Privacy & HIPAA Notice

Effective date: [to be set upon approval] · Project MIND, Inc., 3850 W. Ann Rd, North Las Vegas, NV 89031

Part 1 — Website privacy policy

What we collect on this website

• Request Services (intake) form: your contact information and, if you provide it, your child's name, date of birth, diagnosis status, and insurance details. This is protected health information (PHI) and is handled under HIPAA from the moment you submit it.
• Contact form: your name and how to reach you. Delivered to our office inbox so we can respond.
• Careers applications: whatever you choose to send us by email.

How intake information is protected

• Submitted over an encrypted connection and stored in a HIPAA-eligible cloud database covered by a Business Associate Agreement (BAA) with our cloud provider.
• Visible only to our intake team. The notification email our staff receive contains no health information — just a note that a submission arrived.
• If you save a draft and come back later, the draft is linked to your browser by an opaque, HttpOnly cookie (pm_draft) that expires after 14 days. Drafts contain what you typed and nothing else, and are removed after submission or after the return window lapses.
• No analytics or advertising scripts run inside the intake wizard, and health information is never sent to analytics tools.

Cookies & analytics

Marketing pages on this site use Google Tag Manager for basic visit analytics. The intake wizard and the Family Portal do not. We do not sell personal information, and we do not use advertising trackers on any page that handles health information.

The Family Portal

• Access is invitation-only; each guardian has an individual account. There are no shared logins.
• Every access to a document or record in the portal is logged in an audit trail.
• Documents open through short-lived, expiring links — never public URLs.
• The portal does not store your child's information in your browser between sessions, and portal notifications (email or push) never include health details — they say only that something new is waiting in the portal.

In-center cameras

Our observation cameras are closed-circuit and viewable only inside the center (including the family observation room). They are not accessible over the internet.

Part 2 — HIPAA Notice of Privacy Practices

This notice describes how medical information about your child may be used and disclosed and how you can get access to this information. Please review it carefully.

How we may use and disclose health information

• Treatment — to provide, coordinate, and manage your child's ABA therapy (for example, sharing information among your child's BCBA and RBTs, or with your child's referring physician).
• Payment — to bill and collect payment from your insurance plan, Nevada Medicaid, or you (for example, submitting claims and obtaining authorizations).
• Health care operations — to run the practice (quality review, training, scheduling, audits). We use practice-management and clinical data systems that are bound by business-associate agreements to protect your information.
• As required or permitted by law — including mandatory child-abuse or neglect reporting, public-health activities, health oversight, court orders and lawful process, and to prevent a serious threat to health or safety.

Other uses and disclosures — including most uses for marketing, any sale of information, and most sharing of psychotherapy notes — are made only with your written authorization, which you may revoke at any time.

Your rights

• See and get a copy of your child's records (including an electronic copy).
• Ask us to correct records you believe are wrong or incomplete.
• Ask for an accounting of certain disclosures we have made.
• Ask us to limit what we use or share. If you pay for a service in full out-of-pocket, you may require us not to share that service's information with your health plan.
• Ask us to contact you in a specific way or at a specific place (for example, only by phone, or only at a certain number).
• Get a paper copy of this notice, and be notified promptly if a breach ever compromises your child's information.
• Choose a personal representative. For children, a parent or legal guardian generally exercises these rights, consistent with Nevada law and any custody orders on file.

Complaints

If you believe privacy rights have been violated, you may complain to us — contact our Privacy Officer at (702) 323-6555 or info@projectmindhq.com — and to the U.S. Department of Health and Human Services, Office for Civil Rights. We will never retaliate against you for filing a complaint.

Changes to this notice

We may update this notice, and the updated version will apply to all information we hold. The current version will always be posted on this page and available on paper at the front desk.