Privacy Policy & Notice of Privacy Practices

Effective Date: July 8, 2026

This page has two parts. Part 1 is our general website Privacy Policy, covering how we handle data from website visitors, inquiries, and SMS opt-ins. Part 2 is our HIPAA Notice of Privacy Practices, which specifically describes how we use and protect your medical and health information as a patient.

Part 1: Website Privacy Policy

Welcome to North Coastal Care (“Company,” “we,” “our,” or “us”). Your privacy is important to us, and we are committed to protecting your personal information. This Privacy Policy explains how we collect, use, and protect your data when you interact with our website, services, and digital offerings (collectively, “Services”).

1. Information We Collect

We may collect the following types of information:

Personal Information: Name, email address, phone number, and other contact details provided voluntarily through forms, inquiries, or subscriptions.
Usage Data: IP address, browser type, operating system, pages visited, session duration, and other technical data.
Cookies & Tracking Technologies: We use cookies and similar technologies to enhance user experience and analyze website traffic.

2. How We Use Your Information

We use the information collected to:

Provide and improve our services.
Respond to inquiries and customer support requests.
Send appointment reminders, scheduling updates, and account notifications (see Section 6, SMS Terms).
Send newsletters or marketing communications, where applicable (you may opt out at any time).
Analyze trends, user behavior, and website performance.
Detect and prevent fraud, security risks, and abuse.
Comply with legal obligations and regulatory requirements.

3. Sharing of Information

We do not sell, rent, or trade your personal data. We may share your information with:

Service Providers: Trusted third parties that assist with website hosting, analytics, scheduling, or communications (e.g., our phone/SMS service provider).
Legal & Compliance: If required by law, court order, or to protect our rights and safety.
Business Transfers: In the event of a merger, sale, or transfer of assets, your data may be transferred as part of the transaction.

No personal information, mobile phone number, or messaging consent information is shared with third parties or affiliates for marketing or promotional purposes.

Do Not Share — SMS Opt-In Data: No mobile or messaging consent information will be shared with third parties/affiliates for marketing/promotional purposes. All the above categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties.

4. HIPAA & Protected Health Information

As a healthcare provider, North Coastal Care maintains protected health information (“PHI”) in accordance with the Health Insurance Portability and Accountability Act (HIPAA).

This Part of the page addresses our general website, administrative, and communications data practices. It does not replace, and should not be relied on in place of, Part 2 of this page, our HIPAA Notice of Privacy Practices, which describes how your medical and health information is used, disclosed, and protected.

We do not use SMS text messages, general email, or website contact forms to transmit PHI, including diagnoses, treatment details, or other clinical information. Digital communications through these channels are limited to appointment scheduling, administrative reminders, and account notifications. Clinical and treatment-related information is handled only through secure channels consistent with our HIPAA obligations.

If you have questions about how we handle your health information, see Part 2 of this page or contact us using the information in Section 10.

5. CCPA Compliance (California Residents)

If you are a California resident, you have rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA), including:

Right to Know: Request details on the personal data we collect, use, and share.
Right to Delete: Request deletion of personal data we hold, subject to legal and medical recordkeeping exceptions.
Right to Correct: Request correction of inaccurate personal information.
Right to Opt-Out: Request that we do not sell or share your personal information (we do not sell or share personal data).
Right to Non-Discrimination: You will not be discriminated against for exercising your privacy rights.

How to Exercise Your CCPA Rights To submit a request, email us at privacy@northcoastalservices.net with the subject “CCPA Request.” We may ask you to verify your identity before processing your request.

[Flag, <85% confidence: health information is treated as “sensitive personal information” under CPRA, which can trigger an additional required disclosure — a “Right to Limit the Use of My Sensitive Personal Information” mechanism. Whether this applies to your practice depends on how patient data is collected and used beyond direct care. I’d recommend a privacy attorney confirm whether this section needs that addition before publishing.]

6. SMS Terms & Consent

By providing your phone number and opting in through our website intake form, you consent to receive SMS text messages from North Coastal Care, including appointment reminders, scheduling updates, and account notifications.

Message frequency varies based on your appointments and account activity.
Message and data rates may apply.
Consent to receive texts is not a condition of receiving care or any service.
Text messages will not contain protected health information (PHI), diagnoses, or clinical details.

Opt-Out: Reply STOP to any message to unsubscribe at any time. You will receive a one-time confirmation. Reply START to opt back in.

Help: Reply HELP or contact us at 760-845-6004 or privacy@northcoastalservices.net.

Carriers are not liable for delayed or undelivered messages. As noted in Section 3, your mobile number and messaging consent information are never shared with third parties or affiliates for marketing purposes.

For the full SMS Terms and Conditions, visit www.northcoastalservices.net/terms-service.

7. Data Security

We implement appropriate security measures to protect your personal data from unauthorized access, loss, or misuse. However, no method of transmission over the internet is 100% secure. We encourage users to take precautions when sharing sensitive information online.

8. Your Choices & Rights

Opt-Out of Marketing: Unsubscribe from emails at any time via the unsubscribe link in our emails.
Opt-Out of SMS: Reply STOP to any text message (see Section 6).
Cookies: You can modify your browser settings to refuse cookies, though some website features may not function properly.
Access & Correction: You may request access to or correction of your personal information.

9. Third-Party Links

Our website may contain links to third-party websites. We are not responsible for their privacy practices, and we encourage you to review their policies.

10. Changes to This Policy

We may update this Privacy Policy periodically. Any changes will be posted on this page with an updated effective date. Continued use of our services after updates constitutes your acceptance of the revised policy.

11. Contact Us

If you have any questions or wish to exercise your privacy rights, please contact us:

North Coastal Care Privacy Officer 760-845-6004 privacy@northcoastalservices.net northcoastalservices.net

Part 2: Notice of Privacy Practices

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

Effective Date: July 8, 2026

I. Our Commitment to Your Privacy

North Coastal Care is required by law to maintain the privacy of your protected health information (“PHI”), to provide you with this Notice describing our legal duties and privacy practices, and to follow the terms of the Notice currently in effect. This Notice applies to all mental health and psychiatric records maintained by North Coastal Care.

II. Understanding Your Health Record

Each time you receive services from North Coastal Care, we create a record of the care provided, which may include diagnosis, treatment plans, medications, progress notes, and billing information. This information serves as a means of communication among treatment providers, a basis for planning your care, a legal document, and a tool for billing and quality review.

III. How We May Use and Disclose Your Health Information

A. For Treatment

We may use or disclose your health information to provide, coordinate, or manage your care and related services, including consulting with other treating providers involved in your care.

B. For Payment

We may use or disclose your health information to bill and collect payment from you, an insurer, or a third party, including verifying coverage and processing claims.

C. For Health Care Operations

We may use your health information for internal operations such as quality assessment, staff training, licensing, and administrative purposes necessary to run the practice.

D. Appointment Reminders and Administrative Communications

We may contact you by phone, text (SMS), or email to provide appointment reminders and administrative notices. Consistent with our SMS Terms, these communications will not include diagnosis, treatment details, or other clinical information.

E. Other Permitted or Required Disclosures (Without Your Authorization)

In limited circumstances, and only as narrowly permitted by law, we may disclose information:

As required by law (e.g., mandatory reporting of abuse, neglect, or domestic violence).
For public health activities (e.g., reporting to public health authorities as required).
For health oversight activities (e.g., audits, licensing investigations).
In response to a court order, or in limited judicial/administrative proceedings as narrowly permitted by law.
To avert a serious and imminent threat to health or safety.
For specific government functions (e.g., military, national security, as applicable).
For workers’ compensation, to the extent authorized.

F. Uses and Disclosures Requiring Your Written Authorization

Any use or disclosure not described above requires your specific written authorization, which you may revoke at any time in writing. This includes:

Psychotherapy notes (kept separate from the rest of your medical record), which require your authorization for nearly all uses and disclosures.
Marketing communications.
Sale of health information.

IV. Substance Use Disorder (SUD) Records — 42 CFR Part 2

If you receive treatment for a substance use disorder from North Coastal Care, records related to that care are subject to an additional federal confidentiality law, 42 CFR Part 2, which provides greater protection than HIPAA alone. Under Part 2, these records generally cannot be disclosed without your specific written consent, except in narrowly defined circumstances such as a medical emergency or a qualifying court order. Ask us if you would like more information about how this applies to your care.

V. Minors and Confidentiality (California)

California law permits minors age 12 and older to consent to certain outpatient mental health and substance use disorder services without parental involvement, under conditions established by the California Family Code. Where a minor lawfully consents to their own care under these provisions, additional confidentiality protections may apply, including possible limits on parental access to related records. Ask us if you would like more information about how this applies to your situation.

VI. Your Rights Regarding Your Health Information

You have the right to:

Inspect and obtain a copy of your health record, with limited exceptions (e.g., psychotherapy notes may be excluded).
Request an amendment to your health information if you believe it is incorrect or incomplete.
Request an accounting of disclosures we have made of your health information, subject to certain exceptions.
Request restrictions on certain uses or disclosures of your health information, including disclosures to health plans for services you paid for in full out-of-pocket.
Request confidential communications by an alternative method or at an alternative location.
Obtain a paper copy of this Notice at any time, even if you agreed to receive it electronically.
Be notified in the event of a breach of your unsecured health information.

VII. Our Responsibilities

North Coastal Care is required to:

Maintain the privacy of your health information as described in this Notice.
Provide you with this Notice describing our legal duties and privacy practices.
Abide by the terms of the Notice currently in effect.
Notify you if we are unable to agree to a requested restriction.
Accommodate reasonable requests for confidential communication.

We reserve the right to change the terms of this Notice and to make the revised Notice effective for all health information we maintain. Updated copies will be made available at our office and on our website.

VIII. Complaints

If you believe your privacy rights have been violated, you may file a complaint with North Coastal Care or with the U.S. Department of Health and Human Services, Office for Civil Rights. You will not be retaliated against, and treatment will not be conditioned on, your filing a complaint.

To file a complaint with North Coastal Care, contact: Privacy Officer North Coastal Care 760-845-6004 privacy@northcoastalservices.net

To file a complaint with HHS: U.S. Department of Health and Human Services, Office for Civil Rights 200 Independence Avenue, S.W., Washington, D.C. 20201 1-877-696-6775 www.hhs.gov/ocr/privacy/hipaa/complaints/

IX. Changes to This Notice

We reserve the right to change this Notice at any time. Any revised Notice will be effective for all health information we maintain, and will be posted at our office and on our website at [northcoastalservices.net].

X. Contact Information

North Coastal Care Privacy Officer 760-845-6004 privacy@northcoastalservices.net northcoastalservices.net