Privacy Policy

1. Information We Collect

In the course of providing family support services, the White Picket Fence Foundation ("WPFF," "we," "our") collects personal information necessary to deliver, coordinate, and improve our programs. The types of information we collect include:

Personal Identification Information

Names, dates of birth, addresses, phone numbers, and email addresses for adult household members. Government-issued identification numbers are recorded solely for the purpose of eligibility verification and are stored in encrypted form separate from general case records. We collect Social Security Numbers only when required by specific funding sources (e.g., IDA matched savings accounts) and only with explicit, documented consent.

Family Composition Data

Names and ages of children in the household, household size, family structure (single-parent, two-parent, multigenerational, foster/kinship), and custody arrangements relevant to service delivery. This information is collected during the intake assessment and updated as family circumstances change.

Financial Information

Household income documentation, employment status, government benefits enrollment, debt obligations, and banking information (for families enrolled in the IDA matched savings program only). Financial information is used exclusively for program eligibility determination, service planning, and outcome measurement. We do not collect credit card numbers or online banking credentials.

Case Management Notes

Progress notes, service plan documents, referral records, and outcome data created by your case coordinator and program facilitators during the course of service delivery. Case notes may include sensitive information about family circumstances, health conditions, and behavioral observations relevant to treatment planning.

Website Usage Data

When you visit whitepicketfencefoundation.org, we collect anonymous, aggregated website analytics through a self-hosted analytics platform. This includes page views, session duration, referral sources, and device type. We do not use Google Analytics, Facebook Pixel, or any third-party tracking technology that creates persistent user profiles. Our online Family Needs Assessment tool processes all data locally in your web browser; assessment responses are not transmitted to or stored on our servers.

2. How We Use Your Information

Personal information collected by WPFF is used for the following purposes:

• Program Enrollment & Service Delivery: To determine eligibility, develop personalized service plans, enroll families in appropriate programs, and coordinate care across our six program areas.
• Referral Coordination: To facilitate warm referrals to partner organizations, therapists, housing providers, and government agencies when you have provided explicit written consent for information sharing.
• Outcome Measurement: To track program effectiveness through aggregate, de-identified data analysis. Individual family outcomes are reported to funders and partners only in aggregate form that cannot identify any specific family.
• Communication: To contact you regarding your services, appointment reminders, program updates, and organizational newsletters (with your opt-in consent for non-service communications).
• Legal Compliance: To fulfill mandatory reporting obligations under North Carolina law, including child abuse and neglect reporting as required by N.C.G.S. Section 7B-301.

3. HIPAA Compliance

While WPFF is not a HIPAA-covered entity in the strict regulatory sense (we are not a healthcare provider, health plan, or healthcare clearinghouse), we voluntarily adopt HIPAA-standard privacy and security protections for all family records as a matter of ethical practice and contractual obligation with our healthcare referral partners. This includes:

• Administrative safeguards: designated Privacy Officer, staff training on confidentiality requirements (annual), sanctions for policy violations, and incident response procedures.
• Physical safeguards: locked file storage, restricted office access, secure visitor sign-in, and clean-desk policy for all workstations.
• Technical safeguards: 256-bit AES encryption for all electronic records, role-based access controls limiting file access to assigned case coordinators and supervisors, automatic session timeouts (15 minutes), multi-factor authentication for system access, and encrypted email for communications containing protected information.

4. Information Sharing & Disclosure

WPFF does not sell, trade, rent, or otherwise disclose personal or family information to any third party for marketing, advertising, fundraising, or any commercial purpose. We will never share your information without your explicit, informed, written consent except in the following limited circumstances:

• Referral Services: When you have signed a Release of Information form authorizing us to share specific information with a named referral provider (e.g., a therapist, housing agency, or school). You may revoke this consent at any time.
• Mandatory Reporting: When we are legally required to report suspected child abuse, neglect, or exploitation under North Carolina mandatory reporting statutes. Staff will inform you of any mandatory report filed, except when doing so would compromise child safety.
• Court Orders: When compelled by a valid court order or subpoena. We will notify you and provide an opportunity to contest the disclosure unless prohibited by the court order itself.
• Aggregate Reporting: De-identified, aggregate program data is shared with funders, government agencies, and accrediting bodies for program evaluation purposes. This data cannot identify any individual family.
• Safety Emergencies: When there is an imminent threat to the life or safety of a family member and disclosure is necessary to prevent serious harm.

5. Data Retention & Destruction

Family case records are retained for seven (7) years from the date of program discharge, in accordance with North Carolina nonprofit record retention guidelines and the contractual requirements of our primary funding sources. After the retention period expires, paper records are cross-cut shredded by a bonded document destruction service, and electronic records are permanently purged from all systems and backup media using NIST SP 800-88 compliant data sanitization methods. Financial records related to grant compliance are retained for ten (10) years per federal grant requirements. Anonymous, aggregate program data may be retained indefinitely for historical reporting and research purposes.

6. Your Rights

As a person whose information is held by WPFF, you have the following rights:

• Right to Access: You may request a copy of your complete case file at any time. Requests will be fulfilled within 30 calendar days. A reasonable copying fee may apply for physical reproductions.
• Right to Correction: You may request corrections to any factual errors in your records. Corrections will be processed within 15 business days, and a notation will be added to the record documenting the change.
• Right to Deletion: You may request deletion of your records prior to the expiration of the retention period, subject to legal and contractual retention obligations. If deletion cannot be accommodated, we will explain the specific retention requirement that applies.
• Right to Restrict Processing: You may request that we limit the use of your information to specific purposes or programs.
• Right to Withdraw Consent: You may revoke any Release of Information authorization at any time by notifying your case coordinator in writing. Revocation does not apply to information already shared prior to the revocation date.
• Right to Opt Out: You may opt out of non-essential communications (newsletters, event invitations, fundraising appeals) at any time by contacting our office or clicking the unsubscribe link in any email communication.

7. Children's Privacy (COPPA Compliance)

WPFF serves families with children and necessarily collects information about minor children in the household. We collect children's information only with the knowledge and consent of a parent or legal guardian, and only to the extent necessary for program enrollment, service delivery, and outcome tracking. We do not collect information directly from children through our website. Children's records receive the same privacy protections as adult records and are subject to the same retention and destruction policies. Parents and legal guardians have the right to review, correct, or request deletion of their children's information.

8. California Consumer Privacy Act (CCPA) Provisions

Although WPFF primarily serves families in North Carolina, we extend CCPA-equivalent protections to all individuals regardless of state of residence. This includes the right to know what personal information we collect and how it is used, the right to request deletion of personal information, and the right to non-discrimination for exercising privacy rights. WPFF does not sell personal information to any party and has never done so. To exercise your rights under this provision, contact our Privacy Officer using the information provided below.

9. European General Data Protection Regulation (GDPR)

While WPFF does not actively solicit or serve individuals located in the European Economic Area, we extend GDPR-standard data protection principles to all individuals as a matter of best practice. This includes data minimization (collecting only what is necessary), purpose limitation (using data only for stated purposes), storage limitation (retaining data only as long as necessary), and integrity and confidentiality (protecting data against unauthorized access, loss, or damage). Any individual may exercise their GDPR-equivalent rights by contacting our Privacy Officer.

10. Website Cookies & Browser Storage

The whitepicketfencefoundation.org website uses only essential, first-party cookies necessary for basic website functionality (session management and form state preservation). We do not use tracking cookies, advertising cookies, or any third-party cookie technology. We do not use browser fingerprinting, pixel tracking, or cross-site tracking of any kind. Our website does not contain embedded social media widgets, share buttons, or third-party advertising scripts. The Family Needs Assessment and Budget Calculator tools on our website process all data locally in your browser using client-side JavaScript; no assessment data, budget figures, or tool results are transmitted to our servers or any third party.

11. Data Breach Notification

In the event of a data breach affecting your personal information, WPFF will notify all affected individuals within 72 hours of discovery in accordance with the North Carolina Identity Theft Protection Act (N.C.G.S. Section 75-65). Notification will include a description of the breach, the types of information potentially compromised, steps we are taking to mitigate the breach, and recommended protective actions for affected individuals. We will also notify the North Carolina Attorney General's office and any applicable federal agencies as required by law.

12. Changes to This Policy

WPFF reserves the right to update this privacy policy as necessary to reflect changes in our practices, technology, legal requirements, or operational needs. Substantive changes will be communicated to active program participants through written notice and posted prominently on our website. The "Last Updated" date at the top of this policy reflects the most recent revision. Previous versions of this policy are available upon request.

13. Contact Our Privacy Officer

If you have questions about this privacy policy, wish to exercise any of your privacy rights, or need to report a privacy concern, please contact:

All privacy inquiries and complaints will be acknowledged within five (5) business days and resolved within thirty (30) calendar days. If you are not satisfied with our response, you may file a complaint with the North Carolina Attorney General's Consumer Protection Division at (919) 716-6000 or the U.S. Department of Health and Human Services Office for Civil Rights at (800) 368-1019.