Policy 004 · Official policy text
Data Privacy and Confidentiality Policy
Heritage & Opportunity Alliance, Inc.
- Effective date
- Upon Board Adoption
- Approved by
- Board of Directors
- Applies to
- Directors, officers, committees, advisory members, volunteers, employees, contractors, partners, and program participants as applicable
Purpose
This Policy protects personal, resident, youth, volunteer, donor, partner, and program information collected or used by Heritage & Opportunity Alliance, Inc..
Scope
This Policy applies to all information collected through sign-in sheets, surveys, resource clinics, oral histories, photo releases, youth programs, volunteer records, grant reports, fundraising, partner referrals, communications, and events.
Confidential Information
Confidential information includes names with sensitive needs, addresses, phone numbers, emails, youth information, emergency contacts, health-related information, housing/property concerns, financial hardship, legal or re-entry information, recovery information, family stories, photos, and any information a reasonable person would expect to be protected.
Collection Limits
The corporation shall collect only information reasonably needed for its charitable, educational, cultural, youth, health, referral, program, grant, or community-development purposes. Forms should explain why information is collected, how it may be used, and whether participation is voluntary.
Use and Sharing
Confidential information may be used only for authorized organizational purposes. Public reports should use aggregate data unless written permission is obtained. Resident stories, photos, youth images, oral histories, and property information may not be published or shared publicly without documented permission and appropriate release.
Youth Data
Youth information requires heightened protection. Parent or guardian permission should be obtained when required or appropriate. Youth sign-in, emergency contacts, waivers, medical notes, and incident records shall be restricted to authorized adults with a need to know.
Access Controls
Access to confidential information shall be limited to persons authorized by the Board, officers, program leads, or policy. Volunteers may not handle sensitive information unless trained and approved.
Electronic Privacy
Electronic files containing confidential information should be password protected or stored in approved systems. Email and text transmission of sensitive information should be limited and handled carefully.
Incident Response
Any suspected unauthorized disclosure, lost records, breach, misuse of information, or improper public release shall be reported promptly to an officer or Board representative. The Board shall determine corrective action, notice, and documentation.
Records
The Secretary, Treasurer, or other Board-authorized records officer shall maintain records created under this Policy according to the Records Retention and Document Control Policy. Records may include approvals, disclosures, invoices, receipts, reports, correspondence, minutes, incident reports, releases, agreements, restricted-fund logs, or other supporting documents.
Violations
Violations of this Policy may result in corrective action, reassignment, removal from a committee or volunteer role, termination of a contract, repayment, report to the Board, or other action permitted by law and organizational policy. Retaliation against a person who raises a good-faith concern is prohibited.
Review and Amendment
This Policy may be reviewed at least annually and may be amended by the Board of Directors. The Board may adopt more detailed procedures, forms, checklists, and approval schedules consistent with this Policy.
Board Adoption
This Policy is adopted by the Board of Directors and remains in effect until amended, replaced, or rescinded by the Board.
The webpage above presents the complete policy text for accessible reading. The official PDF is retained for printing and formal records.