Privacy Policy ABA Navigator

1. Who We Are

ABA Navigator ("we," "our," or "us") runs abanavigator.com (the "Service"), a directory that helps families find Applied Behavior Analysis (ABA) therapy providers and helps providers be found.

This policy explains what information we collect when you use the Service, how we use it, who we share it with, how long we keep it, and the choices and rights you have. ABA Navigator is a directory, not a health care provider. When you contact a provider through the Service, that provider's own privacy practices apply to what it receives.

2. Information We Collect

A. Information you give us

• Inquiries to a provider: your name, email address, phone number, your child's name and age, a diagnosis if you choose to share one (for example, autism or suspected autism), your location, how you heard about us, and your message.
• Matching quiz: the answers you give, such as your child's age, your insurance, your ZIP code or city, and the kind of care you are looking for, and your email address if you ask us to send you the results.
• Reviews: your name, rating, and review text.
• Contact forms and email: your name, email address, and what you write to us.
• Newsletter: your email address.
• Provider accounts: name, email address, phone number, business details, credentials, NPI numbers, service areas, insurance accepted, and the information you submit to claim or verify a listing. Paid plans are billed through Stripe. We do not store full card numbers.

B. Information collected automatically

• Device and usage information: your IP address, browser type, the pages you visit, and the page that sent you to us. Our servers and our network provider record this to run and protect the Service.
• Search activity: the searches you run on the Service, such as a location or a type of therapy.
• Form security information: when you post a review, send a message or an inquiry, or claim a listing, we record your IP address, your browser type, and the page you came from. We use this only to check for spam, fake reviews, and false ownership claims.
• Cookies: described in section 3.

C. Information from other sources

We build provider listings from public sources, such as provider websites, public business directories, and professional registries, and from what providers tell us. We may also hear from a provider about the status of an inquiry you sent them.

3. Cookies and Similar Technologies

We use two categories of cookies. We do not use advertising or marketing cookies, and we do not run ads that track you across other websites.

• Necessary: cookies the Service cannot work without, such as sign-in sessions, security tokens that protect forms, the cookie that remembers your privacy choice, and security checks from our network provider (Cloudflare). These are always on.
• Analytics: Google Analytics and PostHog, which help us understand which pages families find useful. Analytics is optional. For visitors in Washington, Nevada, Connecticut, the European Economic Area, the United Kingdom and Switzerland, analytics stays off unless you turn it on. For other visitors in the United States, Google Analytics may be on until you turn it off. PostHog only records a page view after you have turned analytics on.

You can change your choice at any time with the cookie banner or the "Cookie settings" link at the bottom of every page, which opens the "Choices" panel. You can also block or delete cookies in your browser settings, although parts of the Service may stop working if you block necessary cookies.

We used Microsoft Clarity session recording in the past. It is turned off, and we will not turn it back on unless you have agreed to analytics.

4. Services That Receive Information When You Use the Site

Some pages load content or services from other companies. When they do, your browser connects to that company, which sees your IP address, your browser type, and the page you are on.

• Cloudflare delivers and protects the whole site, and runs Cloudflare Turnstile, a check on some forms that tells people and bots apart.
• Google Maps shows provider locations on provider pages.
• Google Analytics (only as described in section 3).
• PostHog receives page views from our server after you turn analytics on. For provider accounts, we also send PostHog account and plan events, such as starting an upgrade, without email addresses, phone numbers or card details.
• Fonts and code libraries: some pages load fonts from Google Fonts and code from public content delivery networks (such as cdnjs, jsDelivr and unpkg). We are moving these files onto our own servers.
• Sentry receives error reports when something breaks, so we can fix it. It is set up not to receive personal information, and we remove email addresses, IP addresses and form contents from reports before they are sent.

5. How We Use Information

• To run the directory: to show providers that fit your location, insurance and needs, and to deliver your inquiry to the provider you chose.
• To communicate: to answer your messages, send the results you asked for, send service messages about your account, send newsletters you signed up for, and email providers about their listings.
• To improve the Service: to understand, in aggregate, which pages and features are useful.
• To keep the Service safe: to prevent spam, fraud, fake reviews, and false listing claims.
• To meet legal obligations.

6. How We Share Information

• With the provider you contact: when you send an inquiry, we send it to that provider so they can contact you. If the provider has not yet claimed its listing, your inquiry comes to the ABA Navigator team, and we may pass it on to that provider for you. We do not send your inquiry to providers you did not choose.
• Public content: reviews you post, and provider business information, are shown publicly on the Service.
• Service providers: companies that work for us under contract: our hosting company, Cloudflare, our email service providers, Stripe (payments), Sentry (error monitoring), PostHog and Google Analytics (analytics, as described above), and AI service providers that help our team sort, moderate, and draft replies to messages and submissions.
• Legal reasons: when the law requires it, or to protect the rights and safety of our users, providers, or ABA Navigator.
• Business transfers: if ABA Navigator is merged, acquired or sold, information may pass to the new owner, who must honor this policy.

We do not sell personal information, and we do not share it for targeted or cross-context behavioral advertising.

7. Do Not Track and Global Privacy Control

Global Privacy Control (GPC): if your browser sends a GPC signal, we treat it as your request to opt out, and we keep analytics off for that browser.

Do Not Track: there is no common standard for how websites should respond to a browser's "Do Not Track" setting, so the Service does not change its behavior when it receives one. Use the privacy choices above or GPC instead. We do not allow other companies to track you across websites through the Service.

8. How Long We Keep Information

• The IP address, browser type and referring page recorded with reviews, messages, inquiries and listing claims are deleted after 12 months. The submission itself (for example, a review) may stay longer.
• Provider account and listing information is kept while the account or listing is active, and then as long as we need it for legal, tax, and dispute purposes.
• Other information is kept only as long as we need it for the purposes in this policy, and is then deleted or de-identified.

9. Your Rights and Choices

A. Choices for everyone

• Access, correction and deletion: ask for a copy of your information, or ask us to correct or delete it.
• Email: every newsletter and outreach email has an "Unsubscribe" link. We stop sending those emails to your address once you use it. Account and service messages, such as password resets and receipts, are still sent.
• Analytics: turn analytics off at any time, as described in section 3.

B. Residents of states with privacy laws

If you live in a state with a consumer privacy law (including California, Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah and Virginia), you may have the right to:

• know what personal information we collect, use and disclose, and get a copy of it in a portable format;
• correct inaccurate personal information;
• delete personal information;
• opt out of the sale of personal information, targeted advertising, and profiling (we do none of these);
• limit our use of sensitive personal information, or, where the law requires, have us use it only with your consent;
• appeal our decision on your request; and
• use these rights without being treated differently.

Washington and Nevada residents have additional rights over consumer health data, described in our Consumer Health Data Privacy Policy.

C. How to make a request

Email [email protected] with "Privacy request" in the subject line, and tell us what you would like us to do. We will confirm your identity, usually by writing to the email address we have for you, and we respond within 45 days. If we need more time, we will tell you why, and we may take up to 45 more days where the law allows. You may use an authorized agent, and we may ask the agent for proof that you gave them permission.

If we decline your request, you can appeal by replying with "Appeal" in the subject line. We will answer your appeal within the time your state's law requires. If you are not satisfied, you can contact your state attorney general.

10. Children's Privacy

The Service helps families find care for children, but it is meant to be used by adults, such as parents and guardians. Information about a child comes from the adult who provides it. We do not knowingly collect personal information directly from children under 13. If you believe a child has given us personal information, contact us and we will delete it.

11. User-Generated Content and Provider Listings

A. Definition and Scope

"User-Generated Content" (UGC) includes all content you upload, post, or transmit through the Service, such as reviews, testimonials, provider profiles, photos, comments, and submitted articles and resources.

B. Responsibility for Content

ABA Navigator acts only as a venue. We do not endorse or assume liability for UGC. You are solely responsible for the accuracy and legality of your content. We reserve the right (but not the obligation) to screen, edit, or remove any UGC at any time.

C. Warranties and Representations

By submitting UGC, you warrant that the content is accurate, does not violate any laws or third-party rights, and is not defamatory or objectionable.

D. License Grant to ABA Navigator

You grant ABA Navigator a perpetual, irrevocable, worldwide, royalty-free license to use, modify, distribute, display, and create derivative works of your UGC for operating and promoting the Service.

E. Content from Editors and Staff

Articles, guides, and resources created by our staff or contributors are for informational purposes only and do not constitute medical, therapeutic, or legal advice.

12. Data Security

We use technical and organizational measures to protect your information, including encrypted connections and access controls. No method of sending or storing information over the internet is completely secure.

13. Links to Other Websites

The Service links to other websites, such as provider websites and insurance portals. We are not responsible for their privacy practices. Please review their policies.

14. Changes to This Policy

We will update this policy when our practices change, and change the "Last updated" date above. If a change is significant, we will say so on the Service or by email before it takes effect.

15. Contact Us

Questions about this policy or our data practices: