Skip to main content

Legal

Privacy Policy

How Mercy Gate Foundation collects, uses, and protects information about donors and visitors to this site.

Effective [date]. Last updated [date]. Draft for legal counsel review; not yet approved.

1. Who this policy covers

This policy applies to Mercy Gate Foundation (“the Foundation,” “we”), a California nonprofit public benefit corporation, and to this website. It covers information about donors, people who contact us, and visitors. Mercy Gate Medical PC (California) and Mercy Gate Medical PC (Oregon) are in formation and do not yet see patients; no protected health information (PHI) is collected through this site. When clinical operations open, a separate notice of privacy practices will govern patient information.

Although no PHI flows through this site today, we handle donor and contact data under HIPAA-equivalent discipline: minimum necessary collection, access limited to those who need it, and no secondary use for advertising.

2. What we collect

Information you give us. When you donate: your name, email, mailing address, phone (optional), gift amount and frequency, designation, tribute details (honoree name, notification email, message) and your communication preferences. When you contact us: your name, email, organization (optional), the audience you select, your message, and how you agree to be reached. When you opt in to updates: your email.

Payment information. Card and bank details are entered directly with our payment processor, [processor], and never reach the Foundation’s servers. We receive a confirmation, the last four digits, and a token that lets you pause or cancel a recurring gift.

Information collected automatically. Server logs record IP address, browser type, pages requested, and timestamps. Our analytics are privacy-respecting (see §5) and do not build individual profiles.

3. How we use it

  • To process gifts, issue receipts and IRS acknowledgments, and administer recurring gifts.
  • To notify honorees or their families of tribute gifts - never including the amount.
  • To reply to your inquiries and route them to the right person.
  • To send stewardship or institutional updates only if you separately opted in, with one-click opt-out in every message.
  • To meet legal obligations, including California charitable-solicitation and federal tax requirements.
  • To keep the site secure and understand, in aggregate, how it is used.

We do not sell, rent, or trade your information. We do not use it for third-party advertising. We do not build donor profiles from external data brokers.

4. Who we share it with

  • Service providers acting on our instructions: payment processing ([processor]), email delivery, donor database (CRM) hosting, and website hosting - each bound by contract to use the data only to provide the service.
  • Legal and regulatory recipients when required by law, subpoena, or to protect rights and safety.
  • Successors in the unlikely event of a merger or reorganization of the Foundation, under the same commitments.

We never share donor information with marketing data brokers, advertising networks, or other nonprofits.

5. Cookies and analytics

We use only privacy-respecting analytics ([Plausible / Fathom / self-hosted Matomo]) that do not use cross-site cookies or collect personal identifiers. We do not use Google Analytics, Meta Pixel, or any third-party advertising tracker.

Only cookies strictly required for the site to function (for example, session cookies during a donation) are set without consent. Any cookie banner we show is non-blocking. You may disable cookies in your browser; the donation flow may then not complete.

6. Retention and security

Donation records are retained for at least seven years to meet tax and audit obligations. Contact-form data is retained for up to two years after the last interaction, or until you ask us to delete it. Update subscriptions are retained until you unsubscribe.

We use encryption in transit, access controls, and vendor due diligence. No system is perfectly secure; if a breach affects your information we will notify you as required by California law.

7. Your choices and rights

  • Opt out of any communication with one click, honored immediately across every channel.
  • Access, correct, or delete the information we hold about you by emailing privacy@[domain]. We respond within 30 days. We may need to retain records required by law (for example, receipts).
  • Recurring gifts can be paused or cancelled by you at any time from the link in any receipt, without contacting us.
  • California residents may have additional rights under California privacy law; nonprofits are largely exempt from the CCPA, but we honor access and deletion requests as a matter of policy.
  • Do Not Track / Global Privacy Control: because we do not track across sites or sell data, these signals do not change how the site behaves.

8. Children

This site is not directed to children under 13 and we do not knowingly collect their information. If you believe a child has provided information, contact us and we will delete it.

9. Changes

We will post any changes here with a new effective date. Material changes affecting donors will also be sent by email to donors who have opted in to updates.

10. Contact

Privacy and HIPAA inquiries: privacy@[domain]. Mail: Mercy Gate Foundation, [Street address], [City, State ZIP]. Or use the contact form and select “privacy or HIPAA question.”