Privacy Policy

What we collect

We collect three categories of information.

Account information. Your name, email address, phone number, and password (stored as a one-way salted hash — we never see your plaintext password).

Order information. Billing and shipping addresses you enter at checkout. Payment details (card numbers, etc.) are collected directly by our payment processor (Stripe) and never touch our servers — we only receive the last four digits and a payment confirmation token.

Clinical intake (PHI). If you purchase a letter service, you complete a clinical questionnaire. This includes demographic information, mental-health history, current symptoms, medications, and details about your service or emotional support animal. See the dedicated Protected health information section below for how this is handled.

We also collect minimal technical information automatically: IP address, browser type, and pages visited — used to keep the site running and to detect abuse. Third-party analytics (see Cookies + tracking) are kept off every page that handles protected health information.

How we use information

We use your information to:

Create and maintain your account.
Process your purchases and deliver the products and services you’ve ordered.
Connect you with a licensed clinician in your state and process your clinical assessment.
Send transactional emails (order confirmations, letter delivery, renewal reminders, etc.).
Respond to your support inquiries.
Detect and prevent fraud or abuse.
Comply with legal obligations (subpoenas, valid law-enforcement requests, etc.).

We do not sell your personal information, and we do not share or rent your information for third-party advertising — including the “sharing for cross-context behavioral advertising” concept defined under the California Privacy Rights Act.

Protected health information

When you complete a clinical intake, the information you provide is Protected Health Information (PHI) under the Health Insurance Portability and Accountability Act of 1996 (HIPAA). NSAR operates as a Business Associate to the licensed clinicians who review your case, and we treat PHI with the following protections:

Encryption at rest. Sensitive intake fields are encrypted in our database using AWS KMS (Key Management Service) envelope encryption.
Access controls. Only the clinician assigned to your case and a small set of NSAR staff with operational need can read your intake.
Audit logging. Every access to your PHI — including by you, your clinician, and our staff — is recorded in a tamper-resistant audit log.
Limited disclosure. The letter your clinician issues states that you have a qualifying disability and that your animal ameliorates symptoms. It does not disclose your diagnosis or specific medical history to your landlord, airline, or any third party.
Vendors with BAAs. Where a vendor processes PHI on our behalf (cloud database, email, error tracking), we have a signed Business Associate Agreement requiring the same HIPAA-grade protections. The current vendor list is in the Who we share with section below.

Your separate rights under HIPAA — including the right to access your records, request amendments, and receive an accounting of disclosures — are described in our Notice of Privacy Practices.

Who we share with

We share your information only with parties who need it to do their job. As of the last-updated date above, those parties include:

Your assigned clinician. A licensed mental-health professional in your state. They see your full intake; you can verify their state license number at our clinician directory.
Stripe (payment processing). Payment card details and billing addresses. Stripe is PCI DSS Level 1 certified.
Postmark or AWS SES (transactional email). Your email address and the contents of transactional messages.
AWS (cloud hosting + storage). Database and file storage for your account and intake.
ShipStation (shipping). When you order a physical kit, your shipping address is shared with our fulfillment partner.

We will only disclose your information in response to a legal request (subpoena, warrant, court order) when we believe in good faith that disclosure is required by law. We will, where lawful, notify you before disclosing PHI in response to a legal request.

How we protect your information

Information security is a continuous practice, not a destination. Our current measures include:

TLS encryption (HTTPS) for all traffic.
Encryption at rest for sensitive fields and storage buckets.
Multi-factor authentication available for staff accounts.
Hashed passwords (argon2id) — we never store plaintext.
Access controls based on the minimum-necessary principle — staff see only the information they need to do their job.
Append-only audit logging for every PHI access.
Regular security reviews and dependency updates.

No system is perfectly secure. If you believe your account has been compromised, contact security@nsarco.com right away.

Your rights

You have the right to:

Residents of California (CCPA / CPRA), Virginia (CDPA), Colorado (CPA), Connecticut (CTDPA), and Utah (UCPA) have additional state-specific rights — including the rights to opt out of targeted advertising and profiling. Because we do not sell or share PHI for advertising purposes and we do not engage in profiling for material decisions, the universal rights below satisfy these statutes for our service. To exercise any state-specific right, email privacy@nsarco.com and identify your state of residence so we can apply the correct response timeline.

Access the information we hold about you. Email privacy@nsarco.com to request a copy.
Correctinaccurate information. You can edit most account details directly from your account page; for anything you can’t edit yourself, email us.
Delete your account and associated information, subject to legal recordkeeping requirements (we must retain certain HIPAA records for at least six years).
Withdraw consent for non-essential communications at any time. Transactional emails (order confirmations, etc.) cannot be turned off while your account is active.

For your HIPAA-specific rights — including the right to request an accounting of who has accessed your records — see our Notice of Privacy Practices.

Cookies + tracking

We use a small number of cookies, all essential to the site working:

Authentication cookie — keeps you signed in. Required.
Cart cookie— remembers what you’ve added to your cart. Required for checkout.
Referral cookie— temporarily attributes a referral if you arrived via a friend’s link. Cleared after signup or 30 days.
Analytics cookies — Google Analytics (GA4) and Microsoft Clarity set cookies (such as _ga and _clck/_clsk) to measure traffic and how visitors move through the site. Set only on our public marketing pages — never on your account, the assessment, or any other page that handles protected health information.

We use Google Analytics 4 on our public marketing pages (home, products, blog, and the checkout funnel) to understand traffic and how people move through the site. On those same pages we also use Microsoft Clarityfor aggregate heatmaps and session replays that show how visitors navigate — with form fields masked, so what you type isn’t captured. We deliberately keep both — and any other third-party analytics — off every page that handles protected health information: your account portal, the clinical assessment/intake, and order tracking. We do not use the Facebook Pixel or other advertising trackers.

We do use our own first-party, cookieless analytics to understand aggregate traffic — which pages are visited, roughly when, and (where available) the general region and device type. It uses no cookies and no cross-site tracking, stores no raw IP address and no full browser fingerprint, and cannot identify you or follow you across other websites. We honor Do Not Track and Global Privacy Control signals — when your browser sends one, we record nothing. These analytics run only on public marketing pages, never on pages that handle protected health information.

Children

NSAR services are intended for adults aged 18 and over. We do not knowingly collect personal information from anyone under 18. If you believe a minor has created an account with us, contact privacy@nsarco.com and we will delete the account.

Changes to this policy

We may update this policy from time to time. When we make material changes, we’ll update the “Last updated” date above and, where significant, send a notice to your account email so you can review the change before it takes effect.

Text messages (SMS)

If you opt in, we send text messages to the mobile number you provide. We offer two separate, optional consents, each with its own checkbox at checkout or in your account profile: Order & account updates (transactional — your assistance-animal letter status, shipping and tracking, and reminders to finish your clinical intake or send a required animal photo) and Offers & reminders (marketing — occasional promotions and abandoned-cart reminders).

Message frequency varies. Message and data rates may apply. Reply STOP to any message to unsubscribe, or HELP for help. Consent to receive texts is not a condition of any purchase.

We do not sell, rent, or share your mobile phone number or your SMS opt-in consent with third parties or affiliates for their own marketing. Your number is used only to deliver the messages you requested, through our messaging provider.

Questions about texts: info@nsarco.com or 719-257-4201.

Contact

For privacy questions: privacy@nsarco.com.

For HIPAA-specific questions: contact our Privacy Officer at privacy@nsarco.com.

Mailing address:
National Service Animal Registry, LLC
PO Box 2901
Cleveland, TN 37320