Privacy Policy & Notice

Effective Date: August 14, 2026

Last Updated: August 14, 2026

Crime Victims Assistance Center, Inc. (“CVAC,” “we,” “us,” or “our”) respects the privacy, dignity, safety, and confidentiality of the individuals and communities we serve.

CVAC is a nonprofit organization that provides services and support to people affected by crime, including adults, children, survivors, family members, and other individuals. Our services may include crisis intervention, counseling, advocacy, legal advocacy and, where applicable, legal services, Child Advocacy Center services, case management, medical advocacy, victim compensation assistance, prevention education, training, referrals, and related services.

Because of the nature of our work, information entrusted to CVAC may be highly sensitive and, in some circumstances, subject to special confidentiality, privacy, privilege, professional, or legal protections.

CVAC seeks to collect, use, maintain, disclose, and protect information in accordance with applicable federal and New York law, professional obligations, funding requirements, contractual requirements, program requirements, and CVAC policies and procedures.

This Privacy Policy explains CVAC’s general privacy practices for its website and other interactions with CVAC. It also contains a specific Privacy Notice for Individuals Seeking or Receiving CVAC Services, beginning in Section 14.

Nothing in this Privacy Policy is intended to reduce, waive, replace, or eliminate any privacy right, confidentiality protection, evidentiary privilege, professional obligation, or other protection provided by applicable law.

If another applicable law, regulation, professional obligation, funding requirement, valid authorization, court order, program-specific notice, or other legally controlling requirement provides different or greater protection, the applicable controlling requirement will govern.

1. Scope of This Privacy Policy

This Privacy Policy may apply to information collected through or in connection with:

The CVAC website;
Website contact and inquiry forms;
Telephone communications;
Text communications;
Email communications;
Requests for information or resources;
Requests for counseling, advocacy, or other services;
Crisis intervention and advocacy;
Child Advocacy Center services;
Legal advocacy and, where applicable, legal services;
Medical advocacy;
Case management;
Victim compensation assistance;
Prevention education and training;
Event registrations;
Donations and fundraising activities;
Employment, volunteer, internship, or board applications;
Administrative communications;
Information received from authorized third parties where permitted by applicable law; and
Other interactions with CVAC.

Different privacy, confidentiality, privilege, consent, and disclosure requirements may apply to different CVAC programs, professionals, records, funding sources, and circumstances.

2. This Privacy Policy Is Not a Release or Authorization

This Privacy Policy provides notice regarding CVAC’s privacy practices. It is not a release of information or authorization to disclose confidential or protected information.

Accessing or using CVAC’s website, submitting a general website form, providing information to CVAC, or acknowledging this Privacy Policy does not, by itself, constitute:
A release of information;
Authorization to disclose victim service information;
Informed consent to disclosure;
Waiver of confidentiality;
Waiver of an evidentiary or professional privilege;
Consent to a use or disclosure that requires separate authorization under applicable law; or
Authorization for CVAC to disclose information that CVAC is otherwise prohibited from disclosing.

When applicable law requires a separate authorization, release, consent, or other permission before information may be disclosed, CVAC will follow the requirements applicable to that information and circumstance.

3. Important Crisis and Emergency Information

The CVAC website, general email addresses, website contact forms, and text line should not be relied upon as emergency response systems.

If you are experiencing an emergency or immediate danger, call 911 or the appropriate emergency service.

For immediate crisis advocacy through CVAC, call the 24/7 Crisis Line: (607) 722-4256

Text Line: (607) 725-8196

The text line is not an immediate response service and may not receive a response until the next business day. Individuals who need immediate support should call the 24/7 Crisis Line rather than relying on text, email, a website form, social media, or another electronic communication method.

CVAC does not guarantee that general website forms, email accounts, text messages, or other non-emergency communication channels are continuously monitored or that a response will be provided within any particular period.

4. General Website Forms and Sensitive Information

Unless a particular form expressly states that it is intended for a specific confidential or protected service-related purpose, CVAC’s general website forms are intended for routine administrative or informational inquiries.

General website forms should not be relied upon for:

Emergency assistance;
Crisis intervention;
Counseling;
Victim service intake;
Safety planning;
Legal advice;
Medical advice; or
Other time-sensitive or highly sensitive communications.

Please avoid providing unnecessary sensitive information through a general website form, including detailed information concerning:

Victimization or alleged criminal activity;
Sexual assault or sexual abuse;
Domestic violence;
Child abuse or maltreatment;
Human trafficking or exploitation;
Stalking or harassment;
Trauma history;
Mental or behavioral health;
Medical treatment;
Safety plans;
Current or planned locations;
A child’s identity or circumstances;
Alleged offenders;
Court proceedings;
Orders of protection;
Immigration information;
Confidential legal matters;
Law enforcement involvement;
Child protective services involvement; or
Other information that could create a privacy or safety risk.

Submission of a general website form does not, by itself, create an attorney-client, counselor-client, advocate-client, healthcare-provider, or other professional relationship.

Nothing in this section waives, limits, or eliminates any confidentiality, privacy, or privilege protection that may otherwise apply to information under applicable law.

Individuals seeking CVAC services should contact CVAC through the appropriate service or crisis channel.

5. Information We May Collect

The information CVAC collects depends on how an individual interacts with CVAC and the services or activities involved.

A. Contact and Identifying Information

CVAC may receive information such as:

Name;
Mailing address;
Email address;
Telephone number;
Date of birth or age, where appropriate;
Organization, employer, school, or agency affiliation;
Preferred method of communication;
Safe contact preferences; and
Other contact information voluntarily provided to CVAC.

B. Information Submitted Through Communications

CVAC may receive information contained in:

Website inquiries;
Emails;
Text messages;
Telephone calls;
Voicemail;
Written correspondence;
Program requests;
Applications;
Referrals; or
Other communications.

C. Donation and Fundraising Information

When an individual makes a donation, CVAC or a third-party service provider may receive information such as:

Name;
Contact information;
Donation amount;
Transaction information;
Donation history;
Dedication or tribute information; and
Information reasonably necessary to process, document, or acknowledge the contribution.

Payment card, banking, or similar payment information may be processed directly by an independent payment provider. Information submitted directly to such a provider may also be governed by that provider’s terms, privacy policy, and security practices.

D. Applicant Information

Individuals applying for employment, volunteer opportunities, internships, board service, or similar opportunities may provide information such as:

Contact information;
Employment history;
Education;
Qualifications;
Professional credentials;
References;
Resumes;
Cover letters; and
Other information relevant to the application or opportunity.

Additional information may be obtained or requested where appropriate and legally permitted.

E. Website and Technical Information

When a person visits or uses the CVAC website, CVAC or service providers supporting the website may automatically receive limited technical information, which may include:

Internet Protocol (“IP”) address;
Browser type;
Device type;
Operating system;
Referring page;
Pages visited;
Approximate date and time of access;
General website interactions;
Cookie or similar technology identifiers;
Security logs; and
Diagnostic information.

CVAC seeks to avoid using website technologies in a manner that unnecessarily reveals, exploits, or discloses sensitive information concerning an individual’s possible status as a crime victim, survivor, person seeking assistance, or recipient of services.

6. Sensitive and Highly Sensitive Information

Information handled by CVAC may include highly sensitive personal information.

Depending on the services and circumstances involved, this may include information concerning:

Crime victimization;
Sexual assault;
Sexual abuse;
Domestic violence;
Child abuse or maltreatment;
Human trafficking;
Stalking;
Harassment;
Exploitation;
Trauma;
Mental or behavioral health;
Physical health;
Disability;
Medical treatment;
Forensic medical services;
Counseling;
Safety planning;
Current or future location;
Shelter or housing;
Family relationships;
Children and minors;
Alleged offenders;
Immigration matters;
Criminal proceedings;
Family Court proceedings;
Orders of protection;
Law enforcement involvement;
Child protective services;
Financial circumstances;
Victim compensation;
Legal advocacy;
Legal representation, where applicable; and
Other information associated with services sought, received, used, referred for, or denied.

CVAC recognizes that, depending on the circumstances, even the fact that a person contacted, requested services from, was referred to, or received services from a victim services organization may itself be sensitive or protected information.

7. How CVAC May Use Information

Subject to applicable privacy, confidentiality, privilege, authorization, professional, and other legal restrictions, CVAC may use information as reasonably necessary to:

Respond to inquiries;
Provide requested services;
Provide counseling;
Provide crisis intervention or advocacy;
Provide case management services;
Provide legal advocacy and, where applicable, legal services;
Provide Child Advocacy Center services;
Provide medical advocacy;
Assist with victim compensation;
Provide prevention education or training;
Assess and respond to safety concerns;
Communicate with individuals seeking or receiving services;
Coordinate services requested by an individual;
Make authorized or legally permitted referrals;
Provide information and resources;
Schedule programming;
Process and acknowledge donations;
Administer events;
Evaluate applications;
Operate CVAC’s programs;
Maintain appropriate records;
Meet applicable legal, grant, audit, accreditation, funding, contractual, or program requirements;
Protect CVAC’s systems and information;
Detect, prevent, investigate, or respond to cybersecurity incidents, fraud, misuse, or unlawful activity;
Comply with applicable legal requirements;
Protect rights or safety where legally permitted or required; and
Carry out another lawful purpose disclosed or reasonably apparent when information is collected.

CVAC does not use personally identifying victim service information for commercial behavioral advertising.

8. Cookies, Analytics, and Similar Technologies

CVAC’s website may use cookies and similar technologies to support functions such as:

Operating the website;
Maintaining website security;
Remembering user preferences;
Diagnosing technical problems;
Measuring general website performance;
Understanding general website usage;
Maintaining accessibility or functionality; and
Improving the website and online services.

CVAC may use third-party providers to support website functionality and related services.

Because visiting certain portions of a victim services website may reveal sensitive interests or circumstances, CVAC seeks to minimize unnecessary collection, use, or disclosure of information associated with an individual’s use of victim service resources.

CVAC does not intend for the substance of confidential victim service communications to be collected through general website analytics or used for behavioral advertising.

To the extent applicable, users may be able to control certain cookies or similar technologies through browser settings or website privacy controls.

Disabling certain technologies may affect website functionality.

9. Electronic Communications and Safe Contact

Telephone calls, email, text messages, websites, and other electronic communications may create privacy and safety risks.

Information regarding communications may be accessible through systems or devices outside CVAC’s control, including:

Shared phones;
Shared computers;
Email accounts;
Cloud accounts;
Telephone records;
Mobile carrier records;
Browser history;
Device notifications;
Internet service provider records; or
Other systems.

Individuals seeking or receiving services may tell CVAC whether it is safe to:

Call;
Leave voicemail;
Send text messages;
Send email;
Send postal mail; or
Contact them at particular times.

CVAC seeks to follow documented safe contact preferences where reasonably practicable and legally appropriate.

Individuals should inform CVAC if their safe contact preferences change.

CVAC cannot control or guarantee the privacy or security of devices, accounts, telecommunications networks, internet services, email systems, mobile carriers, or other technology outside CVAC’s control.

10. Quick Exit and Device Safety

CVAC may provide a “Quick Exit” or similar safety feature on its website.

A Quick Exit feature may redirect a browser away from CVAC’s website, but it does not necessarily remove, erase, or conceal evidence that the website was visited.

Depending on the device and services involved, website activity may remain visible through:

Browser history;
Search history;
Cached information;
Download history;
Cookies;
Device logs;
Network records;
Internet service provider records;
Account histories; or
Other records.

Individuals concerned that another person may monitor their internet, account, or device use should consider using a safer device, account, network, or communication method when available.

CVAC does not guarantee that a Quick Exit feature will conceal an individual’s browsing activity from another person.

11. Third-Party Websites and Service Providers

CVAC may use, integrate with, or link to third-party services, including services related to:

Donations;
Payment processing;
Website hosting;
Information technology;
Video hosting;
Email;
Telecommunications;
Event management;
Maps or directions;
Accessibility;
Government resources;
Victim notification;
Community resources; and
Other external services.

Third parties may maintain their own terms, privacy policies, records, technologies, and security practices.

CVAC does not control all privacy or security practices of independent third parties.

When an individual leaves CVAC’s website, interacts directly with an independent service, or provides information directly to a third party, that third party’s terms and privacy practices may apply.

A link, reference, integration, or referral to an outside organization does not, by itself, constitute a representation, warranty, or endorsement of that organization’s privacy, security, availability, accuracy, or practices.

Nothing in this section authorizes CVAC to disclose information to a third party where disclosure is otherwise restricted or prohibited by applicable law.

12. Independent Agencies, Multidisciplinary Partners, and Professionals

CVAC’s work may involve interaction or coordination with organizations and professionals such as:

Law enforcement agencies;
Courts;
Prosecutors;
Attorneys;
Healthcare providers;
Hospitals;
Mental health professionals;
Child protective services;
Government agencies;
Schools;
Community organizations;
Victim service providers; and
Other professionals or agencies.

Unless expressly stated otherwise, these organizations and individuals may be legally and operationally independent from CVAC and may maintain their own records, systems, privacy practices, legal duties, and confidentiality obligations.

This Privacy Policy governs CVAC’s handling of information and does not control the independent practices of unrelated organizations or professionals.

Participation in a multidisciplinary or coordinated response does not, by itself, constitute authorization for CVAC to disclose information that is otherwise protected from disclosure by applicable law.

Information will be disclosed or coordinated only to the extent permitted or required under the requirements applicable to the particular information and circumstances.

13. Children and Minors

CVAC provides services to children and adolescents and recognizes the heightened sensitivity of children’s information.

CVAC seeks to minimize unnecessary collection of sensitive personal information from minors through general website forms.

Information concerning minors may be collected, used, or disclosed as reasonably appropriate and legally permitted to:

Respond to a request for services;
Provide authorized or legally permitted services;
Address safety concerns;
Administer Child Advocacy Center services;
Provide prevention or education programming;
Comply with applicable law;
Protect a child or another individual where legally permitted or required; or
Carry out another legitimate and legally permissible program purpose.

Privacy, consent, authorization, access, and confidentiality rights involving minors may vary depending on factors including:

The child’s age;
The particular service;
The professional providing the service;
Applicable federal or New York law;
The authority of a parent, guardian, caregiver, or representative;
Safety considerations;
Court orders;
The circumstances surrounding the alleged victimization; and
Applicable program or funding requirements.

A parent, guardian, caregiver, or other representative does not necessarily have an unrestricted right to all information concerning a minor in every circumstance.

To the extent the New York Child Data Protection Act, the Children’s Online Privacy Protection Act, or another child privacy law applies to a particular online interaction, CVAC will handle information concerning minors in accordance with the applicable requirements.

Nothing in this Privacy Policy should be interpreted as a representation that every CVAC website page, program, service, or interaction is subject to the same child privacy statute or requirement.

CVAC does not use personal information of known minors for commercial behavioral advertising.

Nothing in this section is intended to discourage a child or adolescent who needs assistance from contacting CVAC, emergency services, or another appropriate support resource.

14. Privacy Notice for Individuals Seeking or Receiving CVAC Services

This Section 14 specifically addresses information associated with individuals seeking, receiving, using, being referred for, or otherwise interacting with CVAC’s victim services.

The privacy and confidentiality protections applicable to a particular person’s information depend on the service, program, professional, funding source, applicable federal and state law, and surrounding circumstances.

Nothing in this Privacy Notice should be interpreted as providing less protection than applicable law requires.

14.1 Confidentiality of Victim Service Information

CVAC treats identifiable victim service information as confidential to the extent required by applicable law, regulation, evidentiary privilege, professional obligation, funding requirement, contractual obligation, or CVAC policy.

Depending on the program and requirements involved, applicable protections may restrict disclosure of information identifying an individual who:

Requested services;
Received services;
Used services;
Was referred for services;
Participated in services; or
Was denied services.

Personally identifying information may include more than a person’s name.

Depending on the circumstances, information such as an address, telephone number, email address, date of birth, family relationships, demographic characteristics, case details, or physical location may identify an individual.

Location and safe contact information concerning victims and survivors is treated with particular care because its disclosure may create privacy or safety risks.

14.2 Federal and State Victim Service Confidentiality Requirements

Certain CVAC programs, services, records, professionals, or activities may be subject to confidentiality requirements arising from federal or New York law or from victim services funding requirements.

Where such requirements apply, CVAC will comply with applicable restrictions concerning personally identifying or individual information associated with individuals requesting, receiving, using, or being denied covered victim services.

Where applicable law or funding requirements prohibit disclosure without an individual’s authorization except under specifically permitted circumstances, CVAC will follow the applicable requirement.

Routine administrative, grant, statistical, funding, auditing, or program reporting needs do not, by themselves, authorize CVAC to disregard applicable confidentiality requirements.

When permitted and appropriate, CVAC may use aggregate, statistical, coded, or de-identified information for lawful reporting, evaluation, administration, education, research, quality improvement, or similar purposes.

14.3 Authorizations and Releases of Information

When applicable law requires authorization before CVAC may disclose protected information, CVAC will follow the authorization requirements applicable to the information and circumstances.

Depending on the applicable confidentiality requirement, an authorization or release may be required to be:

Written;
Informed;
Voluntary;
Specific regarding the information to be disclosed;
Specific regarding the intended recipient or recipients; and
Reasonably limited in duration.

CVAC will not require an individual to authorize unnecessary disclosure of personally identifying victim service information as a condition of receiving covered services where doing so is prohibited by applicable law.

An individual should have an opportunity to ask questions before signing an authorization or release.

Where permitted by law, an individual may revoke an authorization with respect to future disclosures.

Revocation generally does not require information already properly disclosed in reliance upon a valid authorization to be retrieved, withdrawn, or destroyed by a recipient.

14.4 No Consent, Authorization, or Waiver Through Website Use

Accessing CVAC’s website, using online resources, submitting a general website form, or acknowledging this Privacy Policy does not constitute:

A victim service release of information;
Authorization to disclose confidential information;
Informed consent to disclosure;
Waiver of an applicable privilege;
Waiver of confidentiality;
Authorization for disclosure to law enforcement;
Authorization for disclosure to another service provider; or
Authorization for any other use or disclosure that requires separate consent under applicable law.

Any authorization or release legally required for a particular disclosure will be addressed separately in the manner required by applicable law.

14.5 Disclosures Required or Permitted by Law

Circumstances may arise in which disclosure is required or permitted without an individual’s authorization.

Depending on the particular law, information, profession, program, and circumstances involved, these may include:

Mandatory reporting obligations;
Legally required reports concerning suspected child abuse or maltreatment;
A statute requiring disclosure;
A legally enforceable court order;
Other legally compulsory processes;
Circumstances expressly permitted under an applicable evidentiary privilege or confidentiality law; or
Other circumstances expressly required or permitted by controlling law.

CVAC does not consider protected victim service information freely disclosable merely because a government agency, law enforcement agency, attorney, family member, healthcare provider, service provider, or other person requests it.

CVAC will evaluate requests in light of the requirements applicable to the particular information and circumstances.

Where applicable law requires notice to an affected individual or reasonable steps to protect the individual’s privacy and safety in connection with a compelled disclosure, CVAC will comply to the extent required and legally permitted.

The receipt of a subpoena, court order, governmental request, or other legal process does not, by itself, authorize CVAC to disclose information where a more protective federal or state confidentiality law, evidentiary privilege, funding requirement, or other legally controlling restriction applies.

Where disclosure is legally required, CVAC seeks to limit disclosure to the information necessary or appropriate to satisfy the applicable requirement.

14.6 Mandatory Reporting

Certain CVAC personnel may be mandated reporters under New York law based on their profession, role, responsibilities, or particular circumstances.

When applicable law requires an individual to report suspected child abuse, maltreatment, or another legally reportable circumstance, that individual must comply with the applicable legal obligation.

The existence and scope of a mandatory reporting obligation depend on the applicable law and circumstances.

Nothing in this Privacy Policy should be interpreted as a promise of absolute confidentiality where applicable law requires disclosure.

14.7 Privileged Communications

Certain communications involving qualifying professionals or advocates may be protected by federal or New York confidentiality or evidentiary privilege laws.

Depending on the applicable legal requirements, this may include certain communications involving qualifying:

Rape crisis counselors;
Domestic violence advocates;
Mental health professionals;
Social workers;
Attorneys; or
Other professionals.

The existence, scope, ownership, and possible waiver of a privilege depend on factors including:

The particular professional or advocate involved;
The program;
The nature of the communication;
The surrounding circumstances;
The person legally holding the privilege;
Applicable exceptions; and
Applicable law.

CVAC does not represent that every communication with every employee, volunteer, advocate, counselor, or representative receives the same legal privilege.

Where a privilege or other heightened confidentiality requirement applies, CVAC will apply that protection as required by applicable law.

14.8 Counseling and Trauma-Related Information

Counseling information may contain particularly sensitive information concerning:

Victimization;
Trauma;
Mental or behavioral health;
Medical circumstances;
Family relationships;
Personal history;
Safety;
Counseling goals; and
Other private matters.

CVAC maintains counseling information subject to applicable confidentiality laws, professional obligations, recordkeeping requirements, program requirements, and organizational policies.

Additional requirements may apply depending on the professional providing the service, the nature of the information, and applicable law.

Nothing in this Privacy Policy should be interpreted as an absolute promise of confidentiality where a legally applicable exception or reporting duty exists.

14.9 Child Advocacy Center Services

CVAC provides Child Advocacy Center services that may involve a multidisciplinary response.

Depending on the matter, professionals or agencies involved may include:

Victim advocates;
Forensic interviewers;
Medical professionals;
Mental health professionals;
Law enforcement personnel;
Child protective services personnel;
Prosecutors; and
Other appropriately authorized participants.

Participation in a Child Advocacy Center or multidisciplinary response does not eliminate otherwise applicable privacy, confidentiality, privilege, authorization, or disclosure requirements.

Information may be used, coordinated, or disclosed among authorized participants only to the extent permitted or required by applicable law, program requirements, valid authorization, court order, or other lawful authority.

The independent participants in a multidisciplinary response may have separate legal obligations and may maintain records independent of CVAC.

14.10 Services Involving Minors

Children and adolescents may have privacy, consent, access, and confidentiality rights that vary depending on:

Their age;
The service provided;
The professional providing the service;
The identity and authority of a parent, guardian, or representative;
The circumstances surrounding the victimization;
Court orders;
Applicable law;
Safety considerations; and
Applicable program requirements.

A parent, guardian, caregiver, or representative does not necessarily have an unrestricted right to all information concerning a minor in every circumstance.

Where applicable law requires consent or authorization involving both a minor and an appropriate parent or guardian, CVAC will follow the applicable requirement.

Where the involvement of a parent, guardian, caregiver, alleged offender, or other person is legally restricted or presents a legally recognized safety or confidentiality issue, CVAC will handle consent and disclosure according to applicable requirements.

14.11 Legal Advocacy and, Where Applicable, Legal Services

CVAC may provide legal advocacy and, where applicable, legal services relating to legal systems, rights, and proceedings.

Such services may include assistance with matters such as:

Understanding legal processes;
Accompaniment to court or other proceedings;
Victims’ rights;
Family Court matters;
Orders of protection;
Victim impact statements;
Referrals; and
Other forms of legal advocacy or assistance.

Use of CVAC’s general website or submission of a general website form does not, by itself, establish an attorney-client relationship or create legal representation.

Where an attorney separately agrees to provide legal representation, the scope and terms of that relationship and applicable attorney-client confidentiality and professional obligations will govern that representation.

General information provided through the CVAC website should not be treated as individualized legal advice unless expressly provided as such by an appropriately authorized professional in connection with a professional relationship.

14.12 Crisis Intervention and 24/7 Advocacy

During crisis intervention or advocacy, CVAC seeks to collect information reasonably appropriate to:

Understand an individual’s immediate needs;
Assess safety concerns;
Provide emotional support;
Provide information;
Identify appropriate resources;
Coordinate requested advocacy;
Arrange an appropriate response; or
Fulfill applicable legal requirements.

CVAC recognizes that crisis communications may contain highly sensitive information.

Information associated with crisis services is handled according to applicable privacy and confidentiality requirements.

The 24/7 Crisis Line should be used for immediate crisis support. CVAC’s text line may not provide an immediate response.

14.13 Medical Advocacy and Health-Related Information

CVAC services may involve medical advocacy or interaction with medical providers.

Different privacy and confidentiality requirements may apply depending on:

Who creates the information;
Who maintains the information;
The nature of the service;
The professional involved;
The system in which information is maintained; and
Applicable federal or state law.

CVAC will comply with applicable health information confidentiality requirements where they apply.

14.14 HIPAA

The Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) applies only where the applicable federal requirements for HIPAA coverage are satisfied.

Not every nonprofit, counseling, advocacy, crisis intervention, legal advocacy, victim service, or health-related activity is automatically subject to HIPAA.

Nothing in this Privacy Policy constitutes a representation that all CVAC programs, professionals, communications, systems, or records are governed by HIPAA.

If a particular CVAC program or activity is legally subject to HIPAA and requires a separate Notice of Privacy Practices, that notice and applicable HIPAA requirements will control with respect to protected health information subject to HIPAA.

Other federal or New York confidentiality requirements may apply independently of HIPAA and may provide different or additional protections.

14.15 Referrals and Coordination With Other Organizations

Individuals may request CVAC’s assistance in connecting with other organizations or professionals, including:

Healthcare providers;
Mental health professionals;
Attorneys;
Government agencies;
Law enforcement;
Housing providers;
Victim compensation programs;
Schools;
Child protective services;
Community organizations; and
Other support resources.

CVAC will comply with applicable authorization and confidentiality requirements before disclosing protected personally identifying victim service information as part of a referral or coordination activity.

Where appropriate, an individual may choose to communicate directly with an outside organization rather than having CVAC disclose information on the individual’s behalf.

14.16 Internal Access to Service Information

CVAC seeks to limit internal access to identifiable service information to personnel or other authorized individuals who reasonably require access to carry out their responsibilities or who otherwise have lawful authority to access the information.

Internal access does not eliminate applicable confidentiality obligations.

Personnel or authorized individuals may be subject to confidentiality requirements, policies, training, supervision, or access restrictions appropriate to their roles.

Nothing in this section represents that every record is accessible by every CVAC employee or that every CVAC employee has access to the same systems or information.

14.17 Technology and Vendors Used for Service Information

CVAC may use technology systems or third-party service providers to support functions such as:

Information technology;
Communications;
Data storage;
Case management;
Cybersecurity;
Telecommunications;
Document management; and
Other operational functions.

When sensitive information is entrusted to a service provider, CVAC seeks to select, use, and oversee providers in a manner consistent with applicable legal, contractual, privacy, security, confidentiality, and funding requirements.

Specific safeguards may vary depending on the information, provider, system, risks involved, and applicable requirements.

Use of a service provider does not authorize the provider to use or disclose protected victim service information for purposes prohibited by applicable law.

Nothing in this Privacy Policy should be interpreted as a representation regarding a particular technology, security control, contractual provision, encryption method, or vendor configuration unless expressly stated.

14.18 Grant, Audit, Statistical, and Program Reporting

CVAC may be required to provide information concerning program operations, services, demographics, outcomes, financial matters, or other program information to funders, auditors, governmental agencies, or other authorized entities.

Such reporting will be handled subject to applicable confidentiality requirements.

Where required or appropriate, information may be aggregated, de-identified, coded, or otherwise presented in a manner designed to avoid identifying individual service recipients.

CVAC will not treat an ordinary funding, audit, statistical, or administrative request as authorization to disclose personally identifying victim service information where such disclosure is prohibited by applicable law.

15. Information Security

CVAC maintains administrative, technical, and physical safeguards designed to protect information against unauthorized access, acquisition, disclosure, alteration, destruction, misuse, or loss consistent with applicable legal requirements and the nature and sensitivity of the information involved.

Specific safeguards may vary according to the:

Information involved;
Program or activity;
Technology involved;
Identified risks;
Applicable legal requirements; and
Operational circumstances.

Safeguards may include, as appropriate:

Access restrictions;
Authentication controls;
Confidentiality requirements;
Privacy and security policies;
Training;
Technical protections;
Physical protections;
Vendor oversight;
Secure storage or disposal practices;
System monitoring; and
Incident response procedures.

This list is illustrative and does not describe or represent the complete security architecture or configuration of any CVAC system.

CVAC does not publicly disclose detailed security information where doing so could itself create a security risk.

16. No Guarantee of Absolute Privacy or Security

CVAC takes privacy, confidentiality, and information security seriously and uses safeguards designed to protect information consistent with applicable requirements.

Nevertheless, no organization, website, information system, communication method, device, or storage system can guarantee absolute privacy or security.

CVAC therefore does not warrant or guarantee that every:

Communication;
Website;
Information system;
Telephone network;
Internet connection;
Email service;
Mobile device;
Third-party service;
Electronic transmission; or
Electronic or physical storage system

will be completely secure, error-free, uninterrupted, or immune from unauthorized activity.

References in this Privacy Policy to confidentiality, privacy, security, safeguards, or protection describe CVAC’s practices and applicable obligations and should not be interpreted as a guarantee that unauthorized access, interception, acquisition, loss, disclosure, misuse, or another security event can never occur.

Nothing in this section reduces or limits any duty imposed upon CVAC by applicable law.

17. No Sale or Commercial Exploitation of Victim Service Information

CVAC does not sell or rent personally identifying information concerning an individual’s request for or receipt of victim services for commercial purposes.

CVAC does not use personally identifying information concerning:

Victimization;
Counseling;
Crisis intervention;
Safety planning;
Child Advocacy Center services;
Legal advocacy;
Medical advocacy; or
Other victim services

for commercial behavioral advertising.

Nothing in this section prevents processing or disclosures that are otherwise permitted or required by law and reasonably necessary to provide, administer, secure, fund, evaluate, or support CVAC’s services and operations.

18. Data Retention

CVAC retains information for periods appropriate to the nature of the information and applicable requirements.

Retention periods may depend on:

Federal law;
New York law;
Professional requirements;
Funding requirements;
Grant requirements;
Contractual requirements;
Accounting requirements;
Insurance requirements;
Litigation holds;
Court orders;
Program requirements;
Applicable limitation periods;
Legitimate operational needs; and
CVAC records retention policies.

Different retention requirements may apply to different categories of information, including:

Counseling records;
Crisis service records;
Child Advocacy Center records;
Legal advocacy records and, where applicable, legal-service records;
Case management records;
Medical advocacy information;
Donation records;
Accounting records;
Employment records;
Applicant records;
Education or training records;
Website inquiries; and
Other information.

This Privacy Policy does not establish a specific minimum or maximum retention period except where a particular period is required by an applicable legally controlling requirement.

When information is no longer required to be retained, CVAC may securely delete, destroy, anonymize, de-identify, or otherwise dispose of it consistent with applicable requirements and organizational procedures.

19. Requests Concerning Personal Information

Individuals may contact CVAC with questions or requests concerning personal information maintained about them.

Depending on the type of information and applicable law, a person may have certain rights concerning:

Access;
Correction;
Amendment;
Disclosure;
Restriction; or
Deletion.

CVAC will evaluate and respond to requests to the extent required by applicable law.

CVAC may take reasonable steps to verify the identity and authority of a person making a privacy request before disclosing information or taking requested action.

A request may be limited, restricted, or denied where required or permitted by law, including where providing access or taking the requested action would:

Violate another person’s privacy or confidentiality;
Reveal protected information concerning another person;
Conflict with professional recordkeeping requirements;
Conflict with legal or funding requirements;
Conflict with a court order;
Affect an investigation or legal proceeding;
Create a legally recognized safety concern;
Conflict with applicable records retention requirements; or
Otherwise be prohibited or restricted by law.

Requests concerning counseling, advocacy, Child Advocacy Center, legal, medical, or other service records may be subject to different procedures and requirements from requests concerning general website information.

20. Security Incidents and Legally Required Notifications

CVAC maintains procedures intended to identify, assess, respond to, and mitigate suspected information security incidents.

Whether a particular event constitutes a legally reportable data breach or other reportable incident depends on applicable law and the surrounding circumstances.

Where notification is legally required, CVAC will provide notice to affected individuals, regulators, governmental entities, funders, or other parties to the extent and in the manner required by applicable law.

Nothing in this Privacy Policy expands, eliminates, or limits a breach notification or incident reporting obligation imposed by law.

21. Changes to This Privacy Policy

CVAC may update this Privacy Policy from time to time to reflect changes in:

Applicable law or regulation;
CVAC services or programs;
Technology;
Privacy or security practices;
Funding requirements;
Organizational practices; or
Other relevant circumstances.

The current version will be posted with a revised “Last Updated” date.

Where applicable law requires additional notice, authorization, or consent before a material change may apply to previously collected information, CVAC will comply with the applicable requirement.

A revision to this Privacy Policy does not retroactively eliminate or reduce a confidentiality protection, evidentiary privilege, or legal right that cannot lawfully be eliminated or reduced.

22. Relationship to Other Notices, Authorizations, and Agreements

CVAC programs, services, or professionals may use additional documents, including:

Informed consent documents;
Releases of information;
Authorizations;
Program-specific privacy notices;
Professional disclosure statements;
Counseling documents;
Client rights documents;
Legal representation or engagement documents;
Grant-required notices;
HIPAA Notices of Privacy Practices, where applicable; and
Other notices or forms required by applicable law or professional practice.

Those documents should be read together with this Privacy Policy where applicable.

If there is a conflict between this Privacy Policy and another legally controlling requirement, the requirement that legally controls the particular information, service, or circumstance will govern.

23. Controlling Law and Interpretation

If any statement in this Privacy Policy conflicts with an applicable:

Federal law;
New York law;
Local law;
Regulation;
Court order;
Evidentiary privilege;
Professional obligation;
Funding requirement;
Grant condition;
Legally valid authorization; or
Other legally binding requirement.

If a conflict exists, the controlling legal requirement will govern.

Nothing in this Privacy Policy should be interpreted to:

Authorize conduct prohibited by applicable law;
Prohibit conduct required by applicable law;
Reduce a protection required by law;
Expand a disclosure authority beyond what applicable law permits; or
Eliminate a legally applicable confidentiality or privilege protection.

24. No Waiver of Legal Rights or Obligations

Nothing in this Privacy Policy is intended to:

Waive any right that cannot lawfully be waived;
Limit any confidentiality protection required by law;
Eliminate a legally recognized privilege;
Expand CVAC’s obligations beyond those otherwise applicable;
Eliminate an individual’s rights under applicable law;
Create authority to disclose information where disclosure is prohibited;
Prevent CVAC from complying with applicable law; or
Prevent CVAC from asserting any legally available right, defense, privilege, immunity, limitation, or protection.

25. No Contractual Rights Created

This Privacy Policy is intended to provide notice regarding CVAC’s privacy practices.

Except to the extent otherwise provided or required by applicable law, nothing in this Privacy Policy is intended, by itself, to create:

A separate contract;
A guarantee;
A warranty;
A fiduciary relationship;
A third-party beneficiary right;
A private right of action;
An attorney-client relationship;
A counselor-client relationship;
A healthcare provider relationship; or
A legal duty or remedy beyond those independently imposed by applicable law or separately undertaken by CVAC.

Nothing in this section limits or waives any right, protection, duty, privilege, or remedy that cannot lawfully be limited or waived.

26. Severability

To the extent permitted by applicable law, if any provision of this Privacy Policy is determined by a court or other authority of competent jurisdiction to be invalid, unlawful, or unenforceable, that determination will not affect the remaining provisions to the extent they can continue to operate independently and consistently with applicable law.

Nothing in this section permits the elimination or modification of a right or protection that cannot lawfully be waived or restricted.

27. No Third-Party Rights

Except to the extent otherwise required by applicable law, this Privacy Policy is intended to describe CVAC’s privacy practices and is not intended to confer contractual rights upon unrelated third parties.

Nothing in this section limits any right or remedy independently available under applicable law.

28. Questions and Privacy Concerns

Individuals may contact CVAC with questions or concerns regarding this Privacy Policy or CVAC’s privacy and confidentiality practices.

Crime Victims Assistance Center, Inc.

71 Robinson St

Binghamton, New York 13901

United States

Main Office: (607) 723-3200

Questions concerning the confidentiality of a particular CVAC service may also be directed to the applicable counselor, advocate, attorney, program supervisor, or other appropriate CVAC representative.

General privacy inquiries should not be used when immediate crisis assistance is needed.

For immediate crisis advocacy:

24/7 Crisis Line: (607) 722-4256

CVAC also maintains a text line: (607) 725-8196.

The text line is not an immediate response service and may not receive a response until the next business day.

If you are experiencing an emergency or immediate danger, call 911 or the appropriate emergency service.