Privacy
Hero Facilitation collects and uses information for specific purposes: to respond to inquiries, provide agreed services, operate the business, and maintain necessary records.
You do not need to provide your whole file to get started.
Information you choose to provide
When you contact Hero by email, phone, text, a scheduling service, or another contact method, Hero may receive information you choose to share. This may include your name and contact information, the participant's name, general information about what you are seeking help with, regional-center or SDP status, and communication, language, or accessibility information.
Please do not send sensitive participant records through a general website contact form.
Sensitive information may include a UCI or other regional-center identifier, insurance information, private medical or clinical information, IPPs, individual-budget or Spending Plan records, FMS information, financial or banking information, or other private personal records.
You do not need those records just to begin a conversation.
If we decide to work together and records are needed, Hero will identify information relevant to the agreed work and establish an appropriate way to exchange it.
Information used for Hero services
Independent Facilitation and person-centered planning may require information beyond what someone initially shares through the website.
Depending on the work, that may include planning documents, regional-center records, IPPs, individual-budget or Spending Plan information, FMS or provider records, insurance-related information, and medical or clinical information relevant to the participant's planning, access, needs, or services.
Hero does not request an entire record simply because it exists. Information should be reasonably related to the work being performed.
The public website is not intended to function as a repository for participant records.
Service-related confidentiality and information sharing may also be governed by the applicable Service Agreement, written authorizations, and law.
HIPAA and California confidentiality
HIPAA does not automatically apply to every independent facilitator or every health-related record. Its federal rules apply to defined covered entities and business associates. If an activity performed by Hero falls within HIPAA, the applicable privacy, security, contractual, and breach-notification duties govern that activity. Hero does not claim government-issued “HIPAA certification.” HHS: Covered Entities and Business Associates.
California law may protect records independently of HIPAA. Welfare and Institutions Code §4514 protects information and records obtained while providing developmental-disability services and limits disclosure. The California Confidentiality of Medical Information Act may also apply to particular medical information and organizations. HIPAA is not the only source of confidentiality obligations.
Participant direction and permission to share records
A family member's, supporter's, or professional's participation does not automatically establish unrestricted access to a participant's private records. Before a disclosure requiring authorization, the correct decision-maker, recipient, purpose, records covered, and any time limit must be identified. Permission to share with one organization for one purpose does not automatically permit public disclosure or unrelated uses.
How information is used
Hero may use information to respond to inquiries, schedule and prepare for conversations, determine whether Hero's role fits the requested work, provide agreed Independent Facilitation or person-centered planning services, communicate and coordinate as authorized, maintain service and business records, process billing, and meet applicable legal or administrative obligations.
Participant and client information is not used for unrelated public or advertising purposes.
When information may be shared
Hero may share information when appropriately authorized, reasonably necessary for the agreed work, or otherwise permitted or required by law.
Depending on the work and applicable authorization, that may include participant-selected or legally authorized people involved in the work, regional-center personnel, FMS providers, service providers, professionals, interpreters, advocates, or other team members.
Hero may also use service providers that support business operations, such as website hosting, scheduling, communications, file or business-management systems, billing or invoicing, and other technology services. Those providers may process information as necessary to provide their services.
Where authorization or permission is required, convenience is not a substitute for that authorization.
Recording, transcription, and AI-assisted documentation
For an initial consultation, Hero may offer optional Zoom AI notes to summarize the conversation and next steps. Hero will ask before using this feature, and you may choose manual notes instead. Online meeting and documentation services can offer recording, live transcription, automated notes, and AI-generated summaries. Such features can process voices, names, health details, and other sensitive participant information. Reading this website or contacting Hero is not consent to recording or automated processing. Use of these features for participant-specific work calls for a separate review of the person's direction, applicable consent requirements, service terms, privacy safeguards, and who may access the resulting records.
California Penal Code §632 generally requires consent from all parties before recording a confidential communication. When a cloud provider processes electronic protected health information on behalf of a HIPAA-covered entity or business associate, applicable HIPAA requirements include a business associate agreement and appropriate safeguards. HHS cloud-computing guidance. Ask which documentation method is proposed if you have concerns about recording or automated summaries.
Website and technical information
The website host and enabled services may automatically process limited technical information needed to operate, secure, diagnose, or understand use of the site.
Depending on the production configuration, this may include an IP address, browser or device information, pages visited, date and time of access, approximate location derived from technical information, and similar site-use information.
Hero does not operate its own cross-site behavioral-advertising program.
Hero reviews hosting, analytics, forms, scheduling, cookies, embedded services, and other enabled features as part of site maintenance so this notice can be updated if the site configuration changes.
Cookies and browser privacy signals
The production website may use cookies or similar technologies needed for hosting, security, site functionality, or enabled services. If optional analytics or other technologies are enabled, this notice will reflect those practices.
Hero does not independently alter site behavior in response to a browser Do Not Track signal and does not use the site to track visitors across unrelated websites for behavioral advertising.
Third-party hosting or technology providers may process technical information and handle browser privacy signals according to their own settings and privacy practices.
Security and retention
Hero takes reasonable steps to limit access to sensitive information and to use appropriate methods for exchanging participant records.
No website, email system, cloud service, or electronic transmission method can be guaranteed to be completely secure.
Hero may retain information for as long as reasonably necessary for the purpose for which it was collected, providing and documenting services, billing and business recordkeeping, applicable legal or administrative requirements, dispute resolution, and legitimate backup or archival needs.
Privacy concerns and security incidents
If sensitive records were sent to the wrong person, a shared file was accessed without permission, or an account or device may be compromised, contact Hero promptly. You do not need to repeat sensitive details in an ordinary email or text to report a concern. Whether further investigation, corrective action, or notice is required depends on the facts and applicable law, including California Civil Code §1798.81.5 on reasonable data security and §1798.82 on certain breach notifications, and HIPAA when applicable.
Reviewing or correcting information
If you want to ask about personal information you provided directly to Hero, or believe information maintained by Hero should be corrected, contact Hero.
Hero may need to verify identity and, when participant information is involved, the person's authority to receive, discuss, or request changes to that information before acting on the request.
Hero can address records maintained by Hero. Hero cannot independently alter an official record maintained by a regional center, FMS, insurer, provider, government agency, or another organization.
Third-party services and links
This Privacy Notice describes Hero's practices. Third-party websites, scheduling services, hosting providers, regional centers, FMS providers, insurers, service providers, and other organizations have their own privacy practices. When you use a third-party service or follow an external link, that organization's privacy notice may also apply.
Changes to this Privacy Notice
Hero may update this Privacy Notice when website features, business practices, service providers, or applicable requirements change.
Material changes will be reflected on this page, and the effective date will be updated. When another form of notice is appropriate, Hero may provide additional notice.
Effective date: October 17, 2026
Content last reviewed: October 17, 2026
Questions
If you are unsure whether information is appropriate to send, ask before sending it.
You do not need to disclose the sensitive information itself just to ask how it should be shared.