Privacy Policy

Ravenswood Billing LLC, an Arizona limited liability company ("Ravenswood," "we," "our," or "us"), provides outsourced billing services to ABA, pediatric therapy, mental health, and other healthcare providers. This Privacy Policy explains what personal information we collect, how we use and disclose it, and the choices and rights you have.

Which websites and communications this policy covers

This policy applies to:

• Our websites: ravenswoodbilling.com, get-ravenswoodbilling.com, try-ravenswoodbilling.com, ravenswood-billing.com, and any other website we operate that links to this policy (together, the "Sites"). The same policy applies on every Site, wherever you read it.
• Our emails: sales, marketing, and service emails we send from the domains listed on our Verified Email Domains page.
• Business contacts: information about people at agencies we work with or talk to, such as owners, office managers, and billers.

It does not cover Protected Health Information (PHI) about our clients’ patients. We handle PHI as a HIPAA business associate under a Business Associate Agreement (BAA) with each client, as described in section 8.

1. Notice at Collection (California and Other U.S. States)

The table below lists the categories of personal information we collect through the Sites, our emails, and our business dealings, why we collect it, whether we sell or share it, and how long we keep it.

Sensitive personal information: we do not intentionally collect sensitive personal information through the Sites, and we do not use or disclose it to infer characteristics about you. Please do not enter client or patient information into website forms or booking requests.

Sources: you, your agency, our booking tool, our email tools, and cookies and similar technologies on the Sites.

2. Information We Collect

Information you give us

• Contact and booking details when you book a call, email us, call us, or fill out a form.
• Business and billing details when your agency becomes a client.
• Communications such as emails, messages, and notes from calls.

Information collected automatically

When you visit a Site, we and our providers collect internet and device activity and approximate location as described above, using cookies, browser storage, and similar technologies. See section 3.

Client data and PHI

When an agency hires us, we access its billing systems and records, which contain PHI. That data is governed by HIPAA and our BAA, not by the website practices in this policy. See section 8.

3. Cookies and Similar Technologies

Each Site uses the following. Because each Site has its own domain, cookies and stored choices are kept separately for each Site.

We also load fonts from Google Fonts, and Cloudflare provides DNS, hosting, and security for the Sites. Both receive your IP address when your browser looks up or requests files from the Sites, and Cloudflare may set a short-lived security cookie (such as __cf_bm) to tell people from bots.

Your cookie choices

• Click Reject on the cookie banner, or use the Cookie Settings link in the footer of any Site, to turn off analytics and advertising cookies.
• Turn on Global Privacy Control (GPC) in your browser. We treat it as a request to opt out of sale and sharing, and we automatically turn off analytics and advertising cookies on every Site.
• You can also block or delete cookies in your browser settings, or install the Google Analytics opt-out add-on.

Do Not Track

There is no common industry standard for “Do Not Track” browser signals, so the Sites do not respond to them. We do honor Global Privacy Control, as described above. Third parties such as Google may collect information about your online activity over time and across different websites when you use the Sites, unless you opt out.

4. Sale and Sharing of Personal Information

We do not sell personal information for money. We do use Google advertising cookies to measure and improve our ads. California law may treat this as “sharing” personal information for cross-context behavioral advertising, and other state laws may treat it as targeted advertising.

To opt out of sale, sharing, and targeted advertising, use any of these:

• Click Do Not Sell or Share My Personal Information in the footer of any Site.
• Click Reject on the cookie banner.
• Turn on Global Privacy Control in your browser.

Your choice is saved per browser and per Site. If you visit more than one of our Sites, opt out on each one, or use Global Privacy Control, which works on all of them automatically. We do not knowingly sell or share the personal information of anyone under 16.

5. How We Use Personal Information

• Respond to questions, schedule consultations, and talk with you about our services
• Provide, bill for, and support our services to client agencies
• Send sales and marketing emails, which you can unsubscribe from at any time
• Understand how the Sites are used and measure our advertising
• Keep the Sites, our systems, and our clients’ data secure, and prevent fraud
• Comply with legal obligations, including HIPAA

6. Who We Disclose Personal Information To

We disclose personal information only as needed, to:

• Service providers working on our behalf under contract: Cloudflare (domain name service (DNS), website hosting, and security), Google (Tag Manager, Analytics, advertising measurement, and Fonts), Cal.com (scheduling), Microsoft 365 (email), and email and sales outreach providers. Providers that handle PHI sign a BAA with us.
• Clearinghouses and insurance payers, when we submit and follow up on claims for our clients.
• Professional advisors, such as lawyers, accountants, and insurers.
• Authorities, when required by law or to protect rights, safety, or property.
• A buyer or successor, if our business is merged, acquired, or sold.

7. Marketing and Sales Emails

We send emails only from the domains on our Verified Email Domains page. Every marketing email includes an unsubscribe link and our mailing information, and we honor unsubscribe requests promptly. Our emails may use standard tracking to tell us whether a message was delivered, opened, or clicked. We never ask for passwords, client information, or payment details by email.

8. PHI and Our Role as a HIPAA Business Associate

When an agency hires us, we access and process PHI on its behalf as a business associate. We:

• Sign a BAA with each client before accessing any PHI
• Use and disclose PHI only as the BAA and HIPAA allow, and never for marketing
• Apply administrative, physical, and technical safeguards required by the HIPAA Security Rule
• Limit access to identifiable data to our US-based staff, and remove identifiers before any work done by international staff or AI tools (see our Security page)
• Require vendors that handle PHI to sign a BAA with us
• Report security incidents and breaches as HIPAA, the HITECH Act, and our BAAs require
• Return or destroy PHI when an engagement ends, as the BAA specifies

If you are a patient, please exercise your HIPAA rights (such as access, amendment, or an accounting of disclosures) through your healthcare provider. We will help your provider respond. PHI handled under HIPAA is exempt from the California Consumer Privacy Act and similar state laws.

9. How Long We Keep Information

• Business contact and account information: 3 years after our last contact or after a client agreement ends
• Billing and payment records: 7 years, for tax and legal compliance
• Communications: 5 years
• Website analytics data: up to 3 years
• Marketing preferences: until you unsubscribe, plus 3 years to honor the opt-out
• Security logs: 1 year, or longer if needed for an investigation
• PHI: as required by HIPAA, state law, and our BAA with each client

10. Security

We use administrative, technical, and physical safeguards, including encryption in transit and at rest, multi-factor sign-in, role-based access, company-managed devices, staff training, and incident response procedures. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

11. Your Privacy Rights

Everyone

You can ask us to access, correct, or delete your personal information, and you can unsubscribe from marketing emails at any time.

California residents (CCPA/CPRA)

If you live in California, you have the right to:

• Know the categories and specific pieces of personal information we collected about you, the sources, our purposes, and who we disclosed it to
• Delete personal information we collected from you
• Correct inaccurate personal information
• Opt out of sale and sharing of your personal information (see section 4)
• Limit the use of sensitive personal information (we do not use sensitive personal information in ways that trigger this right)
• Not be discriminated against for exercising any of these rights

Residents of other U.S. states

Depending on where you live, you may have similar rights to access, correct, delete, and get a copy of your data, and to opt out of targeted advertising, sale, and profiling. If we deny your request, you may appeal by replying to our decision. If your appeal is denied, you may contact your state attorney general.

How to make a request

• Email [email protected] with the subject line “Privacy Request,” or
• Call +1 (602) 922-1925.

We will confirm your request within 10 business days and respond within 45 days. If we need more time, we will tell you and may take up to 45 more days. To protect you, we will verify your identity by matching information you give us with information we already have. You may use an authorized agent; we will ask for proof that you authorized them and may ask you to confirm your identity directly.

EEA, UK, and Swiss residents (GDPR)

We process personal data to perform contracts, with your consent (such as optional cookies and marketing emails, which you can withdraw at any time), for our legitimate interests (such as security and improving our services), and to comply with legal obligations. You may have rights to access, correct, delete, restrict, object to, or port your data, and to complain to your local data protection authority. Contact us to exercise these rights.

12. International Transfers

We are based in the United States, and personal information is processed in the United States. Some of our staff work outside the United States. Only our US-based staff access client systems or identifiable client data. Where we transfer personal data internationally, we use appropriate safeguards.

13. Children

The Sites are for businesses and are not directed to children under 16. We do not knowingly collect personal information from children through the Sites. Our clients’ records may include information about minors receiving ABA services; that information is PHI and is governed by HIPAA and our BAAs.

14. Third-Party Websites

The Sites link to other websites, such as state Medicaid sites and our booking provider. We are not responsible for their privacy practices, so please read their policies.

15. Changes to This Policy

We may update this policy. We will post the new version on this page and change the “Last updated” date. If we make material changes, we will also note them prominently on the Sites or tell clients directly.

16. Contact Us

Ravenswood Billing LLC
Phoenix, Arizona
Email: [email protected]
Phone: +1 (602) 922-1925
Website: ravenswoodbilling.com