Effective date: [Month DD, 2026]
1. Who We Are and What This Policy Covers
This Website Privacy Policy explains how Visions Treatment Centers, LLC (“Visions,” “we,” “us”) collects, uses, and shares information when you visit visionsteen.com and any page that links to this policy (the “Site”), call a phone number shown on the Site, or send us a message through the Site.
This policy covers the Site only. If you become a client of Visions, information about your care is protected health information governed by our Notice of Privacy Practices under HIPAA and, for substance use disorder treatment records, by 42 CFR Part 2. Where this policy and the Notice of Privacy Practices both apply, the Notice of Privacy Practices controls.
We designed the Site so that your visit is between you and Visions. We do not use advertising pixels, do not sell or share your information for advertising, and do not load optional analytics until you choose to allow them. The sections below explain exactly what that means.
2. Information We Collect
Information you give us. When you fill in a contact or inquiry form, request a call back, take the Site quiz, or email us, we receive what you choose to provide: your name, email address, phone number, the message you write, and any details about yourself or a family member that you include. You decide how much to share. The form reaches Visions only; it is not read by any advertising or analytics service.
Information from phone calls. The phone numbers on the Site are managed by a call-tracking service so we know which pages lead families to call us. When you call, the service records the number you called from, the number you dialed, the date, time and duration of the call, and the Site page that displayed the number. Calls may be recorded for admissions and quality purposes; if so, you will hear a notice at the start of the call. [Delete the recording sentence if calls are not recorded.]
Information collected automatically. When you load a page, our web server and content delivery network receive your IP address, browser type, device type, the page you requested, the page that referred you, and the time of the request. We keep these logs for security and to keep the Site running. If you accept optional analytics cookies (Section 5), we also receive de-identified usage statistics such as which pages are viewed and for how long.
Information we do not collect through the Site. We do not ask for Social Security numbers, insurance member IDs, dates of birth, diagnoses, or medication lists on this Site. If you need to share that information with our admissions team, we will tell you how to do so securely. Please do not put it in a web form.
3. Health-Related Information and How We Treat It
Visiting a treatment center’s website can itself say something about your health or a family member’s. We treat the record of your visit, including the pages you view, the searches you run on the Site, and the messages you send, as confidential.
- We do not disclose which pages you viewed, what you searched for, or what you wrote in a form to any advertising company, social media platform, or data broker.
- We do not use health-related information from the Site to target you or anyone else with advertising, on this Site or anywhere else.
- Service providers that handle Site data for us (Section 6) do so under written contracts that limit their use of it to providing their service to Visions. Where a provider handles information that may identify a prospective client, we have a HIPAA business associate agreement with that provider.
- Information you submit through a form or by phone goes to our admissions team and is handled under our Notice of Privacy Practices from that point.
If you are already a Visions client and log into any client or family portal, that portal has its own privacy terms and is covered by our Notice of Privacy Practices, not by this policy. [Delete if no portal exists.]
4. How We Use Information
We use the information described above to:
- respond to your inquiry, call you back, and answer questions about our programs;
- verify that a phone call or form came from a real person and not an automated attack;
- operate, secure, and troubleshoot the Site;
- understand, in aggregate, which pages and resources families find useful, so we can improve them (only with your consent, Section 5);
- know which of our pages lead families to call us, so we can keep the information that helps most (call-tracking data, Section 2);
- comply with legal obligations, including licensing and accreditation requirements, and respond to lawful requests;
- protect the rights, safety, and property of Visions, our clients, and others.
We do not use Site information to build advertising profiles, to retarget you on other websites or social media, or to infer health conditions about you for marketing.
5. Cookies, Analytics and Tracking
When you first visit the Site you will see a cookie notice with two equal choices: Accept and Reject all, plus a Cookie settings link. Until you make a choice, the Site loads only the essential items listed below. Nothing optional runs before you decide, and choosing Reject all or closing the notice keeps it that way. You can change your choice at any time from the “Cookie settings” link in the footer of every page.
Essential (Always On)
These are needed for the Site to work and do not track you across other websites.
| Item | Set by | Purpose | Lifetime |
|---|---|---|---|
| cookielawinfo-checkbox-* / CookieLawInfoConsent | Visions (consent banner) | Remembers the cookie choice you made | 11 months |
| wordpress_* / PHPSESSID | Visions | Keeps the page working during your visit | Session |
| Google reCAPTCHA | Google LLC | Blocks automated spam on our forms; loads only on pages with a form | Session |
| Call-number display | CallRail, Inc. | Shows the correct phone number for the page you are on | Session |
Optional Analytics (Off Until You Accept)
If you click Accept, we turn on Google Analytics 4 in a restricted configuration: IP addresses are not stored, Google Signals and advertising features are off, the analytics property is not linked to any Google Ads account, and search terms you type into the Site search are not sent. Google acts as our processor for this data and is contractually limited to providing the analytics service. The cookies involved are _ga and _ga_* (2 years). With your consent, CallRail may also connect a call you make to the pages you viewed before calling, so we can see which information led you to reach out.
[Alternative paragraph if the client moves to first-party analytics: “Optional analytics (off until you accept). If you click Accept, we turn on a privacy-focused analytics tool, [Matomo / Plausible / Fathom], hosted [on our own servers / by the vendor in the EU]. It counts page views and visit lengths without cookies that identify you, does not share data with any advertising company, and does not follow you to other websites.”]
What We Do Not Use
The Site does not use the Meta (Facebook) Pixel, TikTok Pixel, Google Ads remarketing tags, LinkedIn Insight Tag, session-replay or heat-mapping tools, or any third-party data broker or audience-matching service. If we ever propose to add a tool of this kind, we will update this policy first and the tool will be off until you consent.
Embedded Content
Some pages embed videos hosted by YouTube. We use YouTube’s privacy-enhanced mode, which does not set cookies until you press play. Pressing play is governed by Google’s privacy policy. [Edit to match the actual embeds in use.]
Do Not Track and Global Privacy Control
Our Site honors the Global Privacy Control (GPC) browser signal as a Reject all choice for optional cookies. Because there is no industry standard for Do Not Track, we treat it the same way.
6. Who Receives Information from the Site
We share Site information only with the companies below, each of which works for Visions under a written contract, and with the people at Visions who need it to respond to you. We do not sell it, rent it, or trade it.
| Recipient | What it receives | Why | Basis |
|---|---|---|---|
| [Hosting provider / CDN, e.g. WP Engine, Cloudflare] | Server logs: IP address, page requested, browser type | Hosting and security | Service contract; BAA [if available] |
| CallRail, Inc. (Atlanta, GA) | Caller phone number, number dialed, call time and length, page that showed the number; with consent, pages viewed before the call | Routing calls to admissions and measuring which pages lead to calls | Service contract and HIPAA business associate agreement; HIPAA-compliant plan |
| Google LLC – reCAPTCHA | Interaction signals on form pages | Spam and bot prevention | Service contract |
| Google LLC – Google Analytics 4 (only with your consent) | De-identified page view and visit data, no IP storage, no advertising features | Aggregate usage statistics | Consent; Google Analytics data processing terms |
| [Form / email platform the submissions go to, e.g. Gravity Forms + Microsoft 365] | Form contents and your email address | Delivering your message to admissions | Service contract; BAA |
| [Quiz / chat / insurance-verification vendor, if any] | [what it receives] | [purpose] | [contract / BAA] |
We may also disclose information when required by law, to respond to a subpoena, court order, or regulatory request, to protect someone’s safety, or in connection with a merger, sale, or reorganization of Visions (in which case this policy continues to apply to the information). Substance use disorder treatment records are not disclosed in response to a subpoena alone; 42 CFR Part 2 requires a specific court order.
We review this list at least quarterly and whenever a tool is added to or removed from the Site.
7. We Do Not Sell or Share Your Information
Visions does not sell personal information and does not “share” it for cross-context behavioral advertising, as those terms are defined in the California Consumer Privacy Act. We have not done so in the preceding 12 months. We do not use or disclose sensitive personal information, including health-related information, for any purpose other than providing the services you ask about and operating the Site. Because we do not sell or share, there is no “Do Not Sell or Share” choice to make; the GPC signal is still honored for optional cookies (Section 5).
We do not knowingly disclose information from the Site to any company for the purpose of advertising, profiling, or audience matching, and no company is permitted to use Site information for its own marketing.
8. Your Choices and Rights
Cookie choices. Use the banner on your first visit, or the Cookie settings link in the footer, to accept or reject optional analytics at any time. Rejecting them does not change what the Site can do for you.
Email. If you asked to receive email from us, every message includes an unsubscribe link. Transactional messages that answer your inquiry are not marketing.
Access, correction, and deletion. You may ask us what personal information we hold about you from the Site, ask us to correct it, or ask us to delete it. Email [privacy@visionsteen.com] or call [(866) 750-1146] and say you are making a privacy request. We will confirm your identity using the contact details you gave us and respond within 45 days. We will not treat you differently for making a request. Some information must be kept under health-record, licensing, or legal-hold requirements; if we cannot delete something, we will tell you why.
California residents. In addition to the above, you have the right to know the categories and specific pieces of personal information we have collected, the categories of sources, the business purposes, and the categories of third parties with whom it is shared; the right to limit use of sensitive personal information (we already limit it as described in Section 7); and the right to appoint an authorized agent to make a request for you. Section 2 lists the categories we collect (identifiers, contact details, internet activity, and, if you choose to include it in a message, health-related information). Information covered by HIPAA or the California Confidentiality of Medical Information Act is handled under those laws rather than the CCPA.
Residents of other states. Residents of states with comprehensive privacy laws (including Colorado, Connecticut, Virginia, Texas, Oregon, and others) may exercise the access, correction, deletion, and portability rights those laws provide using the same contact details. If we decline a request, we will explain why and how to appeal; you may also contact your state attorney general.
Appeals. If you disagree with our response, reply to our message within 30 days and ask for an appeal. A different member of our team will review it and respond within 45 days.
9. Consumer Health Data Privacy Notice
This section is provided for residents of Washington, Nevada, Connecticut, and any other state with a consumer health data law, and applies to “consumer health data” that is not already covered by HIPAA. On this Site, that may include a message you write describing a health condition, a Site search for a condition or treatment, or the fact that you viewed a page about a specific condition.
- What we collect: only what you choose to type into a form or search box, and, if you accept analytics, de-identified page-view statistics.
- Why: to respond to your inquiry and to operate the Site. No other purpose.
- Sources: you.
- Who receives it: the service providers in Section 6, under contracts that limit their use to serving Visions. Nobody else.
- Sale: we do not sell consumer health data and will not without your separate, signed authorization.
- Geofencing: we do not use geofencing around any facility that provides health care services.
- Your rights: to confirm whether we hold your consumer health data, to access it, to withdraw consent, to have it deleted, and to a list of the third parties that received it. Make a request as described in Section 8. Appeals are handled as described there. Washington residents may also contact the Washington Attorney General if an appeal is denied.
10. Security, Retention, Children, and Other Sites
Security. The Site is served over HTTPS. Form submissions are delivered to our admissions team through [encrypted email / a HIPAA-compliant form platform]. Access to inquiry information is limited to staff who need it. No website can promise absolute security; if you prefer, call us instead of using a form.
Retention. Web server logs are kept for [90 days]. Consent-banner records are kept for [12 months] after your last visit so we can show what you chose. Analytics data, if you consented to it, is kept for [14 months] in aggregate form. Inquiry messages are kept as long as needed to respond and then under our records-retention schedule; once you become a client, they become part of your treatment record.
Children. Visions treats adolescents, so the Site is written for parents, guardians, and teens together. We do not knowingly collect personal information from anyone under 13 through the Site without a parent’s involvement. If you believe a child has sent us information without a parent’s knowledge, contact us and we will delete it. Teens may contact us directly; information they share is handled with the same confidentiality described in Section 3.
Other websites. Links to other sites, including social media, insurance providers, and accreditation bodies, take you to pages we do not control. Their privacy practices are their own. Our social media pages are governed by the platform’s terms; we do not receive individual visitor data from the platform about who viewed our Site.
11. Changes to This Policy and How to Reach Us
When we change this policy we will post the new version here with a new effective date and keep prior versions available on request. If a change would let a new company receive information from the Site, the change takes effect only after it is posted, and any new optional tool stays off until you consent.
Privacy Contact
Visions Treatment Centers, LLC
Attn: Privacy Officer
[Street address]
[City], CA [ZIP]
Email: [privacy@visionsteen.com]
Phone: [(866) 750-1146]
You may also submit a request through the privacy request form on this Site.
For questions about your treatment records or our HIPAA practices, see our Notice of Privacy Practices or contact our Privacy Officer at the address above.
