Privacy Policy

Information We Collect

We collect different types of information depending on how you interact with our website and services.

When You Request Help (Get Help Form)

If you reach out for support through our intake form, we collect your name, phone number, email address (optional), home address (optional), county, household size, urgency level, the services you need help with, and a description of your situation in your own words.

When an Agency Makes a Referral (Referral Form)

When a service provider or agency refers a client to us, we collect:

• The referrer's name, agency, email, and phone number
• The client's name and phone number
• The services requested, urgency level, and reason for the referral

A referral can only be submitted after the referrer confirms the client has given verbal or written consent.

When You Contact Us (Contact Form)

If you send us a message through our contact form, we collect your name, email address, phone number (optional), subject (optional), and your message.

When You Sign Up to Help (Volunteer Form)

If you express interest in volunteering or getting involved through our Get Involved page, we collect your name, email address, phone number (optional), your areas of interest (such as volunteering at events, mentoring, donating supplies, or corporate partnerships), and any additional message you provide.

When You Make a Donation (Donation Form)

When you donate, we collect the amount, frequency (one-time or recurring), and whether you chose to cover processing fees. Your payment information (credit card number, billing address) is collected and processed directly by Stripe, our payment processor. We do not store your credit card number on our servers. Stripe shares your name and email with us so we can send a donation confirmation.

Sensitive Information

Some information collected through our intake and referral processes may be sensitive in nature, including details about behavioral health, substance use, justice system involvement, or domestic situations. We apply heightened protections to this information and limit access strictly to navigators and staff directly involved in your care.

Information Collected Automatically

When you submit any form on our website, our system records your IP address, the date and time of submission, and the page you submitted from. This information is stored in our audit log for security and compliance purposes. Our website uses HTTPS encryption for all connections.

We use Google Analytics to understand how visitors use our website (pages visited, time on site, referral sources). Google Analytics collects information such as your IP address (anonymized), browser type, device type, and pages viewed using cookies. This data is aggregated and does not personally identify you. You can opt out of Google Analytics by installing the Google Analytics Opt-out Browser Add-on. Google's use of this data is governed by Google's Privacy Policy.

Our website is delivered through Cloudflare, which may collect technical data such as your IP address, browser type, and request metadata for security, performance, and content delivery purposes. Cloudflare processes this data as described in Cloudflare's Privacy Policy.

Information We Do Not Collect

We do not use advertising trackers or serve ads on our website. We do not sell or share your browsing data with advertisers. The cookies used on our site are limited to functional cookies required for the website to operate (session management), analytics cookies set by Google Analytics, security and performance cookies set by Cloudflare, and payment processing cookies set by Stripe during the donation checkout process.

How We Use Your Information

We use the information we collect to:

• Connect you with a navigator who can help coordinate your support services
• Respond to your questions or messages
• Process your donations and send tax-deductible receipts
• Coordinate with partner service providers to deliver wraparound support across housing, employment, behavioral health, legal aid, transportation, and education
• Comply with grant reporting requirements (using only aggregated, anonymized data that cannot identify you)
• Maintain audit logs for security and accountability
• Improve our services and website

We will never use your information for marketing purposes or sell it to anyone.

Who We Share Your Information With

We share your personal information only in the following circumstances.

Partner Service Providers. When you request help, your navigator may share relevant information with partner organizations (housing agencies, employers, legal aid providers, behavioral health services, transportation providers) to coordinate your care. We only share what is necessary to deliver the specific services you need.

Stripe. When you make a donation, your payment information is processed by Stripe, Inc. When processing your donation, Stripe acts as an independent data controller for the payment transaction. E&L acts as the data controller for all other information collected through our website. Stripe's handling of your data is governed by Stripe's privacy policy.

Google Analytics. We use Google Analytics to collect aggregated, anonymized data about how visitors use our website. Google may process your IP address (anonymized), browser type, and pages visited. Google's use of this data is governed by Google's Privacy Policy.

Cloudflare. Our website is delivered through Cloudflare's content delivery and security network. Cloudflare may process your IP address and request metadata to protect the site from malicious traffic and deliver content efficiently. Cloudflare's handling of this data is governed by Cloudflare's Privacy Policy.

Email Services. We use email services to send form confirmations and donation receipts. These services process your email address and name only for the purpose of delivering those messages.

Grant Funders. We may report aggregated, anonymized statistics (such as the total number of clients served or services provided) to grant funders. We never share individual client information with funders.

Law Enforcement or Legal Process. We may disclose your information if required to do so by law, court order, or legal process. We will make reasonable efforts to notify you before doing so unless we are legally prohibited from doing so.

We never sell, rent, or trade your personal information. We do not sell your personal data as defined under any applicable state privacy law.

Data Security

We take the security of your data seriously and use multiple layers of protection:

• All data transmitted between your browser and our systems is encrypted in transit using HTTPS/TLS.
• Sensitive client information is encrypted at rest using industry-standard encryption. Your name, phone number, email, address, and case notes are stored in encrypted form that cannot be read without the decryption key.
• Access to client data is restricted by role. Staff members can only access the information necessary to perform their duties. Navigators can only view information for clients they are directly working with.
• All staff are required to use multi-factor authentication to access client information. Each staff member has a unique account — shared logins are prohibited.
• Every access to client data is recorded in a tamper-proof audit log, including who accessed the information, when, and what action was taken. These logs cannot be modified or deleted.
• Client session data automatically expires after a period of inactivity.
• Form submissions are validated and sanitized to prevent malicious input.
• Encrypted backups are performed daily and stored securely.

No system is 100% secure. While we take reasonable measures to protect your information, we cannot guarantee absolute security. In the event of a data breach affecting your personal information, we will notify affected individuals without unreasonable delay in accordance with West Virginia Code §46A-2A-102 and within the timeframes required by our business associate agreements.

Data Retention

We retain different types of information for different periods:

• Client and referral records are retained for the duration of your active service relationship with E&L, plus three years after your last interaction with us. This allows us to provide continuity of care if you return for services.
• Donation records are retained for seven years to comply with IRS record-keeping requirements for 501(c)(3) organizations.
• Contact form and volunteer sign-up submissions are retained for 12 months, then deleted.
• Audit logs are retained for a minimum of six years as required by our compliance obligations.

You may request earlier deletion of your data at any time (see Your Rights below), subject to our legal and regulatory obligations.

Your Rights

You have the following rights regarding your personal information:

• Access. You can request a copy of the personal information we hold about you.
• Correction. You can ask us to correct inaccurate or incomplete information.
• Deletion. You can ask us to delete your personal information. We will comply unless we are required to retain it for legal, regulatory, or grant compliance reasons.
• Withdraw Consent. If you previously gave consent for us to use your information in a specific way, you can withdraw that consent at any time.
• Opt-Out. You can ask us to stop sharing your information with partner service providers at any time, though this may limit our ability to coordinate services on your behalf.

To exercise any of these rights, contact us at support@empowerandlink.org or (413) 676-9370 We will respond within 30 days.

Confidentiality

All client information is treated as confidential regardless of whether HIPAA or other specific regulations apply. Our staff are trained on confidentiality practices and access client information only when it is necessary to perform their role. Information shared during the intake or navigation process is not disclosed to anyone outside the care team without your consent, except as described in the “Who We Share Your Information With” section above.

Information related to substance use disorder (SUD) services receives additional protections under federal regulation 42 CFR Part 2, which restricts the use and disclosure of such records beyond standard privacy protections. When SUD-related information is shared with an external party, we include a notice prohibiting further disclosure: “This information has been disclosed to you from records protected by federal confidentiality rules (42 CFR Part 2). The federal rules prohibit you from making any further disclosure of this information unless further disclosure is expressly permitted by the written consent of the person to whom it pertains or as otherwise permitted by 42 CFR Part 2.” Every disclosure of SUD records is documented in a permanent, unalterable log including what was shared, with whom, for what purpose, and under what authorization.

SUD records may not be used to initiate or substantiate any criminal charges or to conduct any criminal investigation of a client, and cannot be disclosed in any civil, criminal, administrative, or legislative proceeding without a court order that meets the requirements of 42 CFR Part 2.

Children's Privacy

Empower and Link provides services to adults. Our website and services are not directed at anyone under the age of 18. We do not knowingly collect personal information from anyone under 18. If we learn that we have collected information from someone under 18, we will delete it promptly. If you believe a minor has submitted information through our site, please contact us immediately.

Cookies and Tracking

Our website uses the following types of cookies:

• Functional cookies required for the website to operate, including session management.
• Analytics cookies set by Google Analytics to help us understand how visitors use our site. These cookies collect aggregated, anonymized usage data (pages visited, time on site, referral sources). You can opt out by installing the Google Analytics Opt-out Browser Add-on.
• Security and performance cookies set by Cloudflare to protect the site from malicious traffic and deliver content efficiently.
• Payment processing cookies set by Stripe during the donation checkout process.

We do not use Facebook Pixel or any advertising trackers. We do not serve ads on our website. None of our cookies are used to track you across other websites for advertising purposes.

Links to Other Websites

Our website may contain links to other organizations, resources, or service providers. This Privacy Policy applies only to empowerandlink.org. We are not responsible for the privacy practices of other websites. We encourage you to read the privacy policies of any website you visit.

Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the “Last Updated” date at the top of this page. If we make significant changes to how we handle your information, we will post a notice on our website. Your continued use of our website after changes are posted constitutes your acceptance of the updated policy.

Contact Us

If you have questions, concerns, or requests related to this Privacy Policy or your personal information, contact us at: