Who we are
Legacy Behavioral Collective ("we," "us," or "our") is a private-pay ABA therapy and parent-coaching practice in California, serving families on the San Francisco Peninsula and the Coastside. This Privacy Policy applies to legacybehavior.com (the "website") and to our invitation-only family portal. It does not replace any agreement or consent forms you sign with us for services.
If you have questions about this policy, email us at info@legacybehavior.com.
Information we collect
When you visit our website
On our public pages, we use Google Analytics to understand how the website is used. It uses cookies and similar identifiers to collect information such as the pages you view, how you arrived, your browser and device type, your general location (based on your IP address), and actions such as clicking a booking or email button, loading the scheduling tool, or opening WhatsApp. For WhatsApp, we record only that it was opened and the length of your message, never the message itself.
Our hosting and server providers also automatically record technical information in server logs, such as your IP address, browser type, the page requested, and the date and time.
When you contact us
If you email us at info@legacybehavior.com, we receive your email address, your name if you include it, and whatever you write. If you use the WhatsApp chat button, the website opens WhatsApp with the message you typed. Your message, phone number and WhatsApp profile are then handled by WhatsApp, a Meta service, and delivered to our WhatsApp account.
When you book a consultation
Consultations are booked through a Google Calendar appointment page embedded on our home and contact pages. Google collects the details you enter, such as your name, email address and any notes, and shares them with us so we can hold the appointment. Because the scheduler loads from Google when you visit those pages, Google may also receive technical information and set its own cookies.
When you use the family portal
The family portal is available by invitation only. We use Firebase Authentication, a Google service, to manage portal accounts. We receive your email address and, if you sign in with Google, basic profile information from your Google account. If you sign in with an email and password, your password is handled by Firebase; we do not see it.
In the portal, you and our team may store information about your child and family, such as your child's name, service programs, goals, progress data and session notes, documents and meeting summaries, upcoming appointments, and purchased and used service hours.
When you pay for services
Card payments in the portal are processed by Square. Your card number and security code are entered into Square's secure payment form and are not received or stored by us. We keep a record of each transaction, such as the amount, the service purchased, the date and the receipt link. If you choose to save a card with Square for future payments, we also keep the limited card details Square returns, such as the card brand, last four digits and expiration date.
How we use information
We use the information we collect to:
- respond to your questions and schedule consultations;
- provide, coordinate and document services, and share progress with you;
- run the family portal, including sign-in, invitations, documents, appointments and service-hour balances;
- process payments and keep financial records;
- send service-related messages, such as booking confirmations, invitations and password-reset emails;
- understand how our public pages are used so we can improve them; and
- protect the website and portal, prevent fraud, and meet our legal obligations.
Health and child information
Information about your child's development, behavior, goals and progress is used only to provide and coordinate services, and we keep it confidential. We share it only with your consent, for example with a school or another provider you ask us to work with, or as required or permitted by law. We never use it for advertising.
Google Analytics is not loaded on the sign-in page, the family portal or our administrative pages.
Please do not send medical, diagnostic or other sensitive details about your child through WhatsApp or general email, which are not designed for sensitive health information. We are glad to discuss those details during your consultation.
Do Not Track
Some browsers send a "Do Not Track" signal. Our website does not currently respond to these signals: Google Analytics still loads on our public pages. You can use the choices above to limit analytics.
Other than the Google and Square services described in this policy, we do not allow third parties to collect information about your activity on our website, and we do not use advertising networks.
Children's privacy
Our website is not directed to children under 13, and we do not knowingly collect personal information online directly from children under 13. Information about children is provided by their parents or guardians, or recorded by our team, so that we can arrange and deliver services. If you believe a child has sent us personal information through the website, contact us and we will delete it.
How long we keep information
We keep personal information for as long as we need it to provide services and run our practice, and for as long as California and federal record-keeping rules require, for example for clinical and financial records. Analytics data is kept for the limited period set in our Google Analytics settings. When information is no longer needed, we delete it or de-identify it.
How we protect information
We use reasonable safeguards designed to protect your information, including:
- encrypted connections (HTTPS) for the website, the portal and our servers;
- invitation-only portal accounts that require sign-in; and
- role-based access, so families see only their own child's information that our team has shared with them, and only authorized team members can manage records.
No system is perfectly secure. Please keep your sign-in details private and sign out when you use a shared device. You can read more about our approach on our Trust & Compliance page.
Your choices and rights
You can ask to review, correct or update your information, ask for a copy, or ask how it is used by emailing info@legacybehavior.com. We may need to verify your identity before acting on a request, and some records must be kept to meet legal or professional requirements.
If you live in California, you may have additional rights under California law, such as the right to know what personal information we collect and how we use and share it, to request access, correction or deletion, and not to be treated differently for exercising these rights. Email us to make a request, and we will respond as the applicable law requires.
Changes to this policy
We may update this policy from time to time. When we do, we will post the new version on this page and change the "Last updated" date above. If we make significant changes, we may also let portal users know by email or in the portal.
Contact us
Questions or requests about this policy or your information can be sent to info@legacybehavior.com or through our contact page. Our Terms of Use explain the rules for using the website and portal.