Privacy Policy

1. Organization Information

Common Sense Healthcare is a 501(c)(3) nonprofit organization registered in the State of Colorado (EIN: 84-2950381). Our principal office is located at 1600 Stout Street, Suite 1220, Denver, CO 80202. For privacy-related inquiries, contact our Privacy Officer at [email protected] or by calling (720) 555-0461 during regular business hours.

2. Information We Collect

When you interact with Common Sense Healthcare through our website, intake forms, phone consultations, or in-person appointments, we may collect the following categories of personal information:

• Contact Information: Name, email address, phone number, and mailing address.
• Insurance Information: Insurance carrier name, plan type, member ID, group number, and coverage details.
• Healthcare Information: Medical bills, Explanation of Benefits statements, denial letters, prior authorization correspondence, prescription information, and descriptions of healthcare issues you provide during consultations.
• Financial Information: Income information (for eligibility determinations), billing documents, and payment plan details shared during bill review and negotiation.
• Demographic Information: Age, preferred language, household size, and zip code (used for aggregate reporting and service planning only).
• Website Usage Data: Browser type, device information, pages visited, and interaction data collected through standard website analytics tools.

We collect only the information necessary to provide the specific advocacy, navigation, or educational services you have requested. You may decline to provide certain information, understanding that this may limit our ability to assist with specific aspects of your case.

3. How We Use Your Information

We use the personal information we collect for the following purposes:

• Providing patient advocacy, insurance navigation, medical bill review, and educational services directly to you.
• Communicating with insurance companies, healthcare providers, and government agencies on your behalf, with your written authorization.
• Scheduling appointments and follow-up consultations.
• Preparing aggregate, de-identified statistical reports for our funders and the public (e.g., total patients served, average bill reduction amounts). Individual client information is never included in these reports.
• Improving our programs and services based on client feedback and outcome data.
• Complying with applicable legal and regulatory requirements.

4. Information Sharing & Third-Party Disclosure

Common Sense Healthcare does not sell, rent, trade, or otherwise disclose your personal information to third parties for marketing, advertising, or commercial purposes. Period.

We may share your information only in the following limited circumstances:

• With your written authorization: When you sign a consent form authorizing us to contact your insurance company, healthcare provider, or a government agency on your behalf.
• Referral partners: If we refer you to a legal aid organization, healthcare provider, or government program, we will share only the minimum information necessary to facilitate the referral, and only with your verbal or written consent.
• Legal requirements: If required to disclose information by valid court order, subpoena, or other legal process, we will notify you to the extent permitted by law and will seek to limit the scope of disclosure.
• De-identified data: We may share aggregate, de-identified data with funders, partner organizations, and policymakers. This data cannot be used to identify any individual client.

5. HIPAA & Healthcare Information

Common Sense Healthcare is a patient advocacy and educational organization, not a covered entity under the Health Insurance Portability and Accountability Act (HIPAA). However, we recognize the sensitive nature of the healthcare information our clients share with us. We voluntarily adopt privacy and security practices consistent with HIPAA standards, including encrypted storage of client records, role-based access controls, staff and volunteer confidentiality agreements, regular security training, and secure destruction of records that are no longer needed. When we receive Protected Health Information (PHI) from covered entities (such as your insurance company or healthcare provider) in the course of advocating on your behalf, we handle that information with the same care and protections as if HIPAA directly applied to our organization.

6. Attorney-Client Privilege Note

While our Executive Director is a licensed attorney in the State of Colorado, Common Sense Healthcare does not provide legal representation or establish an attorney-client relationship with individuals we serve. Information shared during advocacy consultations is protected under our organizational confidentiality policy but is not subject to attorney-client privilege. If your situation requires legal representation, we will refer you to qualified attorneys through the Colorado Bar Association's health law referral service or applicable pro bono programs, at which point attorney-client privilege would apply to your communications with that retained attorney.

7. Data Security

We implement administrative, technical, and physical safeguards to protect your personal information against unauthorized access, use, modification, or disclosure. These include AES-256 encryption for stored client records, TLS 1.3 encryption for all data transmitted through our website, multi-factor authentication for staff access to client databases, regular security audits and vulnerability assessments, locked physical storage for paper documents, and annual security awareness training for all staff and volunteers. While no security system is impervious to every possible threat, we are committed to maintaining robust protections commensurate with the sensitivity of the information entrusted to us.

8. California Consumer Privacy Act (CCPA) Compliance

While Common Sense Healthcare primarily serves Colorado residents, we extend CCPA-equivalent privacy rights to all individuals regardless of state of residence. You have the right to know what personal information we have collected about you, request deletion of your personal information (subject to legal retention requirements), request a copy of your personal information in a portable format, and opt out of any sale of personal information. As noted above, we do not sell personal information under any circumstances. To exercise any of these rights, contact our Privacy Officer at [email protected].

9. Data Retention

We retain client records for a minimum of seven years from the date of the last service provided, consistent with Colorado nonprofit record-keeping requirements and IRS documentation standards for 501(c)(3) organizations. After the retention period, records are securely destroyed using NIST 800-88 compliant data sanitization methods for electronic records and cross-cut shredding for paper documents. You may request earlier deletion of your records, which we will accommodate to the extent permitted by our legal and regulatory obligations.

10. Website Cookies & Analytics

Our website uses essential cookies necessary for basic site functionality. We use a privacy-respecting, self-hosted analytics platform that does not track individual users across websites, does not use persistent cookies for analytics purposes, and does not share data with third-party advertising networks. We do not use Google Analytics, Facebook Pixel, or any other tracking technologies that create cross-site user profiles. Our website does not display third-party advertisements.

11. Changes to This Policy

We may update this privacy policy from time to time to reflect changes in our practices, applicable law, or operational needs. Material changes will be posted on this page with an updated effective date and, where appropriate, communicated to active clients via email. We encourage you to review this policy periodically.

12. Contact Information

For questions, concerns, or requests related to this privacy policy or the handling of your personal information, please contact: