Privacy Notice
Effective August 25, 2026. Last updated August 25, 2026.
1. Who we are and what this covers
Top ABA Therapy is an independent directory of ABA therapy provider locations, operated from the United States. This notice covers the public directory, the resources and careers sections, the contact and correction routes, accounts, and the provider claim workflow. It is the operative privacy notice for this site, not a summary of one held elsewhere.
Reading this directory does not require you to tell us anything about a diagnosis, a treatment history, or an insurance member identifier, and the interface is built so that it never asks. We are not a healthcare provider, we do not deliver care, and nothing you send us is a medical record.
2. Information we collect
2.1 Information you give us
Only what the task you chose requires, and only when you choose it:
- Contact requests: your name, an email address, and whatever you write in the message.
- Corrections: the fact you are challenging and, ideally, a public source we can check.
- Accounts: an email address, a password we never see in plain text, and sign-in events.
- Provider claims: your name, your role at the organisation, a work email address, and the evidence you offer that you are authorised to act for that organisation.
There are no forms and no sign-in on this site at the moment, so each of these reaches us by email and carries only what you choose to put in the message.
2.2 Information collected automatically
Standard web-server logs (IP address, browser and device type, referring page, time of request) and aggregate analytics. Analytics is measured in aggregate; we do not build a profile of an individual visitor and we keep no visitor-level copy of analytics data.
2.3 Information we do not ask for
A diagnosis, a treatment history, clinical notes, or an insurance member identifier. Search and browse work without any of them, and sensitive intent is kept out of public URLs by design. If you send clinical detail in a general contact message we will not add it to any record, and we will ask you to send it directly to the provider instead.
3. How we use information
- To answer the request you actually made, and route it to the workflow built to handle it.
- To send only the communications you asked for, each with its own consent and its own unsubscribe.
- To operate and secure the service: rate limiting, integrity checks, backups, incident response, and minimised audit events with opaque identifiers.
- To improve the directory in aggregate: which searches return nothing is the single most useful signal we have, and it needs no personal data to read.
We do not use your information to decide where a provider appears in unlabelled results, and we never will. The ordering rules are published and they do not have a price.
4. Cookies and analytics
This site uses Google Analytics 4, loaded through Google Tag Manager, to measure traffic in aggregate. It sets the cookies below.
| Cookie | Set by | Purpose | Lifetime |
|---|---|---|---|
| _ga | Google Analytics 4 | Distinguishes one browser from another | 2 years |
| _ga_* | Google Analytics 4 | Keeps session state for the property | 2 years |
| wordpress_logged_in_* | WordPress | Keeps you signed in to an account | Session |
| wp-settings-* | WordPress | Remembers interface preferences for a signed-in account | 1 year |
Analytics data is retained inside Google Analytics under its own retention setting and is subject to Google’s terms. Google may process a truncated IP address as part of that service. We hold no visitor-level copy of it.
You can refuse analytics cookies in your browser settings, or install the Google Analytics opt-out browser add-on. The directory works normally either way. Nothing on this site is gated behind accepting analytics. The WordPress cookies are set only if you sign in to an account.
5. When information is shared
We do not sell personal information, we do not rent it, and we do not share it for cross-context behavioural advertising. There is no arrangement under which a payment moves your information anywhere.
Information reaches a third party in four circumstances only:
- Service providers who run the infrastructure: our web host, Google (Analytics and Tag Manager), and Google Workspace mail. Each processes information on our instructions and for no purpose of its own.
- A provider organisation, when you deliberately send an inquiry to that organisation. Nothing reaches a provider you did not contact.
- Where the law requires it, or to establish or defend a legal claim.
- A successor entity, if the directory is ever transferred – under this notice, with notice to you before anything changes.
6. How long we keep information
| Record | Kept for |
|---|---|
| Email you send us | While the conversation is useful, then deleted by hand. Nothing prunes it automatically |
| Correction submissions | As long as the corrected fact is published, so its provenance survives |
| Provider claim requests | Kept while the claim is open, then deleted when it is resolved |
| Accounts | Until you close the account, then deleted within 30 days |
| Server logs | 90 days |
| Aggregate analytics | Inside Google Analytics, under its retention setting; no copy here |
Email is currently the only way to reach us, so the first row governs almost everything we hold. The rows beneath it cover the correction, claim, and account routes, which are not open yet.
Where a record has to survive longer to meet a legal obligation, only the part carrying that obligation is kept, and it is kept out of any workflow that would otherwise use it.
7. How information is protected
Transport is encrypted. Private records are scoped to the owner and to a role, and an identity check happens before any private record changes. Passwords are stored hashed and are not recoverable by us or by anyone answering support.
Support replies never reveal whether an account exists. That is deliberate: it protects the person asking, and it is the reason a recovery request always produces the same answer.
No system is perfectly secure. If a breach affects your information we will notify you and any regulator entitled to notice, without undue delay and within the deadline the applicable law sets.
8. Your choices and rights
8.1 Everyone
- Decline optional sharing without losing access to anything public.
- Unsubscribe from any communication, in one step, without affecting the others.
- Ask what we hold, ask for a copy, ask for a correction, or ask us to delete it.
8.2 California residents (CCPA/CPRA)
You have the right to know the categories and specific pieces of personal information collected, the sources, the purpose, and the categories of third party it reaches; to delete it; to correct it; to opt out of sale or sharing; and to limit the use of sensitive personal information.
We do not sell or share personal information as those terms are defined, and we do not collect sensitive personal information, so the opt-out and limit rights have nothing to act on here. We will not discriminate against you for exercising any right.
8.3 EEA and UK residents (GDPR and UK GDPR)
You have the right of access, rectification, erasure, restriction, portability, and objection, and the right to withdraw consent at any time without affecting processing already carried out. You may also complain to your supervisory authority.
Our lawful bases: consent for analytics cookies; performance of a contract for accounts and claimed listings; and legitimate interests for operating and securing the directory and for answering the message you sent us. Where we rely on legitimate interests you may object, and we will stop unless we can show compelling grounds that override your rights.
This site is operated from the United States, so information you send reaches the United States. Where that transfer needs a safeguard we rely on the European Commission’s Standard Contractual Clauses and the UK Addendum with the processors named in section 5.
8.4 How to make a request
Write to topabatherapy@gmail.com and say what you want. We verify identity in proportion to the sensitivity of the request, usually by replying to the address already on the record, and we answer within 30 days, or tell you within 30 days why we need longer. An authorised agent may act for you with written authority. There is no charge.
9. Children’s privacy
This site is written for adults researching care. We do not knowingly collect personal information from anyone under 13, and there is no part of the directory that asks a child for anything.
That matters more here than on most sites, because the people using this directory are often parents of autistic children. So, plainly:
- We never ask you for a child’s name, age, diagnosis, or clinical history, and no form on this site has a field for any of them.
- Information you supply about your child remains yours to control. You can ask us what we hold, and ask us to delete it, at any time, and we will not ask you to justify the request.
- If we discover that a child under 13 has given us personal information, we delete it and any account created with it, and we do not retain a copy.
- A parent or guardian can reach us at topabatherapy@gmail.com to review, correct, or delete anything relating to their child.
10. Providers and claimed listings
A listing describes an organisation, not a person, and is compiled from public records. Claiming a listing is different: it creates an account for a named individual, so we process your name, your role, a work email address, and the evidence of your authority to act for the organisation. We keep it while the claim is active and for as long as it evidences who was entitled to change what.
Claiming does not change where an organisation appears in unlabelled results, and nothing about a claim is used to make that decision. Where a paid placement exists it is labelled as paid wherever it appears.
If you believe a listing publishes something about you personally that should not be there, use the correction route and say so. That request is handled as a privacy request, not as an editorial one.
11. Changes to this notice
Material changes get a new effective date and are announced on this page before they take effect. Superseded versions are retained so you can see what applied when. We will not apply a materially different purpose to information already collected without asking you first.
12. How to contact us
Write to topabatherapy@gmail.com for anything in this notice: a question, a correction, a request to see what we hold, or a request to remove something you sent us. It is a monitored address and it reaches a person.
If you are reporting something urgent about your own safety or someone else’s, this is the wrong channel and we cannot help quickly enough. Contact emergency services or a crisis line directly.