WEBSITE PRIVACY POLICY

2026 Update: Compliance with CCPA/CPRA & CalOPPA for site visitors.

---

PRIVACY POLICY

Effective Date: January 1, 2026

1. INTRODUCTION

Brightwork ABA Therapy, Inc. ("Brightwork," "we," or "us") respects your privacy. This Privacy Policy describes the types of information we may collect from you or that you may provide when you visit the website www.bright.work and its subdomains (the "Site") and our practices for collecting, using, maintaining, protected, and disclosing that information.

Please Note: This policy applies to website visitors. If you are a current or prospective patient, your medical information is governed by our Notice of Privacy Practices (HIPAA), which is provided to you at intake.

2. INFORMATION WE COLLECT

We adhere to a standard of data minimization. We collect strictly what is necessary to operate the Site and respond to inquiries.

• Information You Provide: We collect information you knowingly provide, such as your name, email address, and phone number when you submit a "Contact Us" form or join a waitlist.
• Automatic Data Collection: As you navigate the Site, we may use automatic data collection technologies (such as cookies and server logs) to collect certain information about your equipment, browsing actions, and patterns, including:
  • Your IP address.
  • Operating system and browser type.
  • Traffic data and location data.

3. USE OF YOUR INFORMATION

We use information that we collect about you or that you provide to us:

• To present our Site and its contents to you.
• To provide you with information or services that you request from us.
• To fulfill our obligations and enforce our rights arising from any contracts entered into between you and us.
• To notify you about changes to our Site or services.
• To detect and prevent fraud or security incidents.

4. DISCLOSURE OF YOUR INFORMATION

We do not sell, trade, or rent your personal information to third parties. We may disclose aggregated information about our users, and information that does not identify any individual, without restriction. We may disclose personal information that we collect or you provide:

• To Service Providers: To contractors, service providers, and other third parties we use to support our business (e.g., hosting providers, IT support) who are bound by contractual obligations to keep personal information confidential.
• Legal Requirements: To comply with any court order, law, or legal process, including to respond to any government or regulatory request.
• Enforcement: To enforce or apply our terms of use and other agreements.

5. CALIFORNIA PRIVACY RIGHTS

A. California Online Privacy Protection Act (CalOPPA)

• Do Not Track Signals: We do not currently respond to browser "Do Not Track" (DNT) signals.
• Third-Party Tracking: We do not allow third parties to collect personally identifiable information about your online activities over time and across different websites when you use our Site.

B. California Consumer Privacy Act (CCPA)

As a healthcare provider, the majority of the personal information we collect is Protected Health Information (PHI) governed by HIPAA, which is exempt from the CCPA. For non-exempt data collected from California residents (such as general website visitor data), you may have the right to request access to or deletion of your personal information. To exercise these rights, please contact us at privacy@bright.work.

6. DATA SECURITY

We have implemented measures designed to secure your personal information from accidental loss and from unauthorized access. However, the transmission of information via the internet is not completely secure. We cannot guarantee the security of your personal information transmitted to our Site. Any transmission of personal information is at your own risk.

7. CONTACT INFORMATION

To ask questions or comment about this privacy policy and our privacy practices, contact us at: