GDPR and International Privacy Notice

1.Scope

EVAC provides behavioral health services in Texas, United States. We do not target services to people in Europe, but if you visit this website or contact us from the EEA, UK, or Switzerland, this notice explains how the General Data Protection Regulation (GDPR), the UK GDPR, and similar laws apply. It supplements our Website Privacy Policy and Cookie Policy. Health information created as part of treatment is also covered by our HIPAA Notice of Privacy Practices.

2.Data controller

The controller of personal data collected through this website is Eastern Virginia Advanced Care, LLC, 2600 South Loop West, Suite 240, Houston, TX 77054, United States. You can reach us about any privacy matter at [email protected] or 346-618-0372.

3.Personal data we process

• Contact details and messages you send through our forms (Contact, Book a Consultation, Referral, Donation inquiry, Careers, and newsletter).
• Information about a referred person submitted by a professional, agency, or family member.
• Employment application details.
• Technical data such as IP address, browser and device type, and cookie choices.
• Special category data (health information) only where you or a referral source choose to share it so that we can arrange care.

4.Legal bases for processing

• Consent (Article 6(1)(a)): newsletter sign-up and third-party content cookies such as Google Maps. You may withdraw consent at any time.
• Steps before entering a contract, or performing one (Article 6(1)(b)): responding to consultation requests, intake, referrals, and job applications.
• Legitimate interests (Article 6(1)(f)): answering general inquiries and donation questions, keeping the website secure, and preventing abuse. We balance these interests against your rights.
• Legal obligation (Article 6(1)(c)): keeping records required by law, including medical-record and employment rules.
• Health data (Article 9(2)(a) and (h)): your explicit consent when you choose to share it, and the provision of health or social care by professionals bound by confidentiality.

5.Your rights

Subject to legal conditions and exceptions, you have the right to:

• Access the personal data we hold about you and receive a copy.
• Correct inaccurate or incomplete data.
• Erase your data ("right to be forgotten"), unless we must keep it by law, for example within a health record.
• Restrict or object to processing, including processing based on legitimate interests.
• Data portability: receive data you provided in a structured, machine-readable format.
• Withdraw consent at any time, without affecting processing that took place before withdrawal.
• Not be subject to decisions based solely on automated processing. We do not make such decisions.
• Lodge a complaint with your local data protection authority (for example, the ICO in the UK or the supervisory authority in your EU country).

6.How to make a request

Email [email protected] with the subject line "Privacy Request" or call 346-618-0372. Tell us which right you want to use and how we can reach you. We may need to confirm your identity before acting. We respond within one month, which may be extended by two further months for complex requests, and we will tell you if that happens. Requests are free of charge unless they are clearly unfounded or excessive.

7.International transfers

We and our service providers store and process data in the United States. When data is transferred from the EEA, UK, or Switzerland, we rely on the EU-U.S. Data Privacy Framework and its UK and Swiss extensions where a provider is certified, or on Standard Contractual Clauses approved by the European Commission (and the UK Addendum), together with supplementary safeguards such as encryption in transit.

8.Recipients

We share personal data only with service providers acting on our instructions (website hosting, database and email delivery, and JotForm for intake and referral forms), with Google when you allow map content, with professional advisers, and with authorities where the law requires it. We do not sell personal data or use it for advertising.

9.Retention

We keep general inquiries for up to 2 years, unsuccessful job applications for up to 1 year, newsletter data until you unsubscribe, and cookie consent records for 180 days. Information that becomes part of a health or employment record is kept for the periods Texas and federal law require.

10.Security

We use encrypted connections (HTTPS), restricted staff access, password protection for the administrative area, and reputable hosting providers. If a personal data breach is likely to put your rights at risk, we will notify you and the relevant authorities as the law requires.

11.Children

This website is meant for adults. Services for minors are arranged by a parent, guardian, or authorized referral source. We do not knowingly collect online data directly from children under 16 in the EEA (or 13 in the UK) without parental consent.