Privacy Policy

Last Updated: August 11, 2025

This Privacy Policy (“Policy”) explains Community Autism Services’ (“CAS,” “we,” “us,” or “our”) privacy practices for the activities described below. Please read this Policy carefully to understand how we collect, use, share, and protect personal information, and to learn about your rights and choices.

By using our websites, mobile applications, or any online or mobile site or application that we own or control (collectively, our “Sites”), and/or by agreeing to this Policy (for example, when utilizing any of our products or services), you acknowledge and consent to the collection, processing, use, and sharing of personal information as described here.

Personal Information We Collect

We may collect personal information in the course of providing services, interacting with you, or operating our business. The types of information we collect depend on your interactions with us and may include:

• Name, address, email address, and phone number
• Date of birth, age, and gender
• Social Security number and other government identifiers
• Payment and billing information (including insurance details)
• Protected health information (PHI)
• Other personal details you provide to us directly or that we obtain about you

Information You Provide

We collect information you share with us, such as when you request information, use our Sites, purchase services, create an account, communicate with our team, or respond to surveys.

Information from Other Sources

We may obtain information from:

• Healthcare providers, health plans, and other covered entities
• Schools attended by you or your child
• State and federal agencies (e.g., IRS, Medicare/Medicaid)
• Credit bureaus and background check agencies
• Social media networks
• Publicly available sources

Information Collected Automatically

When you use our Sites, we may automatically collect device and usage data, including IP address, browser type, operating system, referring/exit pages, and interactions with our content. We may use cookies, web beacons, and similar technologies to gather this information. You can manage cookies via your browser settings; more information is available at www.allaboutcookies.org.

How We Use Personal Information

We may use your information to:

• Communicate with you and deliver services
• Complete contracts and comply with legal requirements
• Improve our products, services, and user experience
• Process applications, payments, and requests
• Send marketing communications and surveys (with opt-out options)
• Personalize your experience with our Sites and services
• Conduct research, analytics, and quality assurance
• Protect against fraud, security threats, or legal claims
• Fulfill any purpose with your consent

We may also use aggregated or de-identified data for any lawful purpose.

How We Share Personal Information

We may share information with:

• Service Providers assisting with operations, including IT, staffing, analytics, and payment processing
• Government agencies and law enforcement when required by law
• In special circumstances, such as fraud prevention, legal compliance, or security incidents
• In corporate transactions, such as mergers or asset sales
• With your consent or at your direction

Protected Health Information (PHI) and HIPAA Compliance

CAS is a Covered Entity under the Health Insurance Portability and Accountability Act (HIPAA). We are committed to protecting the privacy and confidentiality of PHI we collect and maintain in connection with our healthcare services.

Our HIPAA compliance includes:

• Use and disclosure of PHI only as permitted or required by law, or with your written authorization
• Patient rights under HIPAA, including the right to:
  • Access and obtain a copy of your PHI
  • Request corrections to your PHI
  • Request restrictions on certain uses and disclosures
  • Receive confidential communications
  • Receive an accounting of disclosures of your PHI
• Breach Notification Rule compliance — if there is a breach of unsecured PHI, we will notify affected individuals in accordance with HIPAA requirements
• Clear distinction between PHI and other personal information collected via our Sites — PHI is governed by HIPAA; other personal information is governed by this general Privacy Policy

Notice of Privacy Practices: For a full explanation of how CAS uses, discloses, and protects your PHI, please review our Notice of Privacy Practices.

Educational Records and FERPA Compliance

When we provide services in schools, we comply with the Family Educational Rights and Privacy Act (FERPA) and any applicable contracts with school districts.

Children’s Privacy

Our Sites are not intended for children under 16, and we do not knowingly collect personal information from them. If you believe we have done so, contact us immediately at cas.privacy@ssg-healthcare.com

Do Not Track

We do not respond to “Do Not Track” browser signals. More information is available at www.allaboutdnt.com.

Analytics Services

We use Google Analytics and similar tools to understand website usage. You can review Google’s privacy policy here and opt out here.

Security

We use reasonable physical, technical, and administrative measures to protect information, but no system is 100% secure. We cannot guarantee security during transmission over the internet.

Data Retention

We retain personal information for as long as necessary to provide services, comply with laws, and fulfill legitimate business needs.

Marketing Communications

To opt out of marketing emails, contact cas.privacy@ssg-healthcare.com or follow the “unsubscribe” instructions in any marketing email. We may still send important administrative or service-related messages.

SMS/Text Messaging Terms

By providing your phone number to Community Autism Services, you consent to receive text messages for service or informational purposes. Message and data rates may apply. Reply “STOP” to opt out. We do not share text messaging consent data with third parties for marketing.

U.S. Residents Only

Our Sites and services are intended for U.S. residents. By using our Sites, you confirm you are not located in the European Union and consent to the transfer and processing of your information in the U.S.

Changes to This Policy

We may update this Policy from time to time. The “Last Updated” date at the top indicates when changes were made. Your continued use of our services after changes are posted constitutes acceptance of the updated Policy.

Contact Us

If you have questions or want to exercise your rights regarding your personal information, contact us at:

Community Autism Services
Attn: Privacy Officer
184 High Street
Boston, MA 02110
Email: cas.privacy@ssg-healthcare.com