Privacy Policy

Last Updated: February 8, 2026

1. Introduction

New Hope Wellness, LLC (“we,” “our,” or “us”) is committed to protecting the privacy and security of personal health information. This Privacy Policy describes how the New Hope Wellness Client Intake mobile application (the “App”) collects, uses, discloses, and safeguards information when you use our App.

This App is designed for use by authorized healthcare professionals and intake coordinators at New Hope Wellness to collect client intake information for behavioral health services.

2. HIPAA Compliance

New Hope Wellness is a covered entity under the Health Insurance Portability and Accountability Act (HIPAA). All protected health information (PHI) collected through this App is subject to HIPAA Privacy and Security Rules.

For detailed information about how we use and disclose protected health information, please refer to our Notice of Privacy Practices, which is provided to all clients during the intake process and is available upon request.

3. Information We Collect

The App collects the following types of information as part of the client intake process:

3.1 Personal and Demographic Information

Full name
Date of birth
Social Security Number (for billing and identification purposes)
Gender/sex
Contact information (phone number, address)
Emergency contact information
Referral source information

3.2 Health Information

Insurance information (Medicaid number, insurance company)
Program needs assessment responses
Screening questionnaire responses
Service eligibility information

3.3 Consent and Authorization Records

Digital signatures
Consent dates and timestamps
Acknowledgment of policies and procedures

3.4 Technical Information

Device type and operating system version (for technical support purposes only)
App usage timestamps (submission dates)

4. How We Use Your Information

Information collected through the App is used for the following purposes:

4.1 Treatment

To assess eligibility for behavioral health services
To develop individualized service plans
To coordinate care and provide appropriate services
To maintain accurate clinical records

4.2 Payment

To bill Medicaid (DMAS) or other insurance providers
To verify insurance eligibility and coverage
To process claims and receive payment for services

4.3 Healthcare Operations

To comply with licensing and regulatory requirements
To conduct quality improvement activities
To provide staff training and supervision
To maintain accreditation standards

4.4 Legal and Regulatory Compliance

To comply with Virginia Department of Behavioral Health and Developmental Services (DBHDS) regulations
To respond to legal requests (court orders, subpoenas)
To report suspected abuse, neglect, or exploitation as required by law
To address imminent threats to health or safety

5. How We Share Your Information

We do not sell, rent, or trade personal health information. Information may be shared only as follows:

5.1 With Your Authorization

We will obtain your written authorization before using or disclosing your information for purposes not covered by this policy or HIPAA regulations.

5.2 Without Your Authorization (As Permitted by Law)

Treatment Providers: With other healthcare providers involved in your care
Insurance/Medicaid: For billing and payment purposes
Business Associates: With vendors who provide services on our behalf (e.g., cloud storage, IT support) under strict confidentiality agreements
Regulatory Agencies: DBHDS, Office of Licensing, Office of Human Rights for oversight activities
Legal Requirements: When required by law, court order, or to prevent serious harm

6. Data Security

We implement comprehensive security measures to protect your information:

6.1 Technical Safeguards

End-to-end encryption for data transmission (HTTPS/TLS)
Encrypted storage in Microsoft Azure cloud infrastructure
Secure authentication and access controls
Regular security audits and monitoring

6.2 Administrative Safeguards

Access limited to authorized personnel only
Staff training on HIPAA and privacy requirements
Business associate agreements with all vendors
Incident response and breach notification procedures

6.3 Physical Safeguards

Secure data centers with restricted access
Device security requirements for staff using the App

7. Data Retention

Client records are retained in accordance with Virginia law and DBHDS regulations:

Adult client records: Minimum of 10 years after discharge
Minor client records: 5 years after reaching age 18, or 10 years after discharge, whichever is longer
Records may be destroyed after the retention period in accordance with secure destruction procedures

8. Your Rights

Under HIPAA and Virginia law, you have the following rights regarding your health information:

8.1 Right to Access

You may request to inspect and obtain a copy of your health information. A reasonable fee may apply for copying costs.

8.2 Right to Amend

You may request correction of inaccurate or incomplete information in your record.

8.3 Right to an Accounting

You may request a list of certain disclosures of your information made outside of treatment, payment, and healthcare operations.

8.4 Right to Request Restrictions

You may request limits on how we use or disclose your information. We are not required to agree to all requests but will consider them carefully.

8.5 Right to Confidential Communications

You may request that we communicate with you in a specific manner or at a specific location.

8.6 Right to Revoke Authorization

You may revoke any authorization you have given us, except to the extent we have already acted on it.

9. Children’s Privacy

This App is used to collect intake information for clients of all ages, including minors. When services are provided to minors, consent is obtained from a parent or legal guardian as required by law. Information about minors is protected with the same security measures as adult information.

10. Third-Party Services

The App uses the following third-party services to provide functionality:

Microsoft Azure: Cloud hosting and data storage (HIPAA-compliant Business Associate Agreement in place)
SendGrid: Email delivery service for intake notifications (HIPAA-compliant Business Associate Agreement in place)

All third-party service providers are required to maintain appropriate security measures and comply with HIPAA requirements.

11. Changes to This Privacy Policy

We reserve the right to modify this Privacy Policy at any time. Changes will be effective immediately upon posting the updated policy. The “Last Updated” date at the top of this policy indicates when it was last revised.

Material changes will be communicated through appropriate channels, and the updated policy will be available on our website and upon request.

12. Breach Notification

In the event of a breach of unsecured protected health information, we will notify affected individuals in accordance with HIPAA Breach Notification Rule requirements, typically within 60 days of discovery.

13. State-Specific Rights

Virginia residents have additional rights under Virginia law, including:

Rights under Virginia’s mental health confidentiality laws
Rights related to substance use disorder treatment records (42 C.F.R. Part 2)
Rights under DBHDS Human Rights Regulations (12VAC35-115)

14. Contact Information

Questions or Concerns

If you have questions about this Privacy Policy or wish to exercise your rights, please contact:

New Hope Wellness, LLC
1123 N 25th Street
Richmond, VA 23223

Phone: (804) 369-3600
Fax: (804) 441-9056
Website: https://newhopevirginia.org/contact/

File a Complaint

If you believe your privacy rights have been violated, you may file a complaint with:

New Hope Wellness Privacy Officer
1123 N 25th Street
Richmond, VA 23223
Phone: (804) 369-3600

Virginia DBHDS Office of Human Rights
Phone: (804) 524-7247

U.S. Department of Health and Human Services
Office for Civil Rights
200 Independence Avenue, SW
Washington, DC 20201
Phone: 1-800-368-1019
Website: www.hhs.gov/ocr

You will not be retaliated against for filing a complaint.

15. Effective Date

This Privacy Policy is effective as of February 8, 2026.