Privacy Policy

CHILL ACT EXPO (Children's Health Inclusion Learning Leadership) is committed to protecting the privacy of every family who interacts with us. This Privacy Policy explains how Children's Health Inclusion Learning Leadership, a Utah 501(c)(3) nonprofit organization doing business as CHILL ACT EXPO ("we," "us," or "our"), collects, uses, and protects your personal information when you visit chillactexpo.com, register for an event, book a screening appointment, or communicate with us.

By using our website or services, you agree to the practices described in this policy.

1. Information We Collect

We collect information you provide directly to us, including:

• Contact information: First and last name, email address, phone number
• Child information: Child's name, age, and developmental concerns (for screening appointments only)
• Event preferences: City, interests, and zones you select during registration
• Appointment details: Screening types requested, preferred time slots, and any notes you provide
• Communication records: Messages you send us and responses we provide

We also automatically collect limited technical data when you visit our website, including device type, browser type, pages viewed, and general location (city/state level). We do not collect precise GPS location data.

2. How We Use Your Information

We use the information we collect to:

• Confirm your event registration and send your calendar invite
• Schedule and confirm free developmental screening appointments
• Send event updates, reminders, and important day-of information
• Send educational and informational emails about upcoming CHILL ACT EXPO events
• Send SMS text reminders about your registration or screening appointment
• Respond to your questions and support requests
• Improve our events and services based on attendance and feedback
• Comply with legal obligations

We do not use your information for automated decision-making that produces legal or similarly significant effects.

3. SMS Text Messaging

We use Twilio, Inc. to deliver SMS messages. Your phone number is transmitted to Twilio solely for message delivery purposes. Twilio's privacy policy is available at twilio.com/legal/privacy.

We do not sell, rent, or share your phone number with any other third party for marketing purposes. Your consent to receive SMS is not a condition of attending any CHILL ACT EXPO event.

4. Email Communications

When you register for a CHILL ACT EXPO event, you will receive:

• A registration confirmation email with your event details and a calendar invite
• A series of informational emails leading up to your event, including vendor spotlights, screening information, and day-of preparation tips
• A day-of reminder email with venue details and check-in instructions

We use Resend, Inc. to deliver emails on our behalf. Your email address is transmitted to Resend solely for delivery purposes. Resend's privacy policy is available at resend.com/legal/privacy-policy.

5. Data Sharing & Third Parties

We do not sell, rent, or trade your personal information. We share your information only with:

• Service providers who help us operate our events and communications (Twilio for SMS, Resend for email, Supabase for secure data storage, Stripe for payment processing). Each provider is contractually bound to use your data only to provide services to us.
• Event partners (vendors, screening providers) at the specific event you registered for — limited to first name and registration status only, for check-in purposes. We do not share screening data, child information, or contact details with vendors.
• Law enforcement or legal authorities when required by law, court order, or to protect the safety of our community.

Screening appointment details (child name, age, screening types, and results) are strictly confidential and are never shared with any vendor, sponsor, or third party without your explicit written consent.

6. Data Retention

We retain your personal information for as long as necessary to provide our services and comply with legal obligations:

• Registration data — retained for 3 years after the event date for attendance records and future event planning
• Screening appointment data — retained for 1 year after the event date, then securely deleted
• Email and SMS communication logs — retained for 2 years
• Unsubscribe records — retained indefinitely to honor your opt-out preference

You may request deletion of your data at any time (see Your Rights section below). After deletion, we retain only a minimal record of your opt-out status to prevent accidental re-enrollment.

7. Your Rights & Choices

Regardless of your location, you have the following rights regarding your personal information:

• Access: Request a copy of the personal information we hold about you
• Correction: Request that we correct inaccurate or incomplete information
• Deletion: Request that we delete your personal information (subject to legal retention requirements)
• Opt-out of SMS: Reply STOP to any text message we send you
• Opt-out of email: Click Unsubscribe in any email, or email us directly
• Opt-out of data sharing: Contact us to restrict sharing beyond what is strictly necessary for service delivery

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days. We do not charge a fee for these requests and will never discriminate against you for exercising your privacy rights.

8. Children's Privacy

CHILL ACT EXPO events welcome children and families. However, all registrations and data submissions must be completed by a parent or legal guardian who is 18 years of age or older. We do not knowingly collect personal information directly from children under the age of 13.

Child information submitted during screening appointment booking (such as name and age) is provided by a parent or guardian and is used solely to prepare for the child's screening appointment. This information is treated with the highest level of confidentiality and is never shared with vendors or third parties without explicit parental consent.

If you believe we have inadvertently collected information from a child without parental consent, please contact us immediately at [email protected] and we will delete it promptly.

9. Security

We take the security of your information seriously. We use industry-standard measures including:

• HTTPS encryption on all pages and data submissions
• Row-level security controls on our database — limiting access strictly to what each system needs
• API key management practices that prevent secret exposure in public code
• Access controls limiting which team members can view personal data

No system is 100% secure. If you have reason to believe your information has been compromised, please contact us immediately at [email protected].

10. Updates to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make material changes, we will update the "Last updated" date at the top of this page and, where appropriate, notify registered families by email.

Your continued use of our website or services after any update constitutes your acceptance of the revised policy.

11. Contact Us

For privacy questions, data requests, SMS opt-outs, or any concerns about how we handle your information: