This Privacy Notice (“Notice”) describes how the Rethink Behavioral Health division of Rethink Autism, Inc. (“Rethink”, “Rethink BH”, “we”, “us”, “our”) collects, uses, discloses, secures, and eventually disposes of (collectively “processes”) your personal information. Personal information is any information that does, or could, identify you.
This Notice applies to personal information collected on our website (rethinkbehavioralhealth.com), mobile app (Rethink BH), and in the course of other interactions with you or your behavioral health practice (collectively the “services”). Our website has public and subscription-only sections. Our mobile app is part of our subscription-only services.
Our services may contain links to external websites. This Notice does not cover those sites.
In this Notice, “you” refers to anyone about whom we process personal information. You will usually be a behavioral health practitioner or other employee or contractor of a behavioral health practice; a parent or other caregiver of a child receiving treatment; or a visitor to our public website. For parents and legal guardians, “your personal information” includes your child’s personal information.
Rethink BH provides online tools, content, and related services to behavioral health practices. For personal information that is processed in our subscription-only services, these practices are the “controllers” of your information and Rethink is a “processor” (also called a “service provider”). As a processor, we handle your information only on the controller’s behalf and according to its instructions. In this situation, this Notice describes how we process your information on behalf of the controller. Further, this Notice does not cover the practice’s processing of your information outside our services.
This Notice will identify those situations where Rethink is the controller of your information. This applies, for example, to information collected on the public sections of our website.
Rethink BH is part of the Rethink group of businesses. This Privacy Notice applies only to Rethink BH.
We will update this Notice from time to time and will communicate material changes to you through an appropriate channel (for example, via a notice in our services). The Notice was last updated on August 1st, 2020.
We collect the following categories of personal information:
We collect the categories of personal information listed above from the following categories of sources:
When we collect personal information directly from you, you will know the details of that information. It may include:
Our subscription-only services facilitate the utilization of personal information for the purpose of assisting behavioral health practices (Rethink’s customers) to provide behavioral health solutions. When we collect personal information about you or your child from other users of the subscription-only services, we do so solely for this purpose. The data collected in our subscription-only services reflects the range of personal information typically collected by a behavioral health practice. Which users of our services can access the information of which other users is determined and configured by your practice. The personal information collected in this way may include:
This section describes how Rethink BH uses your personal information. Remember that your behavioral health practice is the “controller” of the personal information processed in our subscription-only services. This Privacy Notice does not cover how the practice uses your information, which will be determined by its own legal obligations and policies.
Rethink BH will never sell your personal information.
When we receive your personal information as a data processor, we use it solely on the data controller’s behalf and according to its instructions. When your behavioral health practice is a Covered Entity under the US Health Insurance Portability and Accountability Act (HIPAA), our relationship with it is that of Business Associate.
When we process your personal information as a controller, the GDPR requires that we provide individuals in the European Union and European Economic Area with our legal bases for doing so. Our legal basis depends on the purpose of processing:
|Purpose of processing||Legal basis|
|Market our services to you||GDPR Article 6,1(a) – your consent.|
|To respond to your requests or questions (on our public services)||GDPR Article 6,1(b) – in order to take steps at your request prior to entering into a contract..|
Who we disclose your personal information to depends on the specific items of information and the purposes we use them for. Your personal information may be disclosed to the following categories of recipients:
We have in the preceding 12 months disclosed the following categories of personal information to service providers:
We will also disclose your personal information in the following exceptional circumstances:
We employ technical, physical, and administrative security measures appropriate to the categories of personal information processed in our services. These measures include, for example: encryption at rest and in transit, roles-based access, firewalls, and anti-virus software. For more details of our practices, please consult our Information Security Standards statement.
We protect information about patient’s diagnoses, treatments, and outcomes with particular care. Rethink is HITRUST CSF certified. HITRUST CSF is a security and privacy framework that covers, among others, HIPAA and National Institute for Standards and Technology (NIST) standards.
No matter how carefully we safeguard your information, it is unfortunately not possible to guarantee that it will never be accidentally or illegally breached.
When we receive your personal information as a processor, we will retain it for the duration of the processing contract and then, according to the controller’s instructions, return it to them, delete it, or transfer it to another service provider.
Section 9 of this Notice below describes your right to request deletion of your data outside of our normal data retention schedule.
Rethink is based in the United States. Your personal information is stored on our systems in the US and is not transferred onward to other jurisdictions.
If you live in the European Union or European Economic Area, note that the European Commission has not issued an unlimited adequacy decision for the US. Privacy safeguards for EU/EEA-US data transfers are the responsibility of the data controller. Rethink BH collaborates with our EU/EEA customers to put in place GDPR-recognized safeguards for international transfer.
US and international laws give you various rights over your personal information and that of your child. These may include the right to:
In most cases relating to our subscription-only services, you should contact your behavioral health practice (the controller) with any request to exercise privacy rights. This would include, for example, requesting access to your child’s information that the practice processes in our services. If necessary, however, please contact Rethink BH using the contact information in Section 10 of this Notice. We will endeavor to facilitate your request.
Rights requests concerning personal information that we collect as a data controller (for example, on our public website or in our marketing communications) should be addressed to Rethink BH using the contact information in Section 10 below.
If you believe that we have infringed your privacy rights, please contact us so that we can try to resolve the issue. However, if you are an EU/EEA resident, you have the right to lodge a complaint with your local supervisory authority.
You can opt out of our marketing communications at any time using, for example, the “unsubscribe” in an e-mail message or similar functionality in other communication formats.
When required by local law, we will obtain your prior consent for marketing communications. You may withdraw that consent at any time using the “unsubscribe” or similar functionality in a marketing message. Alternatively, please contact us using the contact information in Section 10 below.
Please note that, if you are a user of our subscription-only services, you may continue to receive service communications even after you have opted out of marketing communications. “Service” communications contain important information about the service for which you are a current user.
Data Protection Officer: firstname.lastname@example.org or +1 646 257 2919 ext. 800
Rethink Behavioral Health
49 West 27th Street, 8th Floor
New York, NY 10001
Unit 3d North Point House,
North Point Business Park,
New Mallow Road,
email@example.com or +44 203 870 3376.