Institute for Behavior Change Online Privacy Policy

Last Updated: October 1, 2026
Effective Date: September 25, 2025

‍

At Institute for Behavior Change, we are committed to protecting your privacy and personal data. This Privacy Policy (“Policy”) explains how we collect, use, disclose, and protect your personal data when you visit our website, https://www.instituteforbehaviorchange.org, and use our services. We comply with applicable privacy laws. We comply with global privacy laws, including but not limited to:

  • Oregon Consumer Privacy Act (Oregon, US)
  • General Data Protection Regulation (GDPR)
  • California Consumer Privacy Act (CCPA) / California Privacy Rights Act (CPRA)
  • Lei Geral de Proteção de Dados (LGPD)
  • Personal Information Protection and Electronic Documents Act (PIPEDA)
  • Act on the Protection of Personal Information (APPI)
  • Australian Privacy Principles (APPs) under the Privacy Act 1988

By using our website, you agree to the collection and use of personal data in accordance with this Policy.

‍

1. Introduction and Scope

‍

This Policy applies to all personal data processed by Institute for Behavior Change in connection with our services and website visitors. Our services include membership, education, continuing education approval, specializations, professional community activities, and events.

‍

Our Contact Details:
Institute for Behavior Change
Address: PO Box 232, Bend, OR 97709
Email: info@instituteforbehaviorchange.org
Website: https://www.instituteforbehaviorchange.org

‍

Privacy Contact: Institute for Behavior Change
Email: info@instituteforbehaviorchange.org

‍

We encourage you to read this Policy carefully to understand our practices regarding your data and how we will treat it.

‍

2. Information We Collect

‍

We collect various types of information for different purposes to provide and improve our services to you. We only collect data that is necessary for the stated purposes.

‍

2.1. Personal Data

‍

This includes information that can be used to identify you directly or indirectly. The categories of personal data we may collect include:

  • Identifiers: Name, email address, postal address, phone number, IP address, unique personal identifiers, online identifiers.
  • Commercial Information: Records of membership, educational offerings, events, or other services purchased, obtained, or considered.
  • Financial Information: Payment card details (processed securely by third-party payment processors; we do not store full payment card numbers), billing address.
  • Account Information: Username, password, preferences, feedback.
  • Communications: Information you provide when contacting us, such as customer support inquiries, survey responses, feedback, complaints, or appeals.
  • Professional or Employment-Related Information: Job title, company name, professional credentials, and relevant professional experience.
  • Education Information: Course registrations, attendance, learning activities, assessments, completion records, continuing education records, and specialization information.

2.2. Usage Data

‍

When you access our website, we may automatically collect certain information, including:

  • Device Information: IP address, browser type, browser version, operating system, unique device identifiers.
  • Usage Patterns: Pages visited, time spent on pages, referral source, navigation paths, clickstream data.
  • Location Data: General location derived from your IP address.
  • Cookies and Tracking Technologies: Information collected through cookies, web beacons, and similar technologies, as detailed in Section 2.4 of this Policy.

‍

2.3. Sensitive Personal Information

‍

We may collect, use, store and otherwise process certain types of personal data that are considered sensitive, special category, or protected data, under global data protection laws. This may include, depending on your location and the services we provide:

  • Racial or ethnic origin, if you choose to provide this information in an optional demographic survey.
  • Physical or mental health data, if needed to evaluate a requested accessibility or examination accommodation.
  • Financial account information processed in connection with a payment, where considered sensitive under applicable law.

We only process this type of data when:

  • You have given your explicit consent, where required by applicable law.
  • It is required or authorized by law, subject to any additional conditions applicable to sensitive data.
  • It is necessary for the establishment, exercise, or defense of legal claims, where permitted by applicable law.

We implement appropriate safeguards to protect this information, including:

  • Encryption and secure storage
  • Access restrictions and role-based controls
  • Staff training and confidentiality obligations
  • Data minimization and retention limits

We will never use sensitive personal data for marketing or profiling without your explicit consent where required.

‍

Your rights regarding this data, including access, correction, deletion, objections, and withdrawal of consent, may vary depending on your jurisdiction. Please refer to the “7.

Your Data Protection Rights” section of this Policy or contact us at info@instituteforbehaviorchange.org for further details.

‍

2.4. Tracking Technologies

We and our third-party partners may use a variety of tracking technologies to collect information about your interactions with our website and services. These include:

  • Cookies: Small text files stored on your device that help us remember your preferences, enable functionality, and analyze site usage. These are set by both our website (first-party cookies) and via our partners (third-party cookies).
  • Tracking Scripts / Analytics Tools: Software that collects information about how you interact with our website.
  • Web Beacons / Pixels: Tiny graphic images or scripts embedded in web pages or emails that track whether you have accessed certain content or opened an email.
  • Local Storage: Technologies such as HTML5 local storage and browser cache, which store information locally on your device for faster access and improved experience.
  • Session Storage: Temporary storage of data during your browser session, which is cleared when you close your browser.
  • Log Files: Automatically recorded information about your device and usage upon each visit.
  • Flash Cookies: Also known as “local shared objects,” these can store preferences and activity data across sessions and browsers.
  • Device Fingerprinting: Techniques that analyze information from your device, such as browser type, operating system, and settings, to uniquely identify your device.
  • Software Development Kits (SDKs): Code embedded in our mobile applications to enable tracking across mobile devices.
  • Log Files: Automatically recorded information about your device and usage upon each visit.

These technologies may be used for purposes such as enabling website functionality, remembering user preferences, providing analytics, and maintaining the security of our services.

‍

You may adjust your browser or device settings to limit or disable some tracking technologies, though certain features may not function properly without them.

‍

3. How We Use Your Information

‍

We use the collected data for various purposes, based on specific legal bases:

  • To Provide and Maintain Our Service: Including to process your transactions, manage your account, and deliver the services you request. This includes administering membership, education, continuing education approval, specializations, and events.
  • To Improve and Personalize Our Service: To understand how you use our services, develop new features, and tailor content to your preferences.
  • To Send You Marketing and Promotional Communications: Where you have opted in about products, services, and offers that may be of interest to you.
  • For Customer Support: To respond to your inquiries, provide technical support, and resolve issues.
  • For Analytics and Research: To monitor and analyze trends, usage, and activities in connection with our services.
  • For Security and Fraud Prevention: To detect, prevent, and address technical issues, fraud, or illegal activities.
  • To Comply with Legal Obligations: To meet our regulatory and legal requirements, such as tax and accounting obligations.
  • For Advertising: To deliver targeted advertisements to you (where you have opted in or as permitted by law).

‍

4. How We Share Your Information

‍

We may share your personal data with third parties in certain circumstances, always ensuring appropriate safeguards are in place.

‍

4.1. Service Providers: We may engage third-party companies and individuals to facilitate our services, perform service-related services, or assist us in analyzing how our service is used (e.g., hosting providers, payment processors, analytics providers, email service providers). These third parties have access to your personal data only to perform these tasks on our behalf and are obligated not to disclose or use it for any other purpose.

‍

4.2. Business Transfers: If Institute for Behavior Change is involved in a merger, acquisition, or asset sale, your personal data may be transferred. We will provide notice before your personal data is transferred and becomes subject to a different privacy policy.

‍

4.3. Legal Requirements: We may disclose your personal data in the good faith belief that such action is necessary to:

  • Comply with a legal obligation (e.g., subpoena or court order).
  • Protect and defend the rights or property of Institute for Behavior Change.
  • Prevent or investigate possible wrongdoing in connection with the service.
  • Protect the personal safety of users of the service or the public.
  • Protect against legal liability.

4.5. Aggregated or De-identified Data: We may share aggregated or de-identified information that cannot reasonably be used to identify you.

‍

5. International Data Transfers

‍

Your information, including personal data, may be transferred to — and maintained on — servers located outside of your state, province, country, or other governmental jurisdiction where the data protection laws may differ from those of your jurisdiction.

‍

For transfers of personal data from the European Economic Area (EEA), UK, or Switzerland to countries not deemed to provide an adequate level of data protection by the European Commission or relevant authorities, we implement appropriate safeguards, such as:

  • Standard Contractual Clauses (SCCs): Approved by the European Commission, obliging recipients to protect personal data to the GDPR standards.
  • Binding Corporate Rules (BCRs): For intra-group transfers, where applicable.
  • Data Transfer Agreements: Ensuring equivalent protection as required by local laws (e.g., LGPD).

By providing your personal data, you consent to this transfer, storage, and processing. Where consent is the legal basis for transfer, you have the right to withdraw that consent at any time.

Where required, we conduct Transfer Impact Assessments to evaluate the level of protection in the recipient country and implement supplementary measures if necessary.

‍

6. Data Security and Retention

‍

6.1. Data Security: We employ industry-standard technical and organizational security measures to protect your personal data from unauthorized access, alteration, disclosure, or destruction. These measures include:

‍

  • Encryption: Using SSL/TLS encryption for data in transit (HTTPS).
  • Access Controls: Restricting access to personal data to authorized personnel only.
  • Data Minimization: Collecting only necessary data.
  • Regular Security Audits: Conducting periodic reviews of our security practices.
  • Employee Training: Educating our staff on data protection and security.
  • Pseudonymization/Anonymization: Where feasible and appropriate.

While we strive to use commercially acceptable means to protect your personal data, no method of transmission over the internet or method of electronic storage is 100% secure. Therefore, we cannot guarantee its absolute security.

6.2. Data Retention: We will retain your personal data only for as long as is necessary for the purposes set out in this Policy, unless a longer retention period is required or permitted by law (e.g., for legal, tax, or accounting purposes).

‍

When we no longer need your personal data, we will securely delete or anonymize it in accordance with applicable law.

‍

7. Your Data Protection Rights

‍

Depending on your location and applicable privacy laws, you have various rights regarding your personal data. We are committed to facilitating the exercise of these rights. The rights below apply where the relevant law covers our processing and subject to its conditions and exceptions.

‍

7.1. General Rights (Applicable Broadly, e.g., GDPR, CCPA, LGPD, PIPEDA, APPI, APPs):

‍

  • Right to Be Informed: You have the right to know what personal data we collect, why we collect it, and how we use it. This Policy serves to fulfill this right.
  • Right of Access: You have the right to request a copy of the personal data we hold about you.
  • Right to Rectification (Correction): You have the right to request that we correct any inaccurate or incomplete personal data we hold about you.
  • Right to Erasure (Deletion / “Right to Be Forgotten”): You have the right to request the deletion of your personal data under certain circumstances (e.g., if the data is no longer necessary for the purposes for which it was collected).
  • Right to Restrict Processing: You have the right to request that we restrict the processing of your personal data under certain conditions (e.g., if you contest the accuracy of the data).
  • Right to Data Portability: You have the right to receive your personal data in a structured, commonly used, and machine-readable format and to transmit that data to another controller, where technically feasible.
  • Right to Object: You have the right to object to the processing of your personal data based on legitimate interests or for direct marketing purposes.
  • Rights in Relation to Automated Decision-Making and Profiling: You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you, unless certain exceptions apply.
  • Right to Withdraw Consent: Where we rely on your consent to process your personal data, you have the right to withdraw that consent at any time. This will not affect the lawfulness of processing based on consent before its withdrawal.

7.2. Specific Rights by Region:

For Oregon Residents (Oregon Consumer Privacy Act):

‍

Where the Act applies, you may request confirmation of processing, access, correction, deletion, a copy of your personal data, and a list of specific third-party recipients. You may also opt out of covered sales, targeted advertising, or profiling. Contact us through Section 7.3 to make a request or appeal a denial.

  • For California Residents (CCPA/CPRA):
    • Right to Know: You have the right to request that we disclose the categories and specific pieces of personal information we have collected, the categories of sources from which personal information is collected, the business or commercial purpose for collecting, selling, or sharing personal information, and the categories of third parties to whom we disclose personal information.
    • Right to Opt-Out of Sale or Sharing: You have the right to opt-out of the “sale” or “sharing” of your personal information (as defined by CCPA/CPRA) for cross-context behavioral advertising. To exercise this right, contact us at info@instituteforbehaviorchange.org.
    • Right to Limit Use and Disclosure of Sensitive Personal Information: You have the right to limit the use and disclosure of your sensitive personal information (as defined by CCPA/CPRA) to only that which is necessary to perform the services or provide the goods reasonably expected by an average consumer who requests those goods or services. To make a request, contact us at info@instituteforbehaviorchange.org.
    • Right to Non-Discrimination: We will not discriminate against you for exercising any of your CCPA/CPRA rights.
    • Right to Correct Inaccurate Personal Information.
  • For Brazilian Residents (LGPD):
    • Similar rights to GDPR, including confirmation of processing, access, correction, anonymization/blocking/deletion, portability, deletion of data processed with consent, information about shared data, information about possibility of denying consent and consequences, and revocation of consent.
  • For Canadian Residents (PIPEDA):
    • Similar rights to access, correction, and challenging compliance. Emphasis on accountability, identifying purposes, consent, limiting collection, limiting use/disclosure/retention, accuracy, safeguards, openness, individual access, and recourse.
  • For Japanese Residents (APPI):
    • Similar rights to disclosure, correction, cessation of use, and deletion of personal information. Requirements for appropriate security measures and supervision of service providers.
  • For Australian Residents (APPs):
    • Similar rights to access and correction. Specific principles regarding collection, use, disclosure, data quality, data security, and direct marketing.
  • For EU/UK Residents:

7.3. How to Exercise Your Rights: To exercise any of these rights, please contact us at info@instituteforbehaviorchange.org.

We will respond to your request within the timeframes required by applicable law (e.g., one month under GDPR, 45 days for CCPA access, correction, or deletion requests). Different deadlines may apply to other requests. We may need to verify your identity before fulfilling your request. You may exercise your rights free of charge, except where applicable law permits a fee.

‍

‍4.4. With Your Consent: We may disclose your personal data for any other purpose with your explicit consent.

‍

If your request is denied and an appeal right applies, email info@instituteforbehaviorchange.org with the subject “Privacy Appeal” and explain why you believe the decision should be reconsidered. We respond within the applicable legal timeframe and provide information about the appropriate complaint process if the appeal is denied.

‍

8. Children’s Privacy

‍

Our service is not intended for individuals under the age of 13. We do not knowingly collect personally identifiable information from children without verifiable parental consent.

‍

If you are a parent or guardian and you are aware that your child has provided us with personal data, please contact us. If we become aware that we have collected personal data from children without verification of parental consent, we take steps to remove that information from our servers.

‍

9. Links to Other Websites

‍

Our services may contain links to other websites that are not operated by us. If you click on a third-party link, you will be directed to that third party’s site. We strongly advise you to review the privacy policy of every site you visit.

‍

We have no control over and assume no responsibility for the content, privacy policies, or practices of any third-party sites or services.

‍

10. Changes to This Privacy Policy

‍

We may update this Policy from time to time. We will notify you of any changes by posting the new Policy on this page and updating the “Last Updated” date at the top of this Policy.

‍

We will also inform you via email and/or a prominent notice on our website of material changes when required by applicable law, and update the “Effective Date.”

‍

You are advised to review this Policy periodically for any changes. Changes to this Policy are effective on the “Effective Date” shown above.

‍

11. Complaints and Supervisory Authorities

‍

If you have concerns about our privacy practices, please contact us directly using the details provided in Section 1 above.

‍

Where applicable law provides this right, you may also lodge a complaint with the relevant data protection supervisory authority in your jurisdiction:

‍