Privacy Policy

Scope, controller and relationship to other records

This Policy applies when CHSPS determines why and how personal information is processed in connection with CHSPS.org, public forms, My CHSPS accounts, accreditation and assurance services, education, membership, standards-development participation, complaints and appeals, public verification, events, sponsorship or grant inquiries, payments, support and related communications. For purposes of data-protection laws that use the terms controller or business, CHSPS is the controller or business unless a different role is expressly stated.

An applicant, accredited organization, employer, education provider, vendor or other third party may independently control information it gives to CHSPS. Those organizations remain responsible for their own notices, permissions, lawful bases, minimization and disclosures. This Policy does not replace their obligations.

Information we collect

Depending on how you interact with CHSPS, we may collect the following categories of information:

• Identity and contact data: name, title, employer or organization, email, telephone number, postal address and account identifiers.
• Organization and accreditation data: organization identity, scope, program, ownership or authority information, application records, evidence, findings, responses, reviewer communications, complaints, appeals, renewal and maintenance information.
• Account and security data: authentication events, session identifiers, hashed network or device signals, multi-factor-authentication state, recovery and security-event records.
• Transaction data: products or services purchased, invoices, payment status, amounts, refunds, fulfillment and related billing records. Payment-card processing may be performed by a payment processor; CHSPS does not need the full card number to administer an order when the processor provides a token or transaction reference.
• Education, membership and participation data: registrations, attendance or completion information, membership records, public comments, committee or reviewer interest, event participation and communications preferences.
• Website and device data: IP-derived security data, browser/user-agent information, requested pages, referrer or campaign parameters where permitted, client-side error information, and cookies or browser storage described below.
• Communications: messages, support requests, forms, attachments and correspondence sent to or from CHSPS.
• Public or third-party information: information from public registries, organization websites, authorized representatives, service providers or other lawful sources when reasonably relevant to a CHSPS function.

We ask users not to provide information that is unnecessary for the stated purpose.

Sensitive, special-category and confidential information

Accreditation evidence can contain confidential business information and, in limited circumstances, personal or sensitive information. Applicants and other submitters must minimize such data, redact identifiers that are not necessary, and have authority and a lawful basis to provide the information. Do not submit patient medical records, Social Security numbers, full payment-card numbers, passwords, authentication secrets, or other highly sensitive personal information unless CHSPS specifically requires the information through an authorized secure process and the disclosure is lawful.

Where applicable law treats information as sensitive or special-category data, CHSPS processes it only when a permitted legal condition applies and only to the extent reasonably necessary for the applicable purpose. CHSPS may reject, delete, quarantine or require redaction of unnecessary sensitive information without treating that action as a failure to accept evidence.

How we use information

CHSPS may use personal information to:

• provide, administer and secure accounts, websites, portals, forms and services;
• evaluate eligibility, scope, evidence and conformity; administer technical review, decisions, maintenance, complaints and appeals; and preserve accreditation records;
• process purchases, invoices, payments, fulfillment, refunds and fraud-prevention controls;
• deliver education, membership benefits, events, publications, requested notices and support;
• authenticate users, prevent abuse, investigate security events, debug failures and maintain service integrity;
• operate standards development, public comment, governance, reviewer and stakeholder-participation processes;
• publish information that CHSPS is authorized or required to make public, such as accreditation status, scope, standards records, formal actions or attributed public comments when the governing process provides for publication;
• respond to legal process, protect rights and safety, enforce agreements, establish or defend legal claims, and meet tax, accounting, corporate or regulatory obligations;
• improve CHSPS services using aggregated, de-identified or consented diagnostic information where practicable; and
• send the Standards Bulletin or other optional communications when requested, with an unsubscribe mechanism where applicable.

CHSPS may use information for another compatible purpose permitted by law. If a materially different purpose requires consent or a new notice under applicable law, CHSPS will obtain or provide it before that processing.

Legal bases for processing

Where a law requires CHSPS to identify a legal basis, the basis depends on the activity and may include: performance of a contract or steps requested before entering a contract; compliance with legal obligations; CHSPS's legitimate interests in operating a secure, accountable accreditation and standards organization; consent; protection of legal rights; and other bases available under applicable law.

Examples of legitimate interests may include information security, fraud prevention, maintaining accreditation and corporate records, responding to inquiries, improving services, preserving impartiality and defending legal claims. CHSPS balances those interests against affected individuals' rights where the law requires that balancing. Where processing depends on consent, consent may be withdrawn prospectively without affecting prior lawful processing.

Cookies, browser storage and similar technologies

CHSPS uses or may use cookies, local storage, session storage, scripts, security challenges, payment technologies and similar storage/access technologies. These technologies are not all advertising tools. Some are required to secure a session, remember a requested interface state, submit a protected form, keep a cart, process a payment or remember your privacy choice.

Third parties used for security or payment processing may set or access their own strictly necessary technologies when you use those functions. Browser settings can also delete or block storage, but blocking necessary technologies may prevent sign-in, protected forms or checkout from working.

Standards Bulletin, service messages and marketing choices

When you enter an email address and select Subscribe for the Standards Bulletin, you request those emails. You may unsubscribe using an unsubscribe mechanism provided in the message or by contacting CHSPS. CHSPS may retain a limited suppression record so that an unsubscribe request can be honored.

Optional marketing or publication emails are different from transactional, legal, security, accreditation, billing or account communications needed to provide a service, administer an agreement, protect an account or meet a legal obligation. Opting out of optional messages does not prevent CHSPS from sending those necessary service communications.

When information may be disclosed

CHSPS may disclose personal information only as reasonably necessary for a stated or legally permitted purpose, including to:

• service providers and processors supporting hosting, security, authentication, cloud infrastructure, document storage, email delivery, payment processing, fraud prevention, customer support, communications or technical operations, subject to appropriate contractual or legal controls where required;
• reviewers, decision participants, advisors and authorized contractors who need information for a CHSPS function and are subject to applicable confidentiality and conflict requirements;
• your organization or authorized representatives where they control or are entitled to the relevant account, application, accreditation or transaction;
• government, courts, law enforcement or other parties when disclosure is required by law, legal process, a valid governmental request, or reasonably necessary to protect rights, safety, security or legal claims;
• successors or transaction participants in a reorganization, merger, asset transfer or similar institutional transaction, subject to applicable law and confidentiality protections; and
• the public when publication is part of an accreditation, standards, public-comment or other published CHSPS record and the publication is authorized by the applicable process.

CHSPS does not grant vendors or sponsors access to applicant files merely because of a commercial relationship.

No sale of personal information; no targeted-ad business model

As of the effective date, CHSPS does not sell personal information for monetary consideration. CHSPS advertises its own services on Google and uses Google Analytics and Google Ads conversion measurement on CHSPS.org to understand which pages and ads lead to requests. CHSPS does not build remarketing audiences or use personalized advertising, and ad personalization is turned off. Because some U.S. state laws may treat measurement data shared with an advertising platform as “sharing,” CHSPS gives every visitor a way to opt out: choose “Essential only” on the site banner, turn off Google measurement in Privacy Choices, or use Global Privacy Control.

Disclosures to processors that provide CHSPS a requested operational service, disclosures directed by an individual, and legally required disclosures are not treated by CHSPS as sales. If CHSPS materially changes these practices in a manner that triggers an opt-out right, CHSPS will provide the legally required notice and choice before the new covered processing.

International access and data transfers

CHSPS is a United States organization. Information may be processed in the United States and in other countries where CHSPS or its service providers operate. Those countries may have data-protection laws different from the laws where you live.

When applicable law restricts international transfers, CHSPS will use a legally recognized transfer mechanism or exception as appropriate, which may include an adequacy decision, standard contractual clauses, a data-transfer addendum, contractual safeguards, consent where legally valid, or another permitted mechanism. CHSPS may take additional technical or organizational measures when reasonably required by the applicable transfer framework.

Retention and deletion

CHSPS retains personal information for no longer than reasonably necessary for the purpose for which it was collected and for legitimate recordkeeping, accreditation, contractual, tax, audit, security, dispute-resolution and legal needs. Different records have different retention needs. Accreditation decisions, public status history, standards records, governance records and evidence of institutional actions may require longer retention than ordinary inquiries.

When information is no longer required, CHSPS may delete it, de-identify it, aggregate it, archive it under restricted access or retain it when a legal hold or other lawful exception applies. A deletion request does not require CHSPS to erase information that applicable law permits or requires CHSPS to keep, including records reasonably necessary to establish, exercise or defend legal claims or preserve the integrity of an accreditation or public record.

Security and incident response

CHSPS uses administrative, technical and organizational safeguards designed for the nature of the information and the risks involved, including access controls, authentication, transport security, security logging, abuse prevention and restricted operational access where appropriate. Service providers are selected and managed based on the function they perform and the information involved.

AI-assisted tools and automated processing

CHSPS may provide AI-assisted website help or use automated tools to support administrative functions. If you use an AI-assisted help feature, the prompt and related technical context may be processed to generate a response. Do not enter confidential application evidence, patient information, passwords, authentication secrets or other sensitive information into a public AI help feature.

Public AI assistance is informational and does not make an accreditation decision. CHSPS does not treat a public chatbot response as an official interpretation, finding, eligibility determination or accreditation decision. Where applicable law gives rights concerning solely automated decisions that produce legal or similarly significant effects, CHSPS will honor those rights for covered processing.

Your privacy rights and how to exercise them

Depending on your residence, the nature of the processing and the law that applies to CHSPS, you may have rights to request access, correction, deletion, restriction, portability, objection, withdrawal of consent, information about processing, limitation of sensitive-data use, or an appeal of certain privacy-request decisions.

Submit a request to info@chsps.org with the subject Privacy Request, or use the CHSPS contact page. Describe the right you want to exercise and the information or CHSPS relationship involved. CHSPS may need to verify identity and authority before disclosing, correcting or deleting information. An authorized agent may submit a request where applicable law permits it, subject to legally permitted verification.

CHSPS will respond within the period required by the law that applies to the request. CHSPS will not unlawfully discriminate or retaliate against an individual for exercising a privacy right. If CHSPS denies a request in whole or part, CHSPS will provide the explanation or appeal information required by applicable law.

United States state privacy notices

If a U.S. comprehensive state privacy law applies to CHSPS and to your information, CHSPS will provide the rights and notices that law requires. Depending on the state, these may include rights to know or access personal information, correct inaccuracies, delete covered information, obtain a portable copy, opt out of covered sales, targeted advertising or certain profiling, limit certain uses of sensitive personal information, appeal a denied request, and receive equal service for exercising a right.

For California residents, categories of information collected and sources are described in Sections 2 and 8; business or commercial purposes are described in Section 4; retention is described in Section 11. CHSPS's current sale/share practice is stated in Section 9. CHSPS will honor legally valid opt-out preference signals where required. Nothing in this Policy asks a California consumer to waive a right that the California Consumer Privacy Act makes non-waivable.

EEA, United Kingdom, Switzerland and other international rights

Where the EU GDPR, UK GDPR, Swiss data-protection law or another similar law applies, individuals may have rights including information, access, rectification, erasure, restriction, portability, objection, withdrawal of consent and safeguards relating to certain automated decisions. You may also have the right to complain to the competent supervisory or data-protection authority.

Where Canadian, Brazilian, Australian or another national or regional privacy law applies to CHSPS, CHSPS will honor the non-waivable rights and accountability duties required by that law. References in this Policy to a particular jurisdiction do not mean that every law applies to every CHSPS interaction, and they do not reduce broader rights that another applicable law provides.

Children and minors

CHSPS.org and My CHSPS are primarily directed to organizations, professionals and adult users. CHSPS does not knowingly solicit personal information directly from children under 13 through the public website. If CHSPS learns that personal information was collected from a child in circumstances requiring parental consent that was not obtained, CHSPS will take appropriate steps consistent with applicable law.

Where a CHSPS service is lawfully offered to or concerns a minor, additional notices, consent or authorization requirements may apply. Organizations submitting evidence concerning minors remain responsible for minimizing that information and having authority to disclose it.

Changes, contact and controlling version

CHSPS may update this Policy when its services, technologies, legal obligations or privacy practices change. The current version is posted at chsps.org/privacy with its effective or revision date. When required by law, CHSPS will provide additional notice or obtain consent before a material change takes effect for covered processing.

Privacy questions and requests may be sent to info@chsps.org, subject Privacy Request, or mailed to Commission for Health, Safety & Professional Standards, Inc., 818 18th St NW 1373, Suite 810, Washington, DC 20006, United States.

Privacy Policy & Cookie Notice 2026.2, revised October 11, 2026.