applicable law, regulations, and legal process

We do not use your information for automated decision-making or profiling that produces legal or similarly significant effects.

3. How We Share Your Information

We do not sell, rent, or trade your personal information to third parties. We may share information only in the following limited circumstances:

3.1 Service Providers

We work with a small number of trusted third-party service providers who process data on our behalf, including:

  • Formspree - processes form submissions on our behalf (see Section 7)
  • Google LLC - provides website analytics (see Section 6)
  • Web hosting and content delivery providers

These providers are contractually bound to protect your information and may only use it to perform services for us.

3.2 Legal Obligations

We may disclose your information if required to do so by law, court order, subpoena, or government authority, or if we believe in good faith that disclosure is necessary to protect the safety of any person, prevent fraud, or enforce our legal rights.

3.3 Business Transfers

If Archways ABA is acquired by or merged with another entity, your information may be transferred as part of that transaction. We will notify you via a prominent notice on our Site if this occurs and your information becomes subject to a different privacy policy.

3.4 With Your Consent

We may share your information for any other purpose with your explicit prior consent.

4. HIPAA Notice of Privacy Practices

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

Archways ABA, LLC is a HIPAA-covered healthcare provider. We are required by law to maintain the privacy of your Protected Health Information (PHI), to provide you with this notice of our legal duties and privacy practices, and to abide by the terms of the notice currently in effect.

This public website is not a patient portal and does not transmit formal PHI. Active clients and their authorized guardians receive this Notice at the time services begin, as required by the HIPAA Privacy Rule (45 C.F.R. Part 164). Any health-related information submitted through this website's inquiry forms is treated with the same protections described below.

4.1 What Is Protected Health Information?

Protected Health Information (PHI) is individually identifiable health information that relates to your (or your child's) past, present, or future physical or mental health or condition, the provision of health care, or payment for health care. PHI includes names, dates of service, diagnoses, treatment plans, insurance information, and other identifying details.

4.2 How We May Use and Disclose PHI

Treatment. We may use and disclose PHI to provide, coordinate, or manage your child's ABA therapy. For example, we may share information with treating BCBAs, RBTs, or other healthcare providers involved in your child's care.

Payment. We may use and disclose PHI to obtain payment for services, including submitting claims to your insurance carrier, verifying eligibility, obtaining prior authorization, and responding to coverage determinations.

Healthcare Operations. We may use and disclose PHI for internal operations such as quality improvement, staff training, audits, accreditation activities, and business management necessary to operate our practice.

We may also use or disclose PHI without your authorization as permitted or required by law, including:

  • Required by Law: When required by federal, state, or local law.
  • Public Health Activities: To authorized public health authorities for disease or injury prevention.
  • Abuse and Neglect Reporting: To report suspected child abuse or neglect to the appropriate government authority as required by Missouri law.
  • Health Oversight Activities: To oversight agencies for audits, inspections, investigations, or licensing.
  • Judicial and Administrative Proceedings: In response to a court order, subpoena, or other lawful process.
  • Law Enforcement: To law enforcement officials for limited purposes as permitted by HIPAA.
  • Coroners and Medical Examiners: To identify a deceased person or determine cause of death.
  • Organ and Tissue Donation: To organ procurement organizations for transplantation purposes.
  • Serious Threats to Health or Safety: To prevent or lessen a serious and imminent threat to a person or the public.
  • Workers' Compensation: As authorized and necessary for workers' compensation programs.
  • Business Associates: To vendors who perform services on our behalf under a signed Business Associate Agreement (BAA) requiring them to protect PHI.

Uses Requiring Your Written Authorization. All other uses and disclosures of PHI require your written authorization, including use for marketing purposes, sale of PHI, and psychotherapy notes. You may revoke any authorization in writing at any time, except to the extent we have already acted in reliance on it.

4.3 Your Rights Regarding PHI

You (or your child's authorized representative) have the following rights:

  • Right to Inspect and Copy: You may request access to and copies of PHI we maintain in a designated record set. We may charge a reasonable, cost-based fee. We will respond within 30 days.
  • Right to Amend: If you believe PHI we hold is inaccurate or incomplete, you may request an amendment in writing. We will respond within 60 days. We may deny the request if the information was not created by us, is not in our designated record set, or is accurate and complete.
  • Right to an Accounting of Disclosures: You may request a list of certain disclosures we have made of your PHI (other than for treatment, payment, and operations) within the six years prior to your request.
  • Right to Request Restrictions: You may request limits on how we use or disclose PHI for treatment, payment, or operations. We are not required to agree unless the restriction involves a health plan disclosure and you have paid out-of-pocket in full for the service.
  • Right to Request Confidential Communications: You may request that we contact you through a specific method or at a specific location (e.g., email only or an alternate address). We will accommodate all reasonable requests.
  • Right to a Paper Copy of This Notice: You may request a paper copy of this Notice at any time, even if you agreed to receive it electronically.
  • Right to Notification of a Breach: You have the right to be notified following a breach of unsecured PHI affecting you, pursuant to the HIPAA Breach Notification Rule (45 C.F.R. Part 164, Subpart D).

To exercise any of the rights above, submit a written request to our Privacy Officer at info@archwaysaba.com or (314) 668-2866.

4.4 Our Duties

Archways ABA is required by law to:

  • Maintain the privacy of PHI
  • Provide you with notice of our legal duties and privacy practices with respect to PHI
  • Abide by the terms of the notice currently in effect
  • Notify you following a breach of unsecured PHI

We reserve the right to change this notice and make the revised terms effective for all PHI we maintain. Any revised notice will be posted on this website with an updated effective date.

4.5 How to File a Complaint

If you believe your privacy rights have been violated, you may file a complaint with:

  • Archways ABA Privacy Officer
    Email: info@archwaysaba.com
    Phone: (314) 668-2866
  • U.S. Department of Health and Human Services, Office for Civil Rights (OCR)
    Website: hhs.gov/ocr/privacy/hipaa/complaints
    Phone: 1-800-368-1019 (TDD: 1-800-537-7697)
    Mail: 200 Independence Ave., S.W., Washington, D.C. 20201

We will not retaliate against you for filing a complaint.

4.6 Effective Date

This Notice of Privacy Practices is effective as of March 1, 2025.

5. COPPA - Children's Privacy

Archways ABA provides services to children; however, our website is directed at parents, guardians, and healthcare providers - not at children themselves.

We do not knowingly collect personal information directly from children under the age of 13. All information submitted through our intake and referral forms must be provided by a parent, legal guardian, or licensed healthcare professional acting on behalf of a patient.

If you believe we have inadvertently collected personal information from a child under 13 without verifiable parental consent, please contact us immediately at info@archwaysaba.com and we will delete such information promptly.

This policy is consistent with the Children's Online Privacy Protection Act (COPPA), 15 U.S.C. § 6501 et seq., and the FTC's COPPA Rule, 16 C.F.R. Part 312.

6. Google Analytics

Our Site uses Google Analytics 4 (GA4), a web analytics service provided by Google LLC ("Google"). Google Analytics uses cookies and similar tracking technologies to collect and report aggregate, anonymized information about how visitors use our Site.

What Google Analytics Collects

  • Pages visited, click paths, and session duration
  • General device and browser information
  • Approximate geographic region (not precise location)
  • Traffic source (e.g., organic search, direct, referral)

IP Anonymization

We have configured Google Analytics with IP anonymization enabled, meaning the last octet of your IP address is masked before any data is stored. We do not use the advertising or demographic features of Google Analytics.

Opting Out

You may opt out of Google Analytics tracking by:

  • Installing the Google Analytics Opt-out Browser Add-on
  • Enabling "Do Not Track" signals in your browser (note: not all sites honor this signal)
  • Using a browser extension that blocks analytics scripts

Google's privacy policy is available at policies.google.com/privacy.

7. Formspree - Contact Forms

Our contact, intake, and provider referral forms are processed by Formspree, Inc., a third-party form submission service. When you submit a form on our Site, your submission data is transmitted to Formspree's servers and then forwarded to our team.

Formspree may store submitted data temporarily on its servers in accordance with its own privacy policy, available at formspree.io/legal/privacy-policy. We have a data processing agreement with Formspree governing its handling of any personal data submitted through our forms.

We use a honeypot field on all forms to detect and discard automated spam submissions. This field is invisible to human users and captures no personal information.

SMS / Text Message Communications

By providing your phone number and checking the SMS opt-in box on our contact forms, you agree to receive conversational SMS messages from Archways ABA regarding inquiries, service updates, and appointment reminders.

  • Message frequency varies based on your inquiry and service needs.
  • Message and data rates may apply depending on your mobile carrier.
  • Reply HELP for help or contact us at (314) 668-2866.
  • Reply STOP at any time to opt out of SMS messages.
  • SMS consent is never shared with or sold to third parties.
  • Opting out of SMS does not affect your ability to receive services.

For questions about our SMS communications, contact us at info@archwaysaba.com or (314) 668-2866.

8. Cookies and Tracking Technologies

Our Site uses the following types of cookies and similar technologies:

Strictly Necessary Cookies

These cookies are required for the Site to function and cannot be disabled. They do not store personally identifiable information and are typically set in response to user actions such as submitting a form.

Analytics Cookies

Set by Google Analytics to collect aggregate, anonymized data about how visitors use our Site. These cookies help us understand which pages are most popular and where visitors come from, allowing us to improve our content.

Key analytics cookies include:

  • _ga - Distinguishes unique users. Expires after 2 years.
  • _ga_[ID] - Maintains session state. Expires after 2 years.

Managing Cookies

Most web browsers allow you to control cookies through browser settings. You can instruct your browser to refuse all cookies or to indicate when a cookie is being sent. Note that disabling certain cookies may affect the functionality of our Site. For more information on managing cookies, visit allaboutcookies.org.

9. Data Retention

We retain the information you submit through our contact and intake forms for as long as necessary to respond to your inquiry and fulfill the purpose for which it was collected, or as required by applicable law.

  • Intake and referral inquiries - Retained for up to 3 years or until the inquiry is resolved, whichever is later.
  • Newsletter subscriptions - Retained until you unsubscribe.
  • Google Analytics data - Retained for 14 months in accordance with our GA4 data retention settings.

Records related to active clients are governed by our HIPAA policies and applicable Missouri state law, which may require longer retention periods for medical records.

10. Security

We take the security of your information seriously and implement a variety of technical and administrative measures to protect it, including:

  • TLS/SSL encryption for all data transmitted between your browser and our Site (HTTPS)
  • Restricting access to personal information to authorized employees and contractors only
  • Using reputable third-party service providers with their own security certifications
  • Regularly reviewing and updating our security practices

However, no method of transmission over the Internet or electronic storage is 100% secure. While we strive to protect your personal information using commercially reasonable means, we cannot guarantee its absolute security. If you believe your information has been compromised, please contact us immediately.

11. Third-Party Links

Our Site may contain links to external websites, including provider directories, insurance company portals, and professional resources. These third-party sites have their own privacy policies, and we have no responsibility or liability for their content, practices, or policies. We encourage you to review the privacy policy of any third-party site you visit.

12. Your Rights and Choices

Depending on your location and applicable law, you may have the following rights regarding your personal information:

Access and Correction

You may request access to the personal information we hold about you and ask us to correct any inaccuracies. To make such a request, contact us at info@archwaysaba.com.

Deletion

You may request that we delete personal information we have collected from you, subject to certain exceptions (such as legal obligations or active client records). We will respond to deletion requests within 30 days.

Opt-Out of Marketing

You may opt out of marketing or newsletter emails at any time by clicking the "unsubscribe" link in any email we send or by contacting us directly. We will process your request within 10 business days.

Do Not Sell My Information

We do not sell personal information. We have not sold personal information in the past 12 months, and we do not intend to do so in the future.

HIPAA Rights

If you are an active client or the parent/guardian of an active client, you have specific rights under HIPAA with respect to your Protected Health Information, including the right to access, amend, and receive an accounting of disclosures. These rights are described in the Notice of Privacy Practices provided to you at intake.

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other reasons. When we make material changes, we will update the "Last Updated" date at the top of this page. We encourage you to review this Policy periodically to stay informed about how we protect your information.

Your continued use of the Site after any changes to this Policy constitutes your acceptance of the updated terms.

14. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our privacy practices, please contact us:

Archways ABA, LLC
Privacy Officer
info@archwaysaba.com
(314) 668-2866
Missouri, United States

We will respond to all privacy-related requests within 30 days of receipt.

Questions About Your Privacy?

We're happy to explain how we handle your information. Reach out anytime.