BRILLIANT BABIES

WEBSITE PRIVACY POLICY

Effective Date: March 30, 2026

Last Updated: [April 7, 2026]

1. Introduction

Adriana Rusch, d/b/a Brilliant Babies (“we,” “us,” or “our”) operates an occupational therapy practice located in California. We are committed to protecting your privacy and the security of your personal information. This Website Privacy Policy (“Policy”) describes how we collect, use, disclose, and protect information when you visit our website at www.brilliantbabiesot.com (the “Site”).

Important: This Policy applies only to information collected through the Site. It does not apply to information collected during the course of the therapist-patient relationship, which is governed by our HIPAA Notice of Privacy Practices. If you are a patient, please review our Notice of Privacy Practices for information about how we use and protect your protected health information (“PHI”).

2. Information We Collect

We collect information from and about users of the Site in several ways:

2.1 Information You Provide Directly

When you interact with the Site, you may voluntarily provide us with personal information, including through:

•       Appointment requests: When you use our online booking feature (powered by Jane App), you may provide your name, email address, phone number, and scheduling preferences.

•       Contact and inquiry forms: When you submit a contact form or send us a message through the Site, you provide your name, email address, phone number, and any information you include in your message.

•       Patient intake forms: If you complete intake forms or questionnaires through the Site or through our patient portal, you may provide personal and demographic information, insurance details, and health-related information.

•       Payment information: If you make payments through the Site or our patient portal, your payment card or banking information may be collected and processed by our third-party payment processor. We do not directly store your full payment card information.

Note regarding health information in messages: Our contact and inquiry forms include a free-text message field. Please be aware that information submitted through general website forms may not be transmitted through HIPAA-compliant channels. We strongly recommend that you do not include sensitive health or medical information in website contact forms. Please use our secure patient portal through Jane App or Carepatron for any communications involving health information.

2.2 Information Collected Automatically

When you visit the Site, certain information may be collected automatically, including:

•       Device and browser information: such as your IP address, browser type and version, operating system, device type, and screen resolution.

•       Usage data: such as the pages you visit, the date and time of your visit, the duration of your visit, referring URLs, and clickstream data.

•       Location data: approximate geographic location derived from your IP address.

2.3 Cookies and Tracking Technologies

The Site may use cookies and similar tracking technologies to enhance your experience and collect information about how the Site is used. These may include:

•       Essential cookies: necessary for the Site to function properly (e.g., session management, security).

•       Analytics cookies: used to understand how visitors interact with the Site, including through third-party analytics services such as Google Analytics. These tools may collect information such as your IP address, browsing behavior, and device information.

•       Functional cookies: used to remember your preferences and improve your experience on the Site.

You can manage your cookie preferences through your browser settings. Please note that disabling cookies may affect the functionality of certain features of the Site.

Google Analytics: We may use Google Analytics to help us understand how visitors use the Site. Google Analytics uses cookies to collect information about your use of the Site, which is transmitted to and stored by Google. Google may use this information to evaluate your use of the Site, compile reports on website activity, and provide other services related to website activity and internet usage. For more information on how Google uses data when you use our Site, visit Google’s privacy policy. You may opt out of Google Analytics by installing the Google Analytics Opt-Out Browser Add-on.

3. How We Use Your Information

We use the information we collect for the following purposes:

•       To respond to your inquiries and communicate with you about your requests.

•       To schedule and manage appointments.

•       To process intake forms and prepare for your care.

•       To process payments and send invoices.

•       To operate, maintain, and improve the Site.

•       To analyze Site usage and trends to enhance the user experience.

•       To protect the security and integrity of the Site.

•       To comply with legal obligations, including applicable healthcare regulations.

•       To enforce our Terms of Service and protect our rights and the rights of others.

We do not use personal information collected through the Site for automated decision-making or profiling.

4. How We Share Your Information

We do not sell your personal information. We do not share your personal information with third parties for their own direct marketing purposes.

We may share your information in the following limited circumstances:

•       Service providers: We use third-party service providers to help us operate the Site and deliver services. These include Jane App and/or Carepatron (patient portal and scheduling), website hosting providers, payment processors, and analytics providers (such as Google Analytics). These providers have access to your information only to perform services on our behalf and are obligated to protect it.

•       Legal requirements: We may disclose your information if required to do so by law, regulation, legal process, or governmental request, or if we believe disclosure is necessary to protect our rights, the safety of our patients or the public, or to respond to a legal claim.

•       Business transfers: In the event of a merger, acquisition, reorganization, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any such change in ownership or control of your personal information.

•       With your consent: We may share your information for other purposes with your express consent.

5. Third-Party Services and Links

The Site integrates with or links to third-party services, including:

•       Jane App / Carepatron: Our patient portal, scheduling, and intake form services are provided through HIPAA-compliant third-party platforms. Your use of these platforms is governed by their respective terms of service and privacy policies.

•       Payment processors: If online payment functionality is available, payments may be processed by a third-party payment processor. We do not store your full payment card information on our systems.

We are not responsible for the privacy practices or content of third-party websites or services. We encourage you to review the privacy policies of any third-party services before providing them with your information.

6. Data Security

We take reasonable administrative, technical, and physical measures to protect the personal information we collect through the Site from unauthorized access, use, alteration, and disclosure. These measures include encryption of data in transit (SSL/TLS), access controls, and secure hosting infrastructure.

However, no method of electronic transmission or storage is completely secure. While we strive to protect your personal information, we cannot guarantee its absolute security. You are responsible for maintaining the confidentiality of any account credentials associated with your use of our patient portal.

7. Your California Privacy Rights

If you are a California resident, you have certain rights under CCPA/CPRA. This section describes those rights and how to exercise them.

Note: The CCPA/CPRA does not apply to PHI that is governed by HIPAA or the California Confidentiality of Medical Information Act (“CMIA”). Your rights regarding PHI are described in our HIPAA Notice of Privacy Practices.

7.1 Right to Know

You have the right to request that we disclose the categories and specific pieces of personal information we have collected about you, the categories of sources from which it was collected, the business or commercial purpose for collecting or sharing it, and the categories of third parties with whom we share it.

7.2 Right to Delete

You have the right to request that we delete the personal information we have collected from you, subject to certain exceptions permitted by law (such as information necessary to complete a transaction, comply with a legal obligation, or maintain security).

7.3 Right to Correct

You have the right to request that we correct inaccurate personal information that we maintain about you.

7.4 Right to Opt Out of Sharing

You have the right to opt out of the “sharing” of your personal information for cross-context behavioral advertising. As noted in Section 4.1, our use of analytics tools such as Google Analytics may constitute sharing under the CCPA/CPRA. To opt out:

•       You may submit an opt-out request by contacting us at Adriana@brilliantbabiesot.com

•       You may install the Google Analytics Opt-Out Browser Add-on.

•       You may adjust your browser settings to block or delete third-party cookies.

7.5 Right to Limit Use of Sensitive Personal Information

To the extent we collect sensitive personal information (as defined by the CCPA/CPRA) through the Site, you have the right to limit our use and disclosure of that information to purposes that are necessary to provide the services you request.

7.6 Right to Non-Discrimination

We will not discriminate against you for exercising any of your CCPA/CPRA rights. We will not deny you services, charge you different prices, provide a different level or quality of service, or suggest that you will receive any of these as a result of exercising your rights.

7.7 How to Submit a Request

To exercise any of the rights described above, please contact us using the information provided in Section 12 of this Policy. We will verify your identity before processing your request. You may also designate an authorized agent to submit a request on your behalf, provided the agent has your written authorization and we can verify both identities.

We will respond to verifiable consumer requests within 45 days of receipt. If we need additional time (up to an additional 45 days), we will notify you of the extension and the reason for it.

7.8 Categories of Personal Information Collected

We collect or may collect the following categories of personal information, as defined by the CCPA/CPRA:

•       Identifiers: name, email address, phone number, IP address.

•       Internet or other electronic network activity information: browsing history on the Site, search history on the Site, information regarding your interaction with the Site.

•       Geolocation data: approximate location derived from IP address.

•       Professional or employment-related information: if voluntarily provided in intake forms.

•       Insurance information: if provided through intake forms or patient portal.

8. Other State Privacy Rights

Brilliant Babies primarily serves patients in California. However, if you are a resident of another state that has enacted consumer privacy legislation, you may have similar rights to access, delete, or correct your

personal information, and to opt out of certain data processing activities. Please contact us using the information in Section 12 to exercise any applicable rights under your state’s law.

9. Children’s Privacy

Brilliant Babies provides occupational therapy services to minor patients. We recognize the importance of protecting the privacy of children.

9.1 Information Collected About Minors

We do not knowingly collect personal information directly from children under the age of 13 through the Site. When a parent or legal guardian schedules an appointment, completes intake forms, or otherwise provides information about a minor patient through the Site, the parent or guardian is providing that information on the minor’s behalf.

9.2 Parental Rights

Parents and legal guardians may review, request deletion of, or refuse further collection of their child’s personal information by contacting us at Adriana@brilliantbabiesot.com We will take reasonable steps to verify the identity and authority of any person making such a request.

9.3 California Minors

Under California law, minors who have lawfully consented to their own treatment may have privacy rights with respect to the records of that treatment. If you have questions about a minor’s privacy rights related to treatment records, please contact us directly.

10. Data Retention

We retain personal information collected through the Site for as long as necessary to fulfill the purposes described in this Policy, unless a longer retention period is required or permitted by law. Factors we consider in determining retention periods include the nature and sensitivity of the information, applicable legal and regulatory requirements (including record retention requirements under California law and HIPAA, where applicable), and the purposes for which the information was collected.

When personal information is no longer needed, we will securely delete or de-identify it in accordance with our data retention policies and applicable law.

11. Changes to This Policy

We may update this Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors. When we make material changes to this Policy, we will update the “Last Updated” date at the top of this page and, where appropriate, provide additional notice (such as a prominent notice on the Site or an email notification).

We encourage you to review this Policy periodically to stay informed about how we are protecting your information. Your continued use of the Site after any changes to this Policy constitutes your acceptance of the updated Policy.

12. Contact Information

If you have any questions about this Policy, wish to exercise your privacy rights, or have concerns about our data practices, please contact us at:

Brilliant Babies

31103 Rancho Viejo Road

D3 052

San Juan Capistrano, CA 92675

Email: Adriana@brilliantbabiesot.com

Phone: (949) 424-3448

For questions specifically about your PHI or your rights under HIPAA, please refer to our Notice of Privacy Practices or contact our Privacy Officer using the contact information listed above.