Privacy Policy

1. Introduction

Healthy Building Alliance ("HBA," "we," "us," or "our") operates an online directory, membership platform, forum, and learning/shopping center at healthybuildingalliance.org (the "Site"). We provide tools for members to create profiles, list services, participate in discussions, and purchase products, services, or educational content.

This Privacy Policy explains how we collect, use, disclose, and protect personal information of users in the United States, including residents of California.

2. Personal Information We Collect

We may collect the following categories of personal information (as that term is defined under California law) from you:

• Identifiers: name, username, password, email address, phone number, postal address, IP address, and similar identifiers.
• Professional information: organization, job title, business contact details, directory listing information, and other details you choose to include in your profile. For professionals listed in the HBA directory, this may also include trade licenses, professional certifications, insurance certificates, and other credentialing documentation submitted as part of the vetting process.
• Commercial information: membership level, subscription details, order history, products or services purchased, transactions through our learning center or shop, course enrollment and completion records, assessment scores, and continuing education credits earned through the Site.
• Payment-related information: limited billing information such as billing address and last four digits of your payment card. Full card details are processed by our payment processor (e.g., Stripe) and are not stored by us.
• User content: forum posts and comments, directory listing descriptions, questions you submit, reviews, messages, and any other content you voluntarily provide that may be visible to other users or visitors.
• Internet or network activity: device and browser information, IP address, access times, pages viewed, links clicked, referring/exit pages, and similar data collected via cookies and similar technologies.
• Inference data: general interests or preferences we infer from your use of the Site (e.g., topics you view or courses you interact with), used to improve relevance of content.

We collect this information directly from you, automatically from your devices when you use the Site, and from service providers acting on our behalf (such as analytics and payment providers).

3. How We Use Personal Information

We use personal information for the following business purposes:

• To operate, maintain, and improve the Site, directory, forum, membership features, and learning/shopping center.
• To create and manage accounts and member profiles.
• To publish directory listings and forum contributions as you configure them (e.g., public business profile, public posts).
• To process payments, memberships, subscriptions, and orders through third-party payment processors such as Stripe.
• To communicate with you about your account, transactions, service-related updates, and support requests.
• To send newsletters, updates, and other marketing communications where permitted by law and your preferences (you can opt out at any time).
• To monitor and secure the Site, detect and prevent fraud or abuse, and enforce our Terms of Service.
• To comply with applicable laws, regulations, and legal processes.

We do not use your personal information to make automated decisions that produce legal or similarly significant effects about you.

4. How We Disclose Personal Information

We do not sell or share your personal information for cross-context behavioral advertising as those terms are defined under the California Consumer Privacy Act as amended by the CPRA ("CCPA/CPRA"). We may disclose personal information in the following situations:

• Service providers: with vendors and service providers who perform services on our behalf, such as hosting, email delivery (including our email marketing platform, which may track email open rates and link clicks on our behalf), analytics, payment processing (e.g., Stripe), security, and customer support, under contracts that restrict their use of your information to the services they provide us.
• Public content: information that you choose to make public (e.g., directory profile fields you mark as public, forum posts, reviews) is visible to other users or visitors and may be indexed by search engines. If you delete your account or exercise your right to deletion, we will remove your content from the Site; however, we cannot guarantee that content previously indexed by third-party search engines will be removed from those indexes, which operate independently of us.
• Legal and safety: when we believe disclosure is necessary to comply with laws, regulations, legal processes, or governmental requests, or to protect the rights, property, or safety of HBA, our users, or others.
• Business transfers: in connection with a merger, acquisition, reorganization, or sale of assets, subject to appropriate confidentiality and security safeguards.
• Vetting and credentialing providers: where we use third-party services to verify professional licenses, certifications, or insurance credentials submitted by directory applicants, we share the relevant documentation with those providers solely for verification purposes. These providers are contractually prohibited from using the information for any other purpose.

5. Cookies and Tracking Technologies

We use cookies and similar technologies to:

• Enable essential features such as login, account management, security, and shopping carts.
• Remember your settings and preferences.
• Understand how visitors use the Site (for example, which pages are visited and how often) to improve our content and user experience.

We currently use cookies only for essential, functional, and basic analytics purposes and do not use them to sell or share your personal information for cross-context behavioral advertising. For more details, see our Cookie Policy.

You can manage cookies via your browser settings and, where offered, through our on-site cookie controls.

6. Your Privacy Rights (United States and California)

A. General US rights

Regardless of where you live in the US, you may:

• Access and obtain a copy of certain personal information we hold about you.
• Request that we correct inaccurate information about you.
• Request deletion of information, subject to important exceptions (e.g., where we must retain certain records for legal or administrative reasons).
• Opt out of marketing communications by following the unsubscribe link in our emails or contacting us.

You can exercise these rights by contacting us using the details in the "Contact Us" section below. We may need to verify your identity before fulfilling your request.

B. Additional rights for California residents

If you are a California resident, you have the following additional rights under the CCPA/CPRA:

• Right to know: You can request that we disclose the categories and specific pieces of personal information we have collected about you, the categories of sources from which we collected it, the business or commercial purposes for which we collected it, and the categories of third parties to whom we disclose it.
• Right to delete: You can request that we delete personal information we have collected from you, subject to certain exceptions (for example, if we must retain it to comply with legal obligations or to complete transactions you requested).
• Right to correct: You can request that we correct inaccurate personal information we maintain about you.
• Right to opt out of sale or sharing: You can request that we do not sell or share your personal information for cross-context behavioral advertising. At this time, we do not sell or share personal information as those terms are defined under California law.
• Right to know about and delete inferences: Under the CPRA, inferences we draw from your personal information to create a profile about you are themselves a category of personal information. You can request disclosure of inferences we hold about you and request that we delete them, subject to the same exceptions that apply to other deletion requests.
• Right to limit use and disclosure of sensitive personal information: If we collect "sensitive personal information" (as defined by California law) for purposes beyond those allowed by law, you may direct us to limit our use and disclosure of such information. Currently, we do not use sensitive personal information for additional purposes that would trigger this right.
• Right to non-discrimination: We will not discriminate against you for exercising any of your privacy rights, such as by denying you services, charging different prices, or providing a different level or quality of services, except as permitted by law (for example, if a difference is reasonably related to the value of your data).

How to submit California privacy requests

You can exercise your California rights by:

• Emailing us at: info@healthybuildingalliance.org
• Submitting a request through our web form at: healthybuildingalliance.org/contact

We will take reasonable steps to verify your identity before responding, which may include verifying information associated with your account or asking you to sign in. You may also authorize an agent to make requests on your behalf; we may require proof of the agent's authority and verification of your identity.

Notice of collection (past 12 months)

In the last 12 months, we have collected the categories of personal information described in Section 2 above for the business purposes described in Section 3. We have disclosed these categories to service providers and other third parties as described in Section 4.

7. Children's Privacy

The Site is intended for individuals at least 16 years old. We do not knowingly collect personal information from children under 16. If you believe a child under 16 has provided us with personal information, please contact us and we will take steps to delete such information as required by law.

8. Data Security and Retention

We use reasonable technical and organizational safeguards designed to protect personal information from unauthorized access, use, disclosure, or loss. However, no online service can be completely secure.

We retain personal information for as long as reasonably necessary to provide the Services, comply with our legal obligations, resolve disputes, and enforce our agreements. The specific retention period may vary depending on the type of data and the purposes for which we collected it.

9. Nevada Residents

If you are a Nevada resident, Nevada Senate Bill 220 gives you the right to opt out of the sale of certain personal information to third parties who intend to license or sell it. We do not currently sell personal information as defined under Nevada law. If you would like to submit an opt-out request or ask questions about our Nevada privacy practices, you may contact us at info@healthybuildingalliance.org.

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will post the updated version on the Site and update the "Effective Date" at the top. Your continued use of the Site after the revised Policy becomes effective means that you accept the changes.

11. Contact Us

If you have questions or requests regarding this Privacy Policy or your privacy rights, contact: