Privacy Policy

We collect information you voluntarily provide when you:

• Complete a contact, insurance verification, referral, or admissions form.
• Call or email our team or request a callback.
• Use our virtual admissions assistant.

This may include your name, phone number, email address, insurance carrier and member information, and any personal or clinical details you choose to share. Referral submissions may include information about another person; please only submit information you are authorized to share.

We also collect limited technical and usage information, such as IP address, browser and device details, referring source, pages visited, and interactions with website buttons, through cookies and similar technologies.

Protected health information is handled in accordance with applicable HIPAA requirements, Massachusetts law, and, where applicable, the additional federal protections for substance use disorder records under 42 CFR Part 2. Uses and disclosures of patient records are governed by our Notice of Privacy Practices and applicable consent requirements. Contact our team to request that notice.

Please avoid sending sensitive clinical details, Social Security numbers, or medical records through general website forms, email, or the virtual assistant. Contact our admissions team by phone to discuss an appropriate way to share confidential information.

• Respond to questions and coordinate assessments and admissions.
• Verify insurance benefits and eligibility.
• Coordinate treatment, referrals, and follow-up you request.
• Communicate about your inquiry and provide administrative updates.
• Improve our website, services, and outreach.
• Prevent misuse and comply with legal and record-keeping obligations.

We never sell your data. We do not sell personal information or protected health information. We do not use or disclose protected health information for marketing that requires your authorization without obtaining that authorization.

Subject to applicable law and any required consent or authorization, we may share information with:

• Our admissions and treatment teams and providers involved in coordinating your care.
• Insurance carriers or payers for benefits verification and related purposes.
• Service providers supporting website hosting, forms, secure storage, email delivery, and the virtual assistant.
• The analytics and call tracking providers described below.
• Authorities or other parties when disclosure is legally required or permitted, including applicable safety exceptions.

Sharing of protected patient records is subject to HIPAA, 42 CFR Part 2 where applicable, and other legal restrictions; these examples do not authorize disclosures beyond what those laws allow.

Our assistant uses an AI service to generate responses from the messages you send. Messages and relevant conversation context are processed by that service to provide the conversation. The assistant is for admissions support, not emergency care or medical diagnosis.

Conversations are saved on our website's server, not as message history in your browser. Your browser stores a private access identifier that allows you to return to your saved conversation. Treat that identifier and access to your browser as confidential. Starting a new conversation does not automatically delete previously saved records.

When you consent to an admissions follow-up through the assistant, we save your contact request and send our admissions team your contact details, the full conversation transcript, and the pages where you engaged with the assistant. Do not include information you do not want processed or shared in this way. Contact us with questions about access or deletion of a saved conversation.

Our website offers separate choices for Google Analytics 4, CallTrackingMetrics, and external media. We read saved choices and your browser's Global Privacy Control signal before loading optional tracking. In regions requiring consent, and when your region cannot be determined, analytics and call tracking stay off until you accept. Elsewhere they default to on unless you reject them. External media defaults to off everywhere. Global Privacy Control keeps analytics and call tracking off even if a saved preference says otherwise.

• Google Analytics: measures visits, page usage, button clicks, phone-link clicks, and successful inquiry submissions. Google may receive device and browser information, IP address, and cookie identifiers. We send pathname-only page views without query strings, fragments, form values, or health details, and suppress referring URLs. GA4 consent mode controls analytics storage; advertising storage, advertising user data, and advertising personalization signals always remain denied. We do not enable Google signals or customer matching. Optional tags are blocked when tracking is refused, rather than sending denied-consent pings.
• CallTrackingMetrics: helps identify which website visit or source led to a call. It may process visit and referring-source information, device details, IP address, and call information such as caller number, time, and duration, depending on the features in use. It may replace displayed phone numbers with tracking numbers. We do not send it form answers or assistant transcripts. Disabling call tracking after it loads reloads the page so the service stops. Turning website tracking off does not prevent us from receiving a call you choose to make or retaining information needed to respond to it.
• Google Maps: embedded maps and links to our Google business profile connect your browser to Google under its own privacy practices. Embedded Google Maps, YouTube videos, and any third-party review widgets stay paused until you allow external media. Those providers then receive IP and browser details. Video playback requires a separate play click even after media permission. Reviews displayed directly on our site are local content, not a live third-party widget. Clicking an external link takes you to a site governed by that provider's privacy policy.

Our website's conversion event parameters do not include names, phone numbers, insurance details, form responses, or assistant transcripts. Please do not put sensitive information in page URLs.

Review the Google Privacy Policy and the CallTrackingMetrics Privacy Policy for those providers' practices. You can restrict cookies through browser settings and use the Google Analytics opt-out browser add-on. Restricting cookies may affect website features. Use the persistent privacy icon in the lower-left corner on any page to accept, reject optional services, customize, or withdraw choices. Opening settings does not change your choice. Changes apply immediately and to other open tabs; a later acceptance does not replay events blocked earlier. Global Privacy Control overrides tracking acceptance. Browser Do Not Track is not a substitute for these controls.

Your browser stores a visitor identifier, your choices, the time of each decision, the notice text and version, region, and GPC status in localStorage. Choice history retains earlier acceptance when you later withdraw. Necessary storage supports your saved choices, form drafts, security, and private access to your saved chat. Clearing browser storage removes this browser's preference history; if browser storage is unavailable, choices apply only for that visit.

Inquiry forms require an unchecked express consent box before submission. The disclosure authorizes Shine to contact you at the phone number and/or email you provide by phone, text message, or email about treatment options and your inquiry. Message and data rates may apply. Consent is not a condition of treatment or purchase; you may call us instead of submitting a form. We retain the disclosure text and a server-recorded timestamp with your lead record. Contact permission is separate from optional tracking permission and does not authorize advertising data matching. Consent fields and form values are never included in conversion event parameters; those events fire only after a successful submission when analytics is permitted.

We retain inquiry information and saved conversations as reasonably necessary to respond to requests, coordinate services, and meet legal and business record-keeping obligations. Clinical records are subject to applicable Massachusetts and federal retention requirements. Deletion requests may be limited by those obligations.

• Ask us to access, correct, or delete personal information, subject to applicable law and retention obligations.
• Ask us to stop optional follow-up or marketing communications, or use an unsubscribe link where provided.
• Change or withdraw optional services using the floating privacy icon, and use browser controls or Global Privacy Control.
• Request information about patient privacy rights and our Notice of Privacy Practices.

Patients may have additional rights to access or amend protected health information, request restrictions or confidential communications, and receive an accounting of certain disclosures. Contact us to exercise applicable rights; we may need to verify your identity before responding.

We use administrative, technical, and physical safeguards designed to protect information. No internet transmission or electronic storage system is completely secure, so we cannot guarantee absolute security.

This website is not directed to children under 13, and we do not knowingly collect personal information from them through the site. If you believe a child has submitted personal information, please contact us so we can address it.

Our website links to external websites. Their privacy practices are governed by their own policies, not this policy. Please review those policies before sharing information.

We may update this policy from time to time. Changes will appear on this page with a revised last-updated date.

For questions about this policy, our Notice of Privacy Practices, or a privacy request, contact Shine and ask for the person responsible for privacy matters.

Shine Wellness & Recovery
605 Broadway Unit 3A, Saugus, MA 01906
Phone: (617) 341-9944
Email: Info@shinewellnessrecovery.com