Shoreline Recovery Center, LLC
Effective date: November 4, 2026
Last updated: November 4, 2026
This document explains how Shoreline Recovery Center, LLC (“Shoreline,” “we,” “us,” or “our”) handles health information and information collected through shorelinerecoverycenter.com and related admissions inquiries. Part I is our combined HIPAA Notice of Privacy Practices and 42 CFR Part 2 patient notice. Part II describes website privacy, tracking technologies, and applicable California privacy choices.
Privacy Officer
Shoreline Recovery Center, LLC
privacy@shorelinerecoverycenter.com
(866) 821-4766
183 Calle Magdalena, Suite 101, Encinitas, CA 92024
Notice of Privacy Practices of Shoreline Recovery Center, LLC
THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW THIS NOTICE CAREFULLY.
THIS NOTICE DESCRIBES:
• HOW HEALTH INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED
• YOUR RIGHTS WITH RESPECT TO YOUR HEALTH INFORMATION
• HOW TO FILE A COMPLAINT CONCERNING A VIOLATION OF THE PRIVACY OR SECURITY OF YOUR HEALTH INFORMATION, OR OF YOUR RIGHTS CONCERNING YOUR INFORMATION
YOU HAVE A RIGHT TO A COPY OF THIS NOTICE (IN PAPER OR ELECTRONIC FORM) AND TO DISCUSS IT WITH OUR PRIVACY OFFICER AT (866) 821-4766 OR privacy@shorelinerecoverycenter.com IF YOU HAVE ANY QUESTIONS.
This notice applies to Shoreline’s programs and workforce. Protected health information, or PHI, is identifiable information about your health, health care, or payment for care. It can include admissions inquiries and information collected before treatment begins. Substance use disorder records protected by 42 CFR Part 2 receive additional protection, including protection of the fact that you applied for or received services from a Part 2 program.
We follow HIPAA, Part 2, and applicable California confidentiality laws. When more than one law applies, we follow the requirements that provide the applicable additional protection. A permission under HIPAA does not override a stricter Part 2 or California restriction.
Contact our Privacy Officer to exercise these rights, obtain request instructions, or discuss this notice. We may require a written request and verify your identity or authority where appropriate. We respond within the deadlines required by applicable law.
Access your records. You may inspect and obtain copies of medical, billing, and other records used to make decisions about you, subject to limited legal exceptions. You may request paper copies or an electronic copy in the format requested if readily producible, or another agreed readable electronic format. Any fee must comply with applicable law and be reasonable and cost based where required. If access is denied, we provide a written explanation and information about any available review rights.
Request a correction. You may ask us in writing to amend information you believe is inaccurate or incomplete and explain why. If we deny your request, we explain the reason in writing and how to submit a statement of disagreement. We do not erase accurate treatment information simply because you disagree with it.
Request confidential communications. You may ask us to contact you by a particular method or at a different location. We accommodate reasonable requests and do not require an explanation of why you are requesting confidential communications.
Request limits on use or disclosure. You may request restrictions on treatment, payment, and health care operations disclosures, including disclosures otherwise covered by a Part 2 consent. We generally do not have to accept a requested restriction. We must accept a request not to disclose information to your health plan for payment or health care operations when the information relates solely to an item or service paid out of pocket in full and disclosure is not required by law. An agreed restriction may have a limited emergency-treatment exception.
Request an accounting of disclosures. You may request an accounting of disclosures covered by HIPAA for up to the preceding six years. This generally excludes disclosures for treatment, payment, and health care operations, disclosures to you, and disclosures you authorized. One accounting in a 12-month period is free; we explain any permitted fee for additional requests in advance. Part 2 provides additional accounting rights for certain disclosures, including electronic-record disclosures for the preceding three years, when the applicable federal compliance requirements take effect. We will honor those rights as required by law.
Request an intermediary disclosure list. If you authorize a Part 2 intermediary, such as a health information network, to disclose records using a general designation, you may request in writing a list from that intermediary identifying recipients during the preceding three years. Contact our Privacy Officer for assistance identifying the intermediary.
Choose a representative. A person legally authorized to act for you may exercise your rights within the scope of that authority. We verify the authority and apply any legal exceptions before providing access or accepting decisions on your behalf.
Receive this notice and raise concerns. You may obtain a paper or electronic copy, ask questions, and file a complaint without retaliation. Complaint instructions appear below.
For health information not subject to additional consent restrictions, HIPAA generally permits us to use and disclose information for treatment, payment, and health care operations without a separate HIPAA authorization. We obtain consent or authorization when Part 2 or California law requires it.
Treatment. We use information to assess your needs, develop treatment plans, coordinate services, and communicate with providers involved in your care. For example, with any required consent, we may provide a treating clinician with information about your medications to avoid harmful interactions.
Payment. We use information to verify benefits, obtain authorization for services, submit claims, and resolve payment issues. For example, with any required consent, we may send your insurer information needed to process a claim.
Health care operations. We use information for quality improvement, staff training, compliance, accreditation, audits, and administration. For example, authorized staff may review records to evaluate treatment quality. We limit access and disclosures as required by law.
For Part 2 records, we obtain your written consent for most uses and disclosures outside the exceptions described below. You may give a single consent for all future treatment, payment, and health care operations uses and disclosures. You may instead authorize a more limited disclosure, such as a discharge summary sent to a named provider. Any criminal justice referral or other special-purpose consent must satisfy the requirements applicable to that consent.
When Part 2 records are disclosed with your treatment, payment, and health care operations consent to another Part 2 program, HIPAA covered entity, or business associate, further disclosures may be permitted under the rules applicable to that recipient, including HIPAA where applicable. Some information may no longer receive the same Part 2 protections after a permitted redisclosure. The restrictions on using records in proceedings against you continue to apply.
You may revoke a consent or authorization in writing by contacting the Privacy Officer, except to the extent a person has already acted in reliance on it and subject to any special legal rules governing criminal justice referral consents. Revocation does not undo a prior lawful disclosure. We explain any effect of declining or revoking a requested consent on payment arrangements or services.
Receiving this notice, acknowledging receipt, submitting a website inquiry, or selecting cookie preferences does not by itself provide a HIPAA authorization or Part 2 consent.
The following are limited circumstances in which information may be used or disclosed without your written authorization or consent. We apply the legal requirements and limits for each circumstance. For Part 2 records, only a Part 2 exception or other valid Part 2 permission allows disclosure; a general HIPAA exception is insufficient.
Within our program and to qualified service organizations. Personnel may communicate information needed for their duties within the program or the entity with direct administrative control. Qualified service organizations may receive information needed to provide contracted services under the required agreements. Business associates receive PHI only as permitted by law and required contracts. These arrangements do not authorize vendors to use protected information for their own advertising.
Medical emergencies. We may disclose necessary Part 2 information to medical personnel to address a bona fide medical emergency when prior consent cannot be obtained, including other emergency circumstances specifically permitted by Part 2.
Child abuse or neglect and crimes at the program. We may make legally required reports of suspected child abuse or neglect. The underlying Part 2 records remain protected. We may disclose limited information about a crime or threat of a crime on program premises or against program personnel, as permitted by Part 2.
Research and public health. We may disclose information for research only when the applicable privacy and research safeguards are met. Part 2 records may be disclosed without consent to a public health authority only after de-identification to the standard required by law. Other public health disclosures of non-Part 2 information must satisfy HIPAA and California requirements.
Audits, evaluations, and oversight. Authorized auditors, evaluators, regulators, and oversight bodies may receive information when applicable legal conditions and safeguards are satisfied. Part 2 disclosures remain subject to its restrictions on purpose, recipients, and further use.
Death and cause of death. We may disclose information as permitted for legally authorized cause-of-death inquiries and required vital-statistics reporting. Death does not automatically end confidentiality protections.
Legal requirements and other HIPAA purposes. We provide information to you and to the U.S. Department of Health and Human Services as required by law. For information not subject to Part 2 or stricter California restrictions, HIPAA may also permit appropriately limited disclosures for public health and safety, abuse reporting, organ donation, coroners and funeral directors, workers’ compensation, law enforcement, judicial proceedings, and specified government functions. Each disclosure must meet all applicable legal conditions.
Part 2 records, and testimony describing their contents, may not be used or disclosed in civil, criminal, administrative, or legislative investigations or proceedings against you without your specific written consent or a qualifying Part 2 court order. Consent for this purpose must be separate from consent for other uses.
A subpoena alone does not authorize disclosure of Part 2 records. A qualifying court order authorizing disclosure must be accompanied by a subpoena or similar legal mandate compelling disclosure. We comply with the applicable notice and opportunity-to-be-heard requirements for you or the record holder. Different procedures may apply to proceedings against the program or a record holder, and advance patient notice may not be required in those circumstances.
Most uses and disclosures of separately maintained psychotherapy notes require a specific authorization. Most uses and disclosures of separately maintained SUD counseling notes require a separate Part 2 consent that cannot be combined with consent for other types of records. Limited legal exceptions apply. We do not condition treatment, payment, health plan enrollment, or eligibility for benefits on consent to use or disclose SUD counseling notes.
Marketing uses or disclosures of PHI and disclosures constituting a sale of PHI require your written authorization unless a legal exception applies. Any authorization must disclose required information about payment we receive. Other uses or disclosures not described in this notice require your written authorization or consent as applicable.
We share information with family members, friends, or others involved in your care only with the permission required by the laws protecting the information. For non-Part 2 information, HIPAA may allow limited disclosures with your agreement, an opportunity to object, or professional judgment in appropriate circumstances. Those permissions do not replace a required Part 2 consent.
If we use information for fundraising, you may opt out of fundraising communications without affecting treatment or payment. Before using Part 2 records for fundraising for our program, we provide a clear and conspicuous opportunity to elect not to receive those communications. Contact our Privacy Officer to make or change that choice.
California law may impose additional limits on medical, mental health, HIV-related, and other specially protected information. We obtain any additional authorization required and restrict disclosures to the recipients and purposes allowed by the applicable law.
We are required to protect the privacy of health information, provide this notice, follow the notice currently in effect, and notify affected individuals after a breach of unsecured PHI or Part 2 records as required by law. We maintain safeguards appropriate to the information we handle.
We reserve the right to revise this notice and apply lawful changes to information we already maintain and information received later. The revised notice will state its effective date and be available on our website, at our service locations, and upon request. We provide and post revised notices as required. A material change does not take effect before the effective date stated in the revised notice unless law requires otherwise.
You may file a complaint with our Privacy Officer by telephone, email, or mail using the contact information at the beginning of this document. Describe your concern and how we can contact you. You may also complain directly to the appropriate agency without first complaining to Shoreline. We will not retaliate against you.
For HIPAA or Part 2 privacy complaints, contact the U.S. Department of Health and Human Services, Office for Civil Rights, at 1-800-368-1019 or write to 200 Independence Avenue, S.W., Washington, DC 20201.
HHS complaint instructions: https://www.hhs.gov/hipaa/filing-a-complaint/index.html
For concerns about a DHCS-regulated substance use disorder program, contact the California Department of Health Care Services at (877) 685-8333 or sudcomplaints@dhcs.ca.gov.
DHCS complaint information: https://www.dhcs.ca.gov/individuals/licensing-and-certification-complaints/
For patient safety or quality concerns, you may contact The Joint Commission at 1-800-994-6610 or write to Office of Quality and Patient Safety, The Joint Commission, One Renaissance Boulevard, Oakbrook Terrace, IL 60181. The Joint Commission does not accept faxed or emailed complaint submissions.
Joint Commission complaint information: https://www.jointcommission.org/en-us/contact-us/report-a-patient-safety-event
This part describes information collected when you visit our website, submit an inquiry, or call a website or advertising tracking number. Information that qualifies as PHI, Part 2 records, or protected California medical information remains subject to Part I and applicable health privacy law, regardless of how it is collected.
We collect information directly from you or a person contacting us on your behalf; automatically through website and tracking technologies; and through service providers that handle forms, calls, analytics, and advertising attribution. Depending on your interaction, this includes the following categories. The table describes collection and business-purpose disclosures through our website and inquiries during the 12 months preceding the last-updated date.
| Category | Examples and purposes | Categories of recipients |
|---|---|---|
| Identifiers and contact information | Name, email address, telephone number, IP address, browser or device identifiers, and advertising click identifiers. Used to respond, route inquiries, secure the website, and attribute permitted website activity. | Hosting and support providers; Rushax for forms; CallRail for calls. Google Analytics and Google Ads receive permitted online identifiers and events, subject to the restrictions below. |
| Inquiry and customer record information | Contact details, the information you submit in a form or provide by telephone, and the service you request. Used to answer questions, coordinate admissions, and maintain inquiry records. | Personnel and service providers supporting inquiries and admissions; Rushax and CallRail according to their functions. Protected inquiry content is subject to health privacy restrictions. |
| Internet activity and attribution data | Pages visited, landing page, referral source, visit/session identifiers, dates, interactions, and whether an inquiry or call occurred. Used for website performance and permitted attribution. | Hosting and technical providers; Rushax; CallRail; Google Analytics; and Google Ads for permitted conversion measurement. |
| Approximate location | General location inferred from an IP address. Used to understand website traffic and protect the website. This is distinct from precise device location. | Technical, analytics, and attribution providers that process the underlying IP address. |
| Sensitive health information | Health, treatment, or substance use information you choose to provide in an inquiry. Used to assess and respond to your request and coordinate care as permitted by law. | Authorized personnel and legally permitted service providers or care recipients. Cookie choices do not authorize disclosure of this information to advertising platforms. |
We also use information to maintain security, prevent fraud, comply with legal duties, and respond to privacy requests. We do not require you to provide detailed treatment information in a general website form. Please contact admissions for an appropriate method of providing sensitive records.
Rushax. Processes website form inquiries and attribution information, including details entered in forms, referral or campaign information, a landing page, a session identifier, and pages viewed during a visit. Form information may identify a person seeking care and must be handled under the health privacy protections that apply to it.
CallRail. Supports telephone call tracking and attribution. Information includes the caller’s telephone number, time and duration of the call, the tracking number called, and associated referral or website-visit information. Tracking metadata is separate from the substance of a call. If a call is recorded or transcribed, we provide required notice and obtain any consent required before recording or transcription; accepting website cookies is not that consent.
Google Analytics. Measures visitor behavior and website use, including permitted online identifiers, pages or events, and referral information. Our permitted use excludes sending PHI, Part 2 records, form content, call content, or direct contact details to Google Analytics.
Google Ads. Receives conversion information, such as an advertising click identifier and an event indicating that a call or form inquiry occurred, for advertising measurement. The content of forms and calls is outside the permitted conversion data. An identifier or conversion event can still be personal information and, depending on context, protected health information. We do not treat removing a name or omitting message content as sufficient to make a disclosure lawful.
We permit tracking and conversion disclosures only when allowed by all applicable privacy laws. PHI and Part 2 records must not be sent to advertising platforms through these tools without the specific legal permission required. Service providers handling protected information on our behalf must have the required privacy agreements and safeguards. A vendor’s inclusion here does not authorize it to use health information for its own advertising purposes.
Cookies and similar technologies store identifiers or preferences in your browser. Session storage generally lasts for the current tab or session. The following technologies support our website; their duration can be shortened by your choices, browser settings, or deletion.
| Name | Provider and purpose | Configured duration |
|---|---|---|
| _ga | Google Analytics; distinguishes visitors for usage measurement. | Up to 2 years |
| _ga_<ID> | Google Analytics; maintains analytics session information. | Up to 2 years |
| _rx_attr | Rushax; stores referral source, landing page, and a random session identifier. | Up to 30 days |
| _rx_journey | Rushax; records pages viewed using browser session storage. | Until the tab/session closes |
| calltrk_landing | CallRail; records the first page visited. | Up to 1 year |
| calltrk_referrer | CallRail; records the referring website or search engine. | Up to 1 year |
| calltrk_session_id | CallRail; associates a telephone call with a website visit. | Up to 1 year |
Our consent-management service also stores preferences needed to remember your choices. Necessary security, website-operation, and preference-storage functions may remain active when optional tracking is declined. A cookie’s lifespan is separate from the period a provider retains information already received.
Use the website’s cookie banner or persistent Cookie Preferences control to decline optional analytics and advertising tracking or change a previous choice. The site uses WP Consent to manage these choices. You may also request an opt-out through our Privacy Officer. Declining optional tracking does not prevent you from contacting us for services.
You may opt out of disclosures that constitute a sale or sharing of personal information for cross-context behavioral advertising through the Do Not Sell or Share My Personal Information control or by contacting us. We honor a Global Privacy Control signal as a request to opt out of sale or sharing for the browser or device sending it, and for an associated consumer where required by law. Cookie and device choices may need to be repeated on another browser or device or after clearing preferences.
You may use browser controls to delete or block cookies. Browser cookie blocking alone may not stop other methods of transmission. We do not treat a general Do Not Track signal as a substitute for the privacy controls described here; we process legally recognized opt-out preference signals such as Global Privacy Control.
An opt-out stops the covered future processing or disclosures. It does not automatically delete information already lawfully collected, stop necessary security or requested communications, or revoke a separate health-information consent. Contact the Privacy Officer for deletion requests or health-information choices.
For business purposes, we disclose the categories identified above to providers supporting website hosting, maintenance, security, communications, form handling, call handling, analytics, and advertising attribution, as relevant to their services. We may also disclose information to professional advisers, legally authorized recipients, or in a business transaction, subject to applicable confidentiality and health privacy requirements.
For the preceding 12 months, the categories disclosed to Google Ads for advertising measurement are online identifiers and internet activity, including advertising click identifiers and call or form conversion events. We treat these disclosures as sale or sharing for purposes of offering and honoring your opt-out, even when no money is paid for the information. Health information is subject to the additional restrictions in Part I and above; a California advertising opt-out or cookie acceptance cannot replace those protections.
We do not knowingly sell or share the personal information of consumers under 16. We do not use sensitive health information for cross-context behavioral advertising. We limit sensitive information to responding to requested services, providing or arranging care, maintaining security, and other purposes allowed by applicable law.
For personal information and processing subject to the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA), California residents may exercise the following rights, subject to legal conditions and exceptions:
Know and access. Request the categories and specific pieces of personal information collected about you, its sources and purposes, the categories of recipients, and information about sale, sharing, and business-purpose disclosures. You may request a portable copy where required.
Delete and correct. Request deletion of personal information or correction of inaccurate information. We may retain information for a permitted reason, such as legal record-retention duties, security, or completing requested services, and will explain any applicable denial.
Opt out and limit. Opt out of sale or sharing, including through a recognized opt-out preference signal, and request limits on sensitive personal information where the statutory right applies.
Exercise rights without discrimination. We do not deny services or otherwise discriminate against you for exercising privacy rights protected by law.
Submit requests to privacy@shorelinerecoverycenter.com or call (866) 821-4766. No account is required. We may verify identity for access, deletion, or correction, using information reasonably necessary for the request. We do not require identity verification for an opt-out of sale or sharing or a request to limit sensitive information, although we may need enough information to apply the choice. An authorized agent may submit a request; we may require proof of authority and direct confirmation when allowed by law.
For covered requests to know, delete, or correct, we acknowledge receipt within 10 business days and generally respond within 45 calendar days. If legally permitted additional time is needed, we notify you within the initial response period and explain the reason. We process covered sale-and-sharing opt-outs and requests to limit sensitive information as soon as feasible and within 15 business days. You can contact us to confirm the status of a request.
Medical information and PHI covered by applicable health privacy exemptions are generally governed by Part I rather than CCPA rights. For example, a CCPA deletion request does not require destruction of a clinical record we must retain. Other website or business information may still be covered by the CCPA when its applicability requirements are met.
We retain contact and inquiry information for the time needed to answer and document the inquiry, coordinate requested services, and satisfy legal obligations. Website activity, advertising identifiers, and analytics information are retained only for the period reasonably necessary for the disclosed measurement, security, or attribution purpose. Health records follow the retention duties applicable to those records. Privacy-request records and preference choices are retained as needed to document and honor requests and meet legal requirements. Legal holds or dispute-resolution needs may require longer retention.
We use reasonable administrative, technical, and physical safeguards appropriate to the information. No system or internet transmission is completely secure. Ordinary email and general website forms may present privacy risks; ask us for an appropriate method before sending detailed clinical information. Contact the Privacy Officer if you need a confidential method of communication or an accessible copy of this policy.
Our website may link to third-party websites. Their information practices are governed by their own notices. Our general website is intended for adults and is not directed to children under 13. If you believe a child has submitted personal information through the website, contact the Privacy Officer.
We update this policy when our practices or legal requirements change and at least as often as required by applicable law. The current version displays its effective and last-updated dates. We provide any additional notice or obtain consent required before a new use of information. Continued website use does not substitute for a required health-information authorization, Part 2 consent, or legally required privacy choice.
For website privacy questions, California privacy requests, tracking choices, or health-information concerns, contact the Privacy Officer at privacy@shorelinerecoverycenter.com or (866) 821-4766, or write to Shoreline Recovery Center, LLC, 183 Calle Magdalena, Suite 101, Encinitas, CA 92024.
