Consumer Health Data Privacy Notice
The Autism Community in Action (TACA)
Effective Date: September 25, 2026
Last Updated: September 25, 2026
Why this is a separate document. Washington’s My Health My Data Act, Nevada’s consumer health data law (SB 370), and applicable Connecticut privacy requirements impose specific disclosure, consent, rights, and other obligations concerning consumer health data. This standalone notice describes how TACA collects, uses, shares, protects, and retains consumer health data and how consumers can exercise applicable rights. It supplements, and does not replace, TACA’s Privacy and Cookie Policy, available at tacanow.org/privacy-policy/.
1. Who This Notice Applies To
This notice applies to consumer health data that The Autism Community in Action (“TACA,” “we,” “us”) collects about consumers, and in particular to residents of Washington, Nevada, and Connecticut, whose laws give them specific rights over that data. TACA extends the rights described here to anyone who asks, regardless of where they live.
TACA is a 501(c)(3) nonprofit that provides education, support, resources, programs, events, and community connection for individuals and families impacted by autism.
TACA is not a healthcare provider, health plan, or healthcare clearinghouse. Information you give us is generally not protected health information under HIPAA. It is, however, covered by this notice.
This notice does not apply to information TACA collects about its employees or job applicants in that capacity.
2. What We Mean by “Consumer Health Data”
Consumer health data is personal information that is linked or reasonably linkable to a consumer and that identifies the consumer’s past, present, or future physical or mental health status.
For TACA, this can include:
– Health conditions and diagnoses: autism diagnosis, co-occurring conditions, developmental or behavioral diagnoses, diagnosis date, or the fact that a diagnosis is being sought.
– Symptoms and status: communication needs, sensory needs, behavioral concerns, and medical symptoms described in a support request.
– Treatments and interventions: therapies such as speech, occupational, behavioral, or physical therapy; medical treatments; dietary interventions; and supplements.
– Medications: medications taken or considered, described in a support request or program intake.
– Healthcare providers and services sought: the types of providers you are looking for, and the fact that you are seeking a diagnosis, evaluation, treatment, or services.
– Disability status: disability, functional needs, and requests for accommodations at an event or program.
– Education and developmental needs: IEP or 504 status, special education services, developmental milestones, and school supports.
– Health-related contact with TACA: the fact that you contacted TACA for autism-related support, the content of that request, and the program or resource referrals we make.
– Location: the ZIP or postal code you give us on a form, where it is held together with a support request or other health-related information. We treat a ZIP code as ordinary contact information, not as precise location, and we do not use it to infer that you are seeking care.
– Inferences: conclusions we could reasonably draw from the above, or from the health-related pages and resources you use on our website.
– Consumer health data does not include de-identified or aggregate information that cannot reasonably be linked to you, or publicly available information.
3. How We Collect Consumer Health Data
We collect consumer health data from the following sources:
Directly from you or your family. This is our primary and preferred source. You provide it when you:
– Contact us for support, information, or a referral
– Complete a program intake, application, or scholarship request
– Register for a conference, workshop, support group, or event, including accommodation and dietary requests
– Respond to a survey, program evaluation, or listening session
– Create an account or complete a profile
– Share a testimonial or story with us
– Post in a TACA-administered community group
– Speak with TACA staff or trained volunteers by phone, email, or in person
– Purchase and order information: Information related to purchases from our online store where the transaction or related context is linked to consumer health data, including applicable order, transaction, and fulfillment details.
From a parent, guardian, caregiver, or authorized representative who is seeking support on behalf of a child or dependent adult.
Automatically from your use of our website, in a limited way. Which pages you view on tacanow.org can suggest a health-related interest. We treat website activity on autism-related content as consumer health data where it is linkable to you.
Most TACA forms ask for a ZIP or postal code. Where that ZIP code sits alongside a support request or other health-related information, we treat the combined record as consumer health data and protect it accordingly.
We do not purchase consumer health data, and we do not obtain it from data brokers, advertising platforms, wealth-screening services, or other third-party data providers.
4. How We Use Consumer Health Data
We use consumer health data only for these purposes:
– To respond to your request for information, support, resources, or a referral
– To connect you with TACA programs, resources, or trained support staff appropriate to your situation
– To provide accommodations you request at a program or event
– To administer programs, scholarships, and events you apply for or attend
– To evaluate and improve our programs, in aggregated or de-identified form wherever possible
– To measure the reach and impact of our mission, in aggregated or de-identified form
– To maintain the records we need to operate as a nonprofit and to meet legal, tax, and audit obligations
– To protect the safety of an individual where there is an imminent risk of serious harm
– For any other purpose you specifically consent to at the time we collect the data
We do not use consumer health data to:
– Sell it to anyone
– Target advertising to you
– Build advertising audiences or upload it to advertising platforms
– Profile you for decisions that produce legal or similarly significant effects
– Determine whether you or your family are eligible for TACA support based on automated processing
– Set prices
– Train artificial intelligence or large language models operated by third parties
– Discriminate against you or your family
5. How We Share Consumer Health Data
We share consumer health data only in these limited circumstances:
– Service providers. Our constituent relationship management (CRM) system, email platform, website host, event registration platform, survey tools, and IT and security vendors may process consumer health data on our behalf when needed to operate the systems in which our records are stored and provide the services you request. Where they process data on our behalf, they are required by contract to protect it and use it only for authorized purposes. They may not sell it or use it for their own purposes.
– A partner organization co-hosting a program or event. Only where necessary to deliver the specific program or accommodation, and only with your consent, and only for that stated purpose.
– Government authorities, or in legal process. Where required by law, subpoena, or court order, or to protect against an imminent risk of serious harm, and only as legally required.
– A successor organization. If TACA merges, affiliates, or transfers assets, subject to the commitments in this notice.
– Anyone you direct. When you ask us to make a referral or to share your information, and only as you direct.
– Advertising and analytics platforms. TACA may use analytics and advertising technologies to measure website usage and campaign performance. We configure these technologies to avoid intentionally sending consumer health data to advertising platforms or analytics providers. The information these providers receive depends on the technology, its configuration, and your privacy choices. Where required by law, we obtain consent before applicable technologies collect or disclose information.
6. We Do Not Sell Consumer Health Data
TACA does not sell consumer health data, and we will not.
“Sell” here has the broad meaning given by Washington and Nevada law: the exchange of consumer health data for monetary or other valuable consideration. TACA does not engage in any such exchange.
If TACA ever contemplated selling consumer health data, applicable law may require a separate, signed authorization that is distinct from consent to collect or share the data. TACA does not currently sell consumer health data and does not currently seek such authorizations.
7. Consent
Where the law requires it, we obtain your affirmative, voluntary, opt-in consent before collecting or sharing consumer health data for any purpose beyond providing the specific product, service, or support you requested.
Consent is never bundled into terms of service or a general acceptance.
Providing consent is never a condition of receiving TACA programs, resources, or support.
You may withdraw consent at any time, and withdrawal takes effect going forward. To withdraw consent, email privacy@tacanow.org.
Where we collect consumer health data because it is necessary to provide something you specifically asked us for, such as arranging an accommodation you requested, we rely on that necessity rather than consent, and we limit the collection to what is strictly necessary.
8. Your Rights Regarding Consumer Health Data
You have the right to:
– Confirm whether TACA is collecting, sharing, or selling your consumer health data, and access that data.
– Obtain a list of all third parties and affiliates with which TACA has shared or sold your consumer health data, along with contact information for each. (We do not sell it; we will provide the list of those with which we have shared it.)
– Withdraw consent to the collection and sharing of your consumer health data.
– Delete your consumer health data. When you request deletion, TACA will delete applicable consumer health data from its records and systems as required by applicable law, including archived and backup systems subject to applicable backup limitations. Where required by law, we will also notify affiliates, processors, contractors, and other third parties with whom we have shared the consumer health data and request that they delete it.
– Not be discriminated or retaliated against for exercising any of these rights. We will not deny you programs, resources, or support, charge you differently, or provide a different level of service because you made a request.
How to exercise these rights
Email: privacy@tacanow.org. Please write “Consumer Health Data Request” in the subject line.
Mail: Privacy Request, The Autism Community in Action, 17752 Sky Park Circle, Suite 140, Irvine, CA 92614
Phone: (949) 640-4401
We will take reasonable steps to verify your identity before acting on a request to access or delete. We will not ask for more information than we need for that purpose.
An authorized agent, parent, guardian, or legal representative may submit a request on your behalf; we may ask for proof of authority.
Our response times
We will acknowledge your request promptly and respond within the time required by applicable law. For U.S. privacy requests, this may generally be within 45 days, subject to any applicable extension. For requests subject to UK or EEA data protection law, we will generally respond within one calendar month. Where applicable law permits an extension, including for complex requests or multiple requests, we will notify you within the required period and explain the reason for the extension.
Backups and archives
When you request deletion, we remove your consumer health data from our active systems, and from all parts of our network, including archived and backup systems, as the law requires. Where data sits in an encrypted backup that cannot be edited in place, we deleteit as that backup is cycled, and in no case later than six months after your request. In the interim, we do not access or use that data except to restore from a system failure, and if a restoration occurs we re-apply your deletion request to the restored copy.
Limits
We may decline or limit a deletion request where retaining or processing the information is required or permitted by applicable law, including where reasonably necessary to complete a transaction or provide a service you requested, comply with a legal obligation, protect against security incidents, fraud, or other unlawful activity, preserve the security or integrity of our systems, or establish, exercise, or defend legal claims. If we decline or limit a request, we will explain the applicable reason to the extent required by law.
9. Appeals
If we decline your request in whole or in part, we will explain our reasoning and how to appeal.
To appeal, reply to our decision or write to privacy@tacanow.org with “Health Data Appeal” in the subject line, within 45 days of our decision. We will respond in writing, with our reasons, within 45 days of receiving your appeal.
If we deny your appeal, you may submit a complaint to:
– Washington residents: Washington State Attorney General, Consumer Protection Division, at www.atg.wa.gov/file-complaint
– Nevada residents: Nevada Attorney General, Bureau of Consumer Protection, at ag.nv.gov/Complaints
– Connecticut residents: Connecticut Attorney General, at portal.ct.gov/AG
10. Geofencing
TACA does not use geofencing around any healthcare facility, therapy provider, school, or other location.
Washington law prohibits establishing a virtual boundary within 2,000 feet of any facility providing in-person health care services, and Nevada law prohibits the same within 1,750 feet, where the boundary is used to identify or track consumers, collect consumer health data, or send health-related notifications or advertising. TACA does not engage in any of these practices, at any distance.
A ZIP or postal code is not precise location information, and TACA does not treat it as such or derive precise location from it.
We do not use precise geolocation data to identify or track anyone seeking healthcare, therapy, evaluation, or support services, and we do not build audiences or send messages based on your physical proximity to any location.
11. How We Protect Consumer Health Data
We apply heightened safeguards to consumer health data, including:
– Restricting access to the staff and trained volunteers who need it to respond to your request or deliver your program
– Multi-factor authentication on systems that hold it
– Encryption in transit and, where available, at rest
– Contractual data protection commitments from every service provider that can access it
– Configuring our website, forms, and related technologies to reduce the collection or transmission of consumer health data through advertising and marketing technologies, consistent with applicable law and our technical configurations
– Retaining it only as long as reasonably necessary, then deleting, de-identifying, aggregating, or securely disposing of it as appropriate and as permitted or required by applicable law
– Privacy training for staff and volunteers who handle support requests
12. How Long We Keep Consumer Health Data
We keep consumer health data only as long as reasonably necessary for the purpose for which you gave it to us:
– Support request and referral correspondence: Generally up to 3 years after the matter is closed, subject to applicable legal, administrative, operational, security, audit, and recordkeeping requirements.
– Program or scholarship application information: Generally up to 7 years after the applicable program or application cycle ends, where reasonably necessary for reporting, audit, grant, legal, or recordkeeping requirements. Health, diagnosis, and disability information within these records is retained according to the criteria described in TACA’s Privacy and Cookie Policy.
– Event accommodation and dietary requests: Only as long as reasonably necessary for the event and related administrative or operational purposes, after which the information is deleted, de-identified, or securely disposed of when no longer reasonably needed.
– Survey and evaluation responses: Retained only as long as reasonably necessary for the purposes for which they were collected. Where practicable, TACA may de-identify or aggregate responses so that they are no longer associated with an individual.
– Website activity indicating health interest: Retained according to the applicable website analytics, advertising, and log-data retention settings, which TACA configures based on the purposes for which the information is used and applicable law. Where applicable, these settings are generally 14 months or less.
13. Children
Where a parent, guardian, or caregiver provides consumer health data about a child, we treat that data under this notice and use it only for the purpose for which it was provided. We do not use it for advertising, we do not sell it, and we do not disclose it outside the limited circumstances in Section 5.
A parent, guardian, or other authorized representative may exercise applicable rights on behalf of a child where permitted by law.
14. Changes to This Notice
We will update this notice as our practices or the law change, and will revise the “Last Updated” date above. Where applicable law requires notice or affirmative consent before we introduce a new category or purpose for collecting, using, or sharing consumer health data, we will provide the required notice and obtain the required consent before doing so.
15. Contact Us
The Autism Community in Action (TACA)
Attn: Privacy 17752 Sky Park Circle, Suite 140 Irvine, CA 92614
Email: privacy@tacanow.org
Phone: (949) 640-4401