Privacy policy
What we collect, why we collect it, who sees it, and how to make us delete it. Written to be read, not skimmed past.
Current as of September 2, 2026. This policy covers coloradoesaletter.org. Health information handled by our clinicians carries the extra protections described on our HIPAA compliance page.
Six promises, and the mechanism behind each
A privacy policy is easy to write and hard to keep. Each promise below is paired with the thing that actually makes it true, so you can judge it rather than take it on faith.
1. We will not sell your information
Not to advertisers, data brokers or lead generators. Mechanism: there is no such revenue line in this business, and no integration exists to send data anywhere it could be monetised.
2. We will not track you across the web
No advertising pixels following you after you leave. Mechanism: the site loads no third-party advertising scripts. Where analytics run at all, they are configured to avoid collecting information that identifies you.
3. We will not contact your landlord or HOA
Not to verify, not to follow up, not for any reason. Mechanism: we do not collect your landlord's contact details in the first place, unless you supply them with a signed authorisation telling us exactly what to send.
4. We will not use your health information to market to you
Mechanism: clinical records and mailing systems are separate, and marketing email is opt-in only with an unsubscribe link on every message.
5. We will tell you what we hold
Mechanism: a written request to support triggers a verified copy within 30 days. The categories are: your contact details; your screening answers and consultation notes; payment confirmation and the last four digits of your card; technical logs such as IP address and browser type; and any messages you have sent us.
6. We will delete what we are allowed to delete
Mechanism: same request route. Clinical records must be retained for a period set by Colorado law and professional standards, and we will tell you specifically what falls into that category rather than hiding behind it.
Cookies, without the banner theatre
The site sets cookies necessary to function: holding your place through booking, and protecting the payment step against fraud. Block cookies in your browser and every page here still reads normally; booking and payment will fail, because they genuinely depend on them.
Live chat is a third party
The chat widget is operated by an external provider under its own privacy policy. It is the right channel for booking, pricing and questions about a letter you already hold. It is the wrong channel for clinical detail. Bring that to your consultation, which runs encrypted and HIPAA-aligned.
Where to complain
Start with us at support@coloradoesaletter.org. Beyond that, the Colorado Attorney General's office handles consumer data complaints, and the HHS Office for Civil Rights handles health privacy specifically. Both are listed below.
Security, stated without spin
TLS with 256-bit encryption in transit, encryption at rest, role-restricted and logged access, business associate agreements with any vendor touching health information. What we will not claim is that this makes anything unbreakable. No system is. We review, we patch, and we would tell you promptly if something went wrong.
Under 18
Built for adults. A minor needing an evaluation must have a parent or legal guardian arrange and attend it. If you think we hold a child's information collected without proper consent, write to us and it will be deleted.
Changes
The date at the top always reflects the current version, and material changes are announced by email rather than slipped in quietly.
Privacy questions
Do you sell data to advertisers?
No, and there is no mechanism by which we could. The site loads no third-party advertising scripts and health information is never used for marketing.
Will you contact my landlord to verify anything?
No. We do not even collect your landlord's details unless you supply them with a signed authorisation specifying exactly what we may send.
Can I browse with cookies blocked?
Yes, every page reads normally. Booking and payment depend on functional cookies and will fail without them.
How do I get my data deleted?
Email support with 'Privacy request' as the subject. We delete what we can and tell you exactly what Colorado record-retention rules require us to keep.
Is the chat widget covered by this policy?
It is operated by a third party under its own policy. Use it for booking and billing questions, not for clinical detail.
Official sources for this page
Nothing legal on this page is asserted without a source behind it. Open them and read the originals rather than taking our summary on trust.
- Colorado Attorney General — Data protection lawsColorado's consumer data protection and breach notification framework.
- Colorado Attorney General — Consumer ProtectionWhere Colorado residents raise concerns about how a business handles their data.
- FTC — Privacy and Security guidanceThe federal standard for handling consumer data and describing those practices.
- HHS — HIPAA for IndividualsYour federal health privacy rights, which apply alongside this policy.
- FTC Consumer Advice — Online privacy and securityPractical federal guidance on protecting your own information.
- CISA — Secure Our WorldFederal cybersecurity guidance on protecting accounts and devices.
- HHS Office for Civil Rights — File a ComplaintThe federal route for health privacy complaints.