Public website data categories
Basic technical data
IP/network information, browser/device, date/time, requested page, security events, and server logs as configured.
Privacy-oriented analytics
Page views and site performance only after tool, configuration, retention, consent/cookie obligations, and care-seeking privacy are reviewed.
Administrative contact data
Name and contact information only if an approved non-PHI administrative form is later enabled with constrained choices and no clinical narrative.
Newsletter or event data
Only through an approved vendor, clear purpose, consent, retention, unsubscribe, and no health-status profiling.
Employment/training data
Through an approved applicant or training system with a separate notice, role access, retention, and security—not mixed with clinical data.
Clinical data
Not stored in public WordPress. It crosses to the approved secure intake/EHR/portal environment.
Privacy governance controls
Data-flow register
What data enters, where it goes, who receives it, why, legal/contract basis, storage, retention, deletion, and incident path.
Vendor and BAA review
Contract, security, privacy, accessibility, subcontractors, breach response, data location, termination, export, and deletion.
Least privilege and MFA
Named accounts, role-based access, no shared administrator credentials, MFA, periodic access review, and prompt removal.
Content and media consent
Specific purpose, voluntary choice, revocation, duration, audience, channels, youth assent/guardian authority, storage, and removal.
Retention and deletion
Schedules for logs, forms, applications, media, backups, vendor systems, analytics, and legal holds.
Incident response
Detection, containment, preservation, escalation, legal/contract analysis, notification, correction, CAPA, and remeasurement.
Source and publication control
Designed from Reach One’s controlled planning record
This page is generated from the Reach One website/strategic planning package, SPW readiness baseline, executive decision register, program-design materials, and website build charter. Production publication still requires current evidence, named approval, workflow testing, and a rollback path for any claim that can change.