Privacy Policy

Introduction

Empire State Wellness Inc. ("we," "us," or "our") is committed to protecting the privacy of individuals who interact with our website (https://empirestatewellness.org), our "Apply for Assistance" form, and our donation platform. This Privacy Policy explains how we collect, use, disclose, and protect your personal information in compliance with applicable laws, including the New York SHIELD Act, and where applicable, the California Consumer Privacy Act (CCPA), and the General Data Protection Regulation (GDPR) for international users. By using our services, you agree to the practices described herein.

Information We Collect

We collect various types of information to facilitate our mission of providing dental grants to veterans and first responders in New York:

• Personal Identification Information: Full names, email addresses, and phone numbers provided during donation or application processes via our third-party processor, Donorbox, integrated with Stripe, or our Zoho Forms application.
• Financial Information: Payment details (e.g., credit card numbers) processed securely by Donorbox and Stripe, which we do not store directly.
• Application Data: Proof of service (e.g., DD-214, badge ID), income verification (e.g., tax returns, pay stubs), and dental records or medical documentation submitted through our "Apply for Assistance" form.
• Usage Data: IP addresses, browser types, device information, and timestamps of website visits, collected automatically via cookies and analytics tools to enhance user experience.
• Communication Data: Correspondence details when you contact us via email or other means.

How We Use Your Information

We utilize your information to support our nonprofit mission and operational needs:

• Processing donations and issuing tax receipts, where donations are tax-deductible under IRS guidelines during our pending 501(c)(3) status.
• Reviewing and approving grant applications, including verifying eligibility and coordinating with healthcare providers.
• Sending updates, newsletters, or grant-related communications (you may opt out at any time).
• Analyzing website usage to improve functionality and tailor content to user needs.
• Complying with legal obligations, such as identity verification for grant disbursements or audits by the New York Attorney General’s Charities Bureau.

How We Protect Your Information

Protecting your data is a priority, and we employ robust measures:

• Encryption of sensitive data during transmission and storage using industry-standard protocols (e.g., SSL/TLS via Donorbox and Stripe).
• Access controls limiting data access to authorized personnel only, with regular training on data security.
• Regular security audits and updates to address vulnerabilities, conducted by our team and third-party experts.
• Retention policies to delete data when no longer needed, except where required by law (e.g., tax records for 7 years).

Sharing Your Information

We share your information only under specific circumstances:

• With third-party service providers (e.g., Donorbox for donations, Stripe for payments, Zoho for forms) to perform functions on our behalf, bound by confidentiality agreements.
• With healthcare providers (e.g., dentists) to facilitate grant-related treatments, with your consent.
• As required by law, such as responding to subpoenas, court orders, or regulatory requests from the IRS or New York authorities.
• To protect our rights, property, or safety, or that of others, in cases of fraud or legal disputes.

We do not sell, trade, or otherwise transfer your personal information to outside parties for marketing purposes.

Your Choices and Rights

You have control over your personal information:

• Access and Correction: Request to view or correct your data by contacting us.
• Deletion: Request removal of your data, subject to legal retention requirements (e.g., tax or audit purposes).
• Opt-Out: Unsubscribe from non-essential emails by replying "unsubscribe" or using the link provided in communications.
• Do Not Track: We do not currently respond to Do Not Track signals, but you can manage cookie preferences via your browser settings.

To exercise these rights, contact us at the details below. Note that some data may be retained to fulfill legal or operational obligations.

International Data Transfers

Your information may be processed by our service providers in the United States. We ensure compliance with applicable data protection laws, including GDPR for European users, by contracting with providers who adhere to international standards (e.g., Privacy Shield framework, where applicable).

Children’s Privacy

Our services are not intended for individuals under 13 years of age. We do not knowingly collect data from children. If we learn of such collection, we will delete the information promptly and notify the parent or guardian.

Third-Party Links and Services

Our website may contain links to external sites (e.g., Donorbox) not controlled by us. We are not responsible for their privacy practices. Review their policies before providing data.

Cookies and Tracking Technologies

We use cookies to enhance your experience, including session cookies for navigation and analytics cookies for performance tracking. You can disable cookies via your browser settings, though this may affect website functionality.

Data Breach Notification

In the event of a data breach, we will notify affected individuals and relevant authorities (e.g., New York Attorney General) within 72 hours as required by law, detailing the breach and mitigation steps.

Legal Basis for Processing (For GDPR Compliance)

For users in the EU, we process data based on:

• Consent (e.g., for marketing emails).
• Legitimate interests (e.g., improving services, fraud prevention).
• Legal obligations (e.g., tax compliance).

You may withdraw consent at any time.

Changes to This Policy

We may update this Privacy Policy to reflect changes in our practices or legal requirements. Revisions will be posted on this page with an updated effective date. We recommend reviewing it periodically.