Notice of Privacy Practices

Updated: July 20, 2026

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

(The paragraph above is required by federal law to appear exactly as written. The rest of this notice is in plain language, because we believe you should never need a lawyer to understand how we treat your family’s information.)

Who we are

Yoli is a 501(c)(3) nonprofit providing neurodiversity-affirming, play-based ABA therapy at 1057 Solano Ave, Ste 104, Albany, CA 94706. “Health information” in this notice means information that identifies your child (or you) and relates to their health, the care we provide, or payment for that care — everything from intake answers to session data to billing records. This notice applies to all such information we create or receive, in any form.

Our promises

The law (HIPAA, and in California, the Confidentiality of Medical Information Act) requires us to keep your health information private and secure, to give you this notice, and to follow what it says. Beyond the law, these are our commitments:

We collect only what we need to care for your child well.
We will never sell your health information.
We will never use it for marketing or fundraising without your written permission.
If a breach ever compromises your information, we will tell you promptly.

For treatment. The team working with your child — therapists, supervisors, our BCBA — shares information with each other to deliver and coordinate care. With your written authorization on file, we also coordinate with other professionals involved in your child’s care, such as a pediatrician, speech-language pathologist, occupational therapist, or teacher.

For payment. We share what’s necessary to bill and get paid — with your insurance plan, the Regional Center of the East Bay, or other funding sources. For example, a claim may include your child’s diagnosis and the services provided. (Our Financial Responsibility Agreement describes this too.)

To run our practice. We use information for supervision, quality review, staff training, and program evaluation — the work that keeps our care excellent. Where possible we use de-identified information for these purposes.

When the law requires or permits it, without your authorization. This is the honest list, and it’s short:

Mandated reporting: our staff are legally required to report reasonable suspicions of child abuse or neglect (see the Mandated Reporters section of our intake package).
Serious threats to health or safety, to prevent harm to your child or others.
Health oversight: audits, inspections, and licensure reviews by agencies that oversee healthcare and Regional Center services.
Legal process: court orders, or subpoenas with required protections.
Public health activities, as required (rare in our practice).

Everything else requires your written permission — and you can revoke that permission at any time, in writing, going forward. Because your child’s records may include Regional Center–related information, California’s Lanterman Act gives them additional confidentiality protections on top of HIPAA.

People involved in your child’s care. With your verbal okay (or when you’re present and don’t object), we can share relevant information with a family member or caregiver you’ve involved in your child’s care. Tell us at any time if there’s someone we should — or should not — talk to.

Your rights

You have the right to:

See and get a copy of your child’s records. Ask us in writing; we’ll provide them within 30 days and may charge only a reasonable, cost-based fee for copies.
Ask us to correct records you believe are wrong or incomplete. If we disagree, we’ll explain why in writing, and your written statement of disagreement joins the record.
Get a list of disclosures we’ve made of your child’s information for the past six years (other than for treatment, payment, operations, and disclosures you authorized).
Ask us to limit what we use or share. We’ll consider every request seriously; we aren’t required to agree unless the request concerns disclosure to your health plan for a service you paid for entirely out of pocket — those we must honor.
Ask us to contact you a specific way — for example, only at a particular phone number or email. We’ll accommodate all reasonable requests, no questions asked.
Get a paper copy of this notice any time, even if you accepted it electronically. It’s also posted at our office and at yoli.care.
Choose someone to act for you — a legal guardian or someone with medical power of attorney can exercise these rights on your child’s behalf.
File a complaint if you believe we’ve violated these rights — with us directly (contact below), and/or with the U.S. Department of Health and Human Services, Office for Civil Rights: 200 Independence Ave SW, Washington, DC 20201; 1-877-696-6775; hhs.gov/ocr/privacy/hipaa/complaints. We will never retaliate against you for filing a complaint. Ever. Raising concerns — with us or with regulators — will not affect your child’s care or your family’s standing with Yoli in any way.

Changes to this notice

We can change this notice, and changes apply to information we already hold. If we make a material change, we’ll post the new version at our office and on our website, and have copies available. The effective date is always at the top.

Questions, requests, and complaints

Our Privacy Officer: Laura Kliger-Enkin, Clinical & Executive Director

Phone/text: (510) 679-2782
Email: hello@yoli.care
Mail: Yoli — Privacy Officer, 1057 Solano Ave, Ste 104, Albany, CA 94706

A note for the intake package: your signature on the Statement of Understanding includes an acknowledgment that you received this notice. Signing acknowledges receipt only — it doesn’t waive any of the rights described here.