Privacy Policy

1. Information We Collect

Legacy Health Foundation collects personal information only as necessary to deliver our programs, process donations, coordinate volunteer activities, and communicate with stakeholders. The types of information we may collect include:

• Contact Information: Name, email address, phone number, and mailing address provided through enrollment forms, donation transactions, volunteer applications, and general inquiries.
• Health-Related Information: Self-reported health conditions, medication lists, mobility assessments, cognitive screening results, and caregiver status collected during program enrollment and service delivery. This information is treated with the same confidentiality standards as Protected Health Information (PHI) under HIPAA, even though Legacy Health Foundation is not a HIPAA-covered entity.
• Demographic Data: Age, language preference, zip code, and self-identified race/ethnicity collected voluntarily for program planning, grant reporting, and health equity analysis. This information is always reported in aggregate and never linked to individual identities in public documents.
• Financial Information: Donation amounts, payment methods, and employer matching information processed through our secure donation platform. Legacy Health Foundation does not store credit card numbers or bank account details on our servers.
• Website Usage Data: Standard web analytics data including page views, referring URLs, browser type, and device information. We do not use tracking cookies for advertising purposes.

2. How We Use Your Information

Personal information is used exclusively for the following purposes:

• Enrolling participants in programs and coordinating service delivery, including scheduling appointments, matching participants with navigators, and tracking attendance and outcomes.
• Processing and acknowledging tax-deductible donations, issuing annual giving statements, and communicating with donors about the impact of their contributions.
• Recruiting, training, and coordinating volunteers, including background check processing through our authorized screening partner.
• Reporting aggregate program outcomes to funders, including the Oregon Community Foundation, Meyer Memorial Trust, the Administration for Community Living, and Providence Health & Services Community Benefit. All funder reports use de-identified, aggregate data only.
• Communicating with participants, donors, and volunteers about program schedules, organizational updates, and community resources through email newsletters and direct mail. Recipients may opt out of non-essential communications at any time.
• Improving our programs and services through aggregate data analysis, participant satisfaction surveys, and outcomes research conducted in accordance with our research data protocols.

3. Protected Health Information (PHI) Standards

Although Legacy Health Foundation is a community-based non-profit organization and not a HIPAA-covered entity, we voluntarily adopt HIPAA-aligned privacy and security standards for all health-related information collected during program activities. Specifically:

• Health information is stored in encrypted, access-controlled electronic records systems with role-based permissions. Only staff and volunteers with a direct service relationship to a participant may access that participant’s health information.
• Paper records containing health information are stored in locked filing cabinets in our secured office suite and shredded upon completion of the applicable retention period.
• Staff and volunteers receive annual privacy and confidentiality training covering information handling, breach notification, and the consequences of unauthorized disclosure.
• Health information is never shared with third parties without explicit written consent from the participant, except as required by Oregon mandatory reporting laws (ORS 124.050–124.095) regarding elder abuse and neglect.
• Participants have the right to request access to their own records, request corrections to inaccurate information, and request restrictions on how their information is used, by contacting our Privacy Officer at [email protected] or (503) 555-0194.

4. Data Sharing and Third Parties

Legacy Health Foundation does not sell, rent, lease, or trade personal information to any third party for any purpose. We do not share participant information with marketing companies, data brokers, or advertising networks. Information is shared with third parties only in the following limited circumstances:

• With the participant’s explicit written consent, for the purpose of coordinating referrals to partner healthcare providers, social service agencies, or community resources.
• With authorized background check providers for volunteer screening purposes, limited to name, date of birth, and Social Security Number, transmitted via encrypted channels.
• With our secure payment processor for donation transactions. Payment processors operate under their own PCI-DSS compliant privacy policies.
• As required by law, including Oregon mandatory elder abuse reporting statutes, court orders, or legal proceedings.

5. Research Data Protocols

Legacy Health Foundation occasionally conducts or participates in research studies aimed at improving elder health outcomes and program effectiveness. All research activities adhere to the following protocols:

• Research using participant data requires prior review and approval by an independent ethics committee or Institutional Review Board.
• Individual participation in research is always voluntary and requires separate informed consent beyond program enrollment consent.
• Research datasets are fully de-identified in accordance with the HIPAA Safe Harbor method before analysis or publication, removing all eighteen categories of identifying information.
• Research findings are published only in aggregate and are made available to participants and the public through our annual impact report and website.

6. CCPA and Oregon Privacy Rights

Residents of California and Oregon have specific rights regarding their personal information under the California Consumer Privacy Act (CCPA) and Oregon Consumer Privacy Act (OCPA). Although Legacy Health Foundation’s activities may fall below the statutory thresholds for mandatory compliance with these laws, we extend the following rights to all individuals regardless of location:

• The right to know what personal information we have collected about you.
• The right to request deletion of your personal information, subject to legal retention requirements.
• The right to opt out of the sale of personal information (we do not sell personal information).
• The right to non-discrimination for exercising your privacy rights.

To exercise any of these rights, contact our Privacy Officer at [email protected] or call (503) 555-0194. We will respond to verifiable requests within 45 calendar days.

7. Data Retention

Personal information is retained only as long as necessary to fulfill the purposes for which it was collected, comply with legal and regulatory requirements, and support legitimate organizational interests. Program participant records are retained for seven years following the last date of service, in alignment with Oregon records retention guidelines. Donation records are retained for seven years for tax compliance purposes. Volunteer records are retained for three years following the end of volunteer service. Website analytics data is retained for 26 months and is not linked to individual identities.

8. Website and Cookies

The Legacy Health Foundation website (legacyhealthfoundation.org) uses only essential cookies required for basic website functionality, such as form submission and session management. We do not use advertising cookies, social media tracking pixels, or third-party analytics platforms that create individual user profiles. Our website is hosted on secure servers with SSL/TLS encryption. We do not collect IP addresses for purposes other than server security and aggregate traffic analysis.

9. Children’s Privacy

Legacy Health Foundation’s programs are designed for adults aged 55 and older and their adult family caregivers. We do not knowingly collect personal information from individuals under 18 years of age. If we become aware that we have inadvertently collected information from a minor, we will promptly delete it and notify the parent or guardian.

10. Changes to This Policy

Legacy Health Foundation reserves the right to update this privacy policy as necessary to reflect changes in our practices, technology, legal requirements, or organizational policies. Material changes will be communicated through our website and, where appropriate, by direct notice to affected individuals. The “Last Updated” date at the top of this page indicates when the most recent revision was published.

11. Contact Our Privacy Officer

For questions, concerns, or requests regarding this privacy policy or Legacy Health Foundation’s data practices, contact:

Privacy Officer
Legacy Health Foundation
2205 NW Vaughn Street, Suite 140
Portland, OR 97210
Phone: (503) 555-0194
Email: [email protected]