Privacy Policy

Last updated: September 15, 2026  |  Effective date: October 1, 2026

1. Organization Information

CC Health Development ("CC Health Dev," "we," "our," or "us") is a 501(c)(3) nonprofit public health organization incorporated in the State of Maryland. Our registered office is located at 1501 South Clinton Street, Suite 220, Baltimore, MD 21224. Our federal Employer Identification Number (EIN) is 52-3018472. This Privacy Policy describes how we collect, use, store, and protect personal information and community health data in connection with our programs, research activities, website, and organizational operations.

2. Information We Collect

We collect information through several channels in the course of our organizational activities:

Website Visitors

When you visit our website (cchealthdev.org), we may collect standard web analytics data including IP address, browser type, operating system, referring URL, pages visited, and session duration. We use this information solely to understand website usage patterns and improve our digital communications. We do not use third-party advertising trackers or sell website visitor data to any party.

Program Applicants and Participants

When you apply for our Community Health Worker Training Academy, volunteer as a community data collector, or participate in other CC Health Dev programs, we collect personal information necessary for program administration, including your name, contact information, mailing address, educational background, employment history, emergency contact details, and relevant professional credentials or certifications. For CHW Training Academy applicants, we also collect information about community involvement, language proficiency, and neighborhood of residence to assess eligibility and prioritize applicants from medically underserved areas.

Community Health Survey Respondents

Through our Neighborhood Health Needs Assessment program, we collect health status information, healthcare access experiences, food security status, housing conditions, environmental exposure concerns, mental health indicators, and demographic data from community survey respondents. All survey participation is voluntary, respondents provide informed consent before participation, and respondents may decline to answer any individual question. All individual-level survey data is de-identified before analysis, and results are reported only at the aggregate neighborhood level to prevent identification of individual respondents.

Donors and Supporters

When you make a financial contribution to CC Health Dev, we collect your name, contact information, and payment details necessary to process your donation and provide tax acknowledgment receipts. We do not store credit card or bank account numbers after transaction processing is complete.

3. How We Use Your Information

We use personal information and community health data exclusively for the following purposes:

• Administering our programs, including CHW Training Academy enrollment, practicum placement, and alumni career services
• Conducting and analyzing Neighborhood Health Needs Assessments in accordance with our IRB-approved research protocols
• Producing aggregate health status reports for community advocacy, policy development, and grant applications
• Communicating with program participants, partners, donors, and stakeholders about our activities and impact
• Processing donations and providing tax acknowledgment documentation
• Complying with legal obligations, including nonprofit regulatory reporting requirements
• Improving our programs, website, and organizational effectiveness

4. Research Ethics and IRB Oversight

All CC Health Development research activities involving human subjects are reviewed and approved by our Institutional Review Board (IRB) in partnership with the Johns Hopkins Bloomberg School of Public Health. Our IRB ensures that all research protocols meet federal standards for the protection of human research participants, including requirements for informed consent, data confidentiality, participant privacy, and risk minimization. Research participants have the right to withdraw from any study at any time without penalty or loss of services. Research data is stored on encrypted, access-controlled servers with role-based access limited to authorized research personnel.

5. HIPAA Compliance

While CC Health Dev is not a HIPAA-covered entity in most of our operations, we voluntarily comply with HIPAA Privacy Rule standards as a commitment to the communities we serve. When we partner with HIPAA-covered entities such as hospitals, health systems, and Federally Qualified Health Centers, we execute Business Associate Agreements and maintain compliance with all applicable HIPAA requirements. Protected health information received through clinical partnerships is handled in accordance with HIPAA regulations and applicable state health information privacy laws.

6. Data Security

We implement administrative, technical, and physical safeguards to protect personal information and community health data from unauthorized access, disclosure, alteration, or destruction. These safeguards include encrypted data storage and transmission (AES-256 at rest, TLS 1.3 in transit), role-based access controls with multi-factor authentication, regular security assessments and penetration testing, staff training on data handling and privacy protection, physical access controls at our office facilities, and incident response procedures in the event of a data breach. Community data collectors sign confidentiality agreements and receive training in respondent privacy protections as part of their 40-hour training curriculum.

7. Data Sharing and Third Parties

CC Health Development does not sell, rent, or trade personal information or community health data to any third party for commercial purposes. We may share de-identified, aggregate-level community health data with academic research partners, government health agencies, and community organizations for the purpose of advancing public health knowledge and improving community health outcomes. Individual-level data is shared only with explicit consent or when required by law. We do not share personal information with employers, insurers, law enforcement, or immigration authorities except as compelled by valid legal process.

8. Your Rights Under CCPA and GDPR

If you are a California resident, you have the right under the California Consumer Privacy Act (CCPA) to request access to, deletion of, or portability of your personal information, and to opt out of the sale of personal information (we do not sell personal information). If you are a resident of the European Economic Area or United Kingdom, you have rights under the General Data Protection Regulation (GDPR) including the right to access, rectify, erase, restrict processing, and port your personal data, and to object to processing based on legitimate interests. To exercise any of these rights, contact our Privacy Officer at [email protected] or call (443) 555-0276.

9. Data Retention

We retain personal information for as long as necessary to fulfill the purposes for which it was collected, comply with legal obligations, and support legitimate organizational interests. Program application records are retained for 3 years following the application cycle. Research data is retained for the duration specified in the IRB-approved protocol, typically 7 years following study completion. Donor records are retained as required by IRS nonprofit reporting regulations. Website analytics data is retained for 26 months. You may request deletion of your personal information at any time, subject to legal retention requirements.

10. Children's Privacy

Our website is not directed to children under the age of 13, and we do not knowingly collect personal information from children under 13 through our website. Our Youth Public Health Pipeline program serves high school juniors and seniors (typically ages 16 to 18) with parental or guardian consent obtained prior to enrollment. Pipeline participant data is handled with the same confidentiality protections as adult program participant data.

11. Changes to This Policy

We may update this Privacy Policy periodically to reflect changes in our practices, programs, or applicable laws. Material changes will be communicated through our website and, where appropriate, by direct notification to affected individuals. The "Last updated" date at the top of this page indicates when the most recent revision was made.

12. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact: