Privacy Policy

Behavioral Health CFOs, LLC
Effective Date: October 2026
Last Updated: October 2026

Behavioral Health CFOs, LLC ("Behavioral Health CFOs," "we," "us," or "our") is a financial consulting firm that provides fractional CFO, controller, and outsourced accounting services exclusively to behavioral health providers. We are not a licensed CPA firm. This Privacy Policy explains how we collect, use, disclose, and protect information when you visit bhealthcfo.com (the "Site"), complete a form, schedule a call with us, or email us.

This Policy covers the Site and our general business communications only. Information we handle for clients under an engagement is governed by the written engagement letter and, where applicable, a Business Associate Agreement, not by this Policy.

1. Please Don't Send Us Protected Health Information (PHI)

Please read this section before contacting us.

• Please don't send us patient information. That means no protected health information (PHI), patient names, dates of service, diagnoses, treatment details, insurance or claims data, medical record numbers, or any other information about an individual's health or care in our contact form, Calendly booking questions, social media messages, or unsolicited email.
• Do not send client records. Do not send patient lists, billing exports, remittance files, EHR reports, payroll files, bank statements, or similar records through the Site or in an introductory email. A general description of your organization (for example, levels of care, number of beds or locations, approximate revenue) is all we need for a first conversation.
• The Site is not a HIPAA-covered channel. The Site, its contact form, our scheduling tool, and ordinary email are not designed or configured to receive PHI. We do not enter into a Business Associate relationship with anyone through the Site.
• PHI is exchanged only under a signed agreement. If an engagement requires access to PHI, we will do so only after (1) a signed engagement letter and (2) a signed Business Associate Agreement are in place, and only through secure channels we agree on in writing.
• If you send PHI anyway. If we receive PHI through the Site or unsolicited email, we will not use it for any purpose, will limit access to it, and will delete it or return it as soon as reasonably practicable. We may also let you know so you can assess your own obligations. Sending PHI to us this way does not create a Business Associate relationship.

2. Information We Collect

Information you give us

• Contact form submissions: your name, email address, phone number, organization, and the content of your message.
• Scheduling data (Calendly): our booking button is a link to Calendly's own website; we do not embed Calendly on the Site. When you book a call there, your name, email address, the time you select, your time zone, and your answers to any booking questions (for example, an overview of your organization, approximate annual revenue, and your main business challenge). Calendly may also collect information under its own privacy policy.
• Email and other correspondence: your contact details, the content of your messages, and any attachments you choose to send.
• Business information: details about your organization you choose to share, such as service lines, size, and financial goals.

Information collected automatically

• Device and log data: IP address, browser type and version, operating system, device type, referring and exit pages, pages viewed, date and time of visits, and approximate location derived from IP address.
• Fonts (Google Fonts): the Site loads its fonts from Google Fonts. When a page loads, your browser connects to Google's servers, and Google receives your IP address and basic browser information under its own privacy policy.

The Site does not currently use analytics, advertising, or tracking tools. We may add tools such as analytics; we will update this policy before doing so.

Information from other sources

We may receive business contact information from publicly available sources, professional networking sites, and referral partners. We use it only for legitimate business-to-business purposes described in this Policy.

We do not intend to collect sensitive personal information through the Site, and we ask that you not provide it (see Section 1).

3. How We Use Information

We use information to:

• respond to your inquiry and communicate with you;
• schedule, prepare for, and hold introductory and follow-up calls;
• evaluate whether our services are a fit for your organization and prepare proposals;
• send business communications you have requested or that relate to an inquiry or relationship with us (you may opt out of non-essential communications at any time);
• operate, maintain, secure, and improve the Site;
• understand how visitors use the Site, in aggregate, so we can improve content;
• detect, prevent, and address fraud, spam, abuse, and security incidents;
• keep business records and comply with legal, tax, accounting, and professional obligations; and
• protect our rights, property, and safety, and those of others.

4. How We Disclose Information

We do not sell personal information, and we do not share personal information for cross-context behavioral advertising. We do not rent or trade contact lists.

We disclose information only as follows:

• Service providers (processors). We use outside vendors to run our business. They process information on our behalf, under their own security and privacy commitments. These generally include:
  • Scheduling: Calendly (appointment booking, through a link to Calendly's website);
  • Website fonts: Google Fonts;
  • Email, documents, and productivity: Google Workspace;
  • Website hosting: our website host.
• Professional advisors. Our attorneys, accountants, insurers, and similar advisors, under duties of confidentiality.
• Legal and safety reasons. When we believe disclosure is required by law, subpoena, or legal process, or is necessary to protect the rights, property, or safety of Behavioral Health CFOs, our clients, or others.
• Business transfers. In connection with a merger, acquisition, financing, or sale of all or part of our business, subject to customary confidentiality protections.
• With your direction or consent. For example, if you ask us to introduce you to a referral partner.

5. Cookies and Your Choices

The Site does not use analytics or advertising cookies. Google Fonts receives your IP address when a page loads (see Section 2). Third-party sites you choose to visit from the Site (for example, Calendly when you follow our booking link) may set their own cookies under their own policies. We may add tools such as analytics; we will update this policy before doing so.

Your choices:

• You can block or delete cookies through your browser settings. Some features may not work properly if you do.
• Global Privacy Control (GPC): To the extent required by applicable law, we will treat a GPC signal from your browser as a valid request to opt out of the sale or sharing of personal information for that browser.
• "Do Not Track": There is no consistent industry standard for "Do Not Track" browser signals, and the Site does not currently respond to them.

6. How Long We Keep Information

We keep personal information only as long as reasonably necessary for the purposes described in this Policy, including to meet legal, tax, accounting, and professional record-keeping requirements. As a general guide:

• Inquiries and scheduling records that do not lead to an engagement: for as long as reasonably needed for our business purposes. We do not have a fixed deletion schedule for these records;
• Records relating to clients and engagements: for the period required by the engagement letter, applicable law, and professional standards; and
• PHI received in error: deleted or returned as soon as reasonably practicable (see Section 1).

When information is no longer needed, we delete it or de-identify it.

7. Your Privacy Rights

Depending on where you live, you may have rights regarding your personal information under U.S. state privacy laws, such as the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA) and comparable laws in other states, to the extent those laws apply to us and to your information. Whether or not a particular law applies, we aim to honor reasonable requests. These rights may include the right to:

• Access / know: request confirmation of whether we process your personal information and a copy of it;
• Correction: ask us to correct inaccurate information;
• Deletion: ask us to delete personal information we hold about you;
• Opt out: opt out of marketing communications, and, where applicable, of the sale of personal information, sharing for cross-context behavioral advertising, or targeted advertising (we do not engage in these activities); and
• Non-discrimination: exercise these rights without receiving discriminatory treatment.

How to make a request. Email josh@bhealthcfo.com with the subject line "Privacy Request," or call 435-429-2855. We will need to verify your identity before acting on certain requests, and we may ask for information to do so. You may use an authorized agent where permitted by law; we may require proof of the agent's authority. If we deny your request, we will explain why, and where applicable law provides a right to appeal, you may appeal by replying to our decision with the subject line "Privacy Appeal."

We will respond within the time required by applicable law. Some information may be exempt from deletion or access, for example where we must keep it for legal, tax, or professional reasons.

Unsubscribing from emails. You can opt out of non-essential emails at any time by using the unsubscribe link (if provided) or by replying to let us know. We may still send messages related to an active inquiry or engagement.

8. Security

We use reasonable administrative, technical, and organizational safeguards designed to protect the information we collect. No website, internet transmission, or email system is completely secure, and we cannot guarantee absolute security. This is another reason we ask you not to send PHI or sensitive records through the Site or ordinary email (see Section 1). If you believe your interaction with us is no longer secure, please contact us right away.

9. Children's Privacy

The Site is intended for business professionals and is not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided us personal information, please contact us and we will delete it.

10. Third-Party Sites and Services

The Site may link to third-party websites and services (such as Calendly, LinkedIn, or downloadable resources hosted elsewhere). We do not control those third parties, and their collection and use of information is governed by their own privacy policies. We recommend reading them.

11. Visitors Outside the United States

We are based in, and the Site is operated from, the United States. Our services are offered to U.S. organizations. If you access the Site from outside the United States, your information will be processed in the United States, where privacy laws may differ from those in your country.

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last Updated" date above and post the updated Policy on this page. If we make material changes, we will take reasonable additional steps to let you know, such as a notice on the Site. Your continued use of the Site after an update means the updated Policy applies going forward.

13. Governing Law

This Privacy Policy is governed by the laws of the State of Utah, without regard to its conflict-of-laws rules, except where the privacy laws of your state of residence apply and require otherwise.

14. Contact Us

If you have questions about this Privacy Policy or our privacy practices, please contact:

Behavioral Health CFOs, LLC
Attn: Privacy
Email: josh@bhealthcfo.com

Reminder: please do not include patient information or PHI in your message.