Privacy Policy & Data Protection
Health Promotion Project is deeply committed to protecting the privacy and confidentiality of every individual who participates in our programs, visits our website, or interacts with our organization. This policy describes how we collect, use, protect, and share personal information.
Effective Date: January 1, 2024
Last Updated: January 1, 2024
Organization: Health Promotion Project, a 501(c)(3) non-profit organization
EIN: 41-2847301
Address: 1840 Hennepin Avenue, Suite 320, Minneapolis, MN 55403
1. Information We Collect
Health Promotion Project may collect the following categories of personal information in connection with program enrollment, health screenings, volunteer applications, donations, and website interactions:
- Identifying Information: Name, date of birth, mailing address, email address, telephone number, preferred language, and emergency contact information.
- Health Information: Self-reported health conditions, biometric screening results (blood pressure, blood glucose, cholesterol, BMI), health risk assessment responses, program progress data, and tobacco use status. This information is collected only from individuals who voluntarily enroll in our health promotion programs or participate in community screening events.
- Demographic Information: Race, ethnicity, gender, household income bracket (for sliding-scale fee determination), insurance status, and zip code. This information is used exclusively for program eligibility determination, health equity analysis, and aggregate reporting to funders.
- Volunteer & Donor Information: Employment history, professional credentials, availability, areas of interest, donation amounts, and payment information (processed through secure third-party payment processors; we do not store credit card numbers).
- Website Usage Information: Our website may collect standard web analytics data including IP addresses, browser type, pages visited, and time spent on site. Our interactive tools (Health Risk Assessment, Program Cost Estimator) operate entirely in your browser using client-side JavaScript and do not transmit any responses or results to our servers.
2. How We Use Your Information
Personal information collected by Health Promotion Project is used exclusively for the following purposes:
- Program enrollment, scheduling, and communication.
- Delivery of health promotion services including biometric screenings, health education, and patient navigation.
- Program evaluation and outcome measurement using de-identified aggregate data.
- Coordination of referrals to partner healthcare providers (with your explicit consent).
- Grant reporting to federal and state funders using de-identified aggregate data.
- Volunteer coordination and communication.
- Donation processing and tax receipt generation.
- Improving our programs, services, and website based on aggregate usage patterns.
3. HIPAA-Equivalent Protections
Although Health Promotion Project is a community-based non-profit and not a HIPAA-covered entity (as defined under 45 CFR 160.103), we voluntarily adopt and maintain HIPAA-equivalent data protection standards for all participant health information. These protections include:
- Encryption: All electronic health records are stored using AES-256 encryption at rest and TLS 1.3 encryption in transit.
- Access Controls: Health information is accessible only to authorized staff members with role-based access credentials. Access is limited to the minimum necessary for each staff member's job function.
- Physical Security: Paper records containing health information are stored in locked filing cabinets within a secured area of our Hennepin Avenue office. Access requires authorized key card entry.
- Staff Training: All staff members and volunteers complete annual privacy and data security training that covers confidentiality obligations, data handling procedures, and incident reporting protocols.
- Confidentiality Agreements: All staff members, volunteers, and contractors sign confidentiality agreements upon onboarding that specifically address the protection of participant health information.
- Incident Response: We maintain a data breach response plan that includes immediate containment, investigation, notification of affected individuals within 72 hours, and reporting to relevant authorities as required by law.
4. Information Sharing & Disclosure
Health Promotion Project never sells, rents, trades, or otherwise discloses individual personal or health information to third parties for marketing, advertising, or commercial purposes. We may share information only in the following limited circumstances:
- Healthcare Referrals: When participants require clinical follow-up for abnormal screening results, we share relevant health information with partner healthcare providers only with the participant's explicit written consent. Participants may decline referral at any time.
- Grant Reporting: We provide aggregate, de-identified program data to federal and state grant funders as required by grant terms. Individual participants are never identified in grant reports.
- Program Evaluation: De-identified data may be shared with our academic research partners (University of Minnesota School of Public Health) for program evaluation purposes under data use agreements that prohibit re-identification.
- Legal Obligations: We may disclose information when required by valid court order, subpoena, or as otherwise mandated by law. We will notify affected individuals of such disclosures unless prohibited by the court order itself.
We will never share personal information with employers, insurance companies, immigration authorities, or law enforcement without explicit written consent or a valid court order.
5. Your Rights
As a participant or visitor, you have the following rights regarding your personal information:
- Access: You may request a copy of all personal and health information we hold about you.
- Correction: You may request correction of any inaccurate information in your records.
- Deletion: You may request deletion of your personal information, subject to legal retention requirements for grant-funded program records (typically 3 years after grant closeout).
- Restriction: You may request that we limit how your information is used or shared.
- Portability: You may request your information in a portable, machine-readable format.
- Withdrawal of Consent: You may withdraw consent for information sharing at any time by contacting our Privacy Officer.
To exercise any of these rights, contact our Privacy Officer at privacy@healthpromotionproject.org or by mail at 1840 Hennepin Avenue, Suite 320, Minneapolis, MN 55403. We will respond to all requests within 30 days.
6. California Residents (CCPA)
California residents have additional rights under the California Consumer Privacy Act (CCPA). We do not sell personal information. California residents may request disclosure of the categories and specific pieces of personal information collected, the categories of sources, the business purposes for collection, and the categories of third parties with whom information is shared. To make a CCPA request, contact our Privacy Officer using the information above.
7. European Residents (GDPR)
If you are a resident of the European Economic Area (EEA), you have additional rights under the General Data Protection Regulation (GDPR), including the right to object to processing, the right to data portability, and the right to lodge a complaint with a supervisory authority. Our lawful basis for processing personal data is consent (provided at program enrollment) and legitimate interests (program delivery and evaluation). To exercise GDPR rights, contact our Privacy Officer.
8. Data Retention
Program enrollment records and health data are retained for the duration of the participant's active enrollment plus 7 years, consistent with federal grant record retention requirements (2 CFR 200.334) and Minnesota records retention schedules. Volunteer and donor records are retained for 7 years after the last interaction. Website analytics data is retained for 26 months. Upon expiration of retention periods, records are securely destroyed using NIST-compliant media sanitization methods.
9. Cookies & Website Technologies
Our website uses essential cookies required for basic site functionality. We do not use third-party advertising cookies, social media tracking pixels, or cross-site tracking technologies. Our interactive tools (Health Risk Assessment, Program Cost Estimator) process all data locally in your browser and do not set cookies or transmit data to external servers.
10. Children's Privacy
Health Promotion Project programs are designed for adults aged 18 and older. We do not knowingly collect personal information from children under the age of 13. Our childcare services collect only the child's first name, age, and parent/guardian contact information for safety purposes; this information is collected on paper forms that are securely destroyed after each program session.
11. Changes to This Policy
This privacy policy may be updated periodically to reflect changes in our practices, legal requirements, or operational procedures. Material changes will be communicated to active participants by email and posted on this page with an updated effective date. We encourage you to review this policy periodically.
12. Contact Information
If you have questions about this privacy policy or our data practices, please contact:
Privacy Officer
Health Promotion Project
1840 Hennepin Avenue, Suite 320
Minneapolis, MN 55403
Phone: (612) 555-0147
Email: privacy@healthpromotionproject.org