United Way Monterey County Confidentiality Policy
Approved by Board of Directors: 12/10/2009: Revised 04/25/2024
United Way Monterey County (UWMC) recognizes the importance of protecting an individual's privacy. We take all reasonable steps to ensure that an individual's personal information is protected from misuse or unauthorized disclosure.
UWMC subscribes to the Donor Bill of Rights which was developed by the Association for Healthcare Philanthropy (AHP), the Association of Fundraising Professionals (AFP), The Giving Institute, and the Council for Advancement and Support of Education (CASE).
UWMC recognizes that the efficient operation of the organization requires the maintenance and management of extensive donor and prospect records. These records may contain sensitive information that has been shared with or developed by the UWMC’s staff or volunteers on a confidential basis. (“Records” is construed to mean all files, including electronic data, containing information on donors or prospective donors to UWMC.) Donors and prospects may be attracted to UWMC on the basis of its ability to assure temporary or permanent anonymity. Protecting donor confidentiality is an essential part of providing good service to donors.
Additionally, care must be taken to preserve confidentiality of discussions that take place and information that is shared in the course of conducting United Way business.
The purpose of this policy is to codify the position of UWMC on confidentiality.
- Confidentiality of Records: The President and CEO or designee shall be responsible for maintaining the confidentiality of donor and prospect records, as well as fund information. Records will normally be available to staff as needed to fulfill their duties. At the discretion of the President and CEO, staff may make all or part of any record available to UWMC volunteers to assist them in executing their specific responsibilities. UWMC’s auditors, legal counsel and other contractors are authorized to review donor/prospect and fund records as required for the purposes for which they are engaged.
All persons accessing donor/prospect or fund records in the conduct of UWMC business shall maintain the confidentiality of said records. This applies to agency endowment funds as well as to other types of funds. Staff may share information with donors, fund beneficiaries, and grantees pertaining to their own gifts, funds, grants, etc. Except in those instances, any copies of confidential information shall not be held outside UWMC’s office for extended periods, and are to be destroyed based on UWMC's Records Retention Policy.
- Publication of Donor Names: Unless otherwise requested by the donor, the names of all individual donors may be printed in the UWMC's marketing, solicitation, recognitions communications and in other appropriate listings. UWMC will not publish the amount of any donor's gift without the permission of the donor. Unless otherwise specified in the document, donors making gifts to the UWMC by bequest or other testamentary device are deemed to have granted such permission.
- Memorial/Tribute Gifts: The names of donors of memorial or tribute gifts may be released to the honoree, next of kin, or appropriate member of the immediate family, unless otherwise specified by the donor. Gift amounts are not to be released without the express consent of the donor.
- Anonymous Gifts: The President and CEO is authorized to accept anonymous gifts to UWMC, and to handle them appropriately. The name of the donor and size of the gift may be withheld from the Board of Directors at the President and CEO’s discretion, if so requested by the donor. When made known to Board members, they will respect the anonymity of any such gift.
- Giving Categories: If giving categories have been stipulated for a specific fund drive, challenge grant, or project, or as part of UWMC’s ongoing recognition program, then the donors, unless they otherwise specify, are deemed to have given permission for UWMC to publish their names associated with the particular giving category. Similarly, UWMC may publish giving categories associated with donor names in its annual report, unless a donor specifies otherwise.
- No Disclosures to Third Parties: UWMC shall not release to third parties or allow third parties to copy, inspect or otherwise use UWMC records or other information pertaining to the identification of a donor or donor's gifts. No disclosures to third parties of such information, including addresses and demographic information, shall be made without the donor's consent.
- Confidentiality of Organization's Business: Discussions that take place in the context of UWMC’s operations require discretion, including discussions pertaining to grantmaking, personnel issues, development activities, operational fundraising, investment management, etc. The positions or statements of individual board members, advisors, or staff should not be discussed outside of official UWMC meetings and processes. Likewise, the content of UWMC business, including documents or UWMC analysis of documents, should not be discussed or shared outside official meetings and processes.
- Public Disclosure: UWMC will comply with both the letter and spirit of all public disclosure requirements, including the open availability of its Form 990 tax returns. This Confidentiality Policy shall not be construed in any manner to prevent UWMC from disclosing information to taxing authorities or other governmental agencies or courts having regulatory control or jurisdiction over UWMC. However, all staff, volunteers, and contractors must hold strictly confidential all information of a private nature, including, but not limited to, all items explicitly discussed in this policy.
Consequences of Policy Violation: Violations of the Confidentiality Policy are considered very serious, and may result in disciplinary action, up to and including dismissal for employees or contractors, or removal from the Board or any committee for volunteers.
What information we collect
UWMC collects and uses personal information from donors including: addresses, telephone numbers, email addresses, month and day of birth and donation dates/amounts.
Specific requests made by donors/volunteers are recorded. For example, requests to remain anonymous or to be excluded from certain mailings are respected. We also specify the relationship with UWMC, such as volunteer, private individual, company, etc.
How we collect the information
When donations, whether solicited or not, are made to UWMC, the details provided by the donors are recorded in our database (unless the donor has specifically requested to not be added to our database).
Personal details of volunteers who contact UWMC to offer their services are also entered into our database.
Individuals with a relationship with United Way through activity or participation in fundraising, programs and events receive invitations, newsletters, surveys and have access to Web-based communications that enable UWMC to capture contact information. Through these channels, individuals are given the opportunity to provide their contact information and can specify whether they would like their details added to our database and in what capacity.
Storage and security of information held
All donor contact information, donations, designations and related paperwork are stored in a safe, secure location. UWMC's relational database is password protected and we have a strict hierarchy of access rights in place.
How we use the information
UWMC will use contact information (email, telephone number and address) of donors for these purposes only:
- To distribute receipts for donations;
- To send donor acknowledgement letters and thank donors for their donations;
- To inform supporters about upcoming fundraising and other activities of UWMC;
- For internal analysis and record keeping; and
- For General Mailings. e.g. Direct Mailing to all donors and/or volunteers.
Donors have the option to have their name publicly associated with their donation. However, unless the donor explicitly chooses to remain anonymous, the default is that all donations can be publicly announced.
Comments/testimonials given to UWMC staff/volunteers may be used in promotional materials with the express consent of the individual.
Access and Correction of Information
Donors have the right to access and request a correction to personal information. To ensure that recorded personal information is accurate and up-to-date, donors should notify UWMC of any changes to personal details as soon as possible through the following contact methods: Phone: 831-372-8026 www.unitedwaymcca.org
Financial information
All access to donor financial information is strictly limited to professional staff responsible for processing and reporting on this data. For online payments, UWMC only uses processing services with proven security and strong reputations. UWMC does not have access to credit card or account details sent to those processing services and the information is not stored electronically by UWMC.
Notification of Changes
If UWMC decides to change the privacy policy, those changes will be posted on our Website at www.unitedwaymcca.org so donors are always aware of what information we collect, how we use it, and the circumstances (if any) in which we disclose it. If at any point we decide to use personally identifiable information in a manner different from that stated at the time it was collected, donors will be notified. Donors will have a choice as to whether or not we may use this information in this different manner. We will use information in accordance with the privacy policy under which the information was collected.
United Way Monterey County Notice of Privacy Practices and Client Information Policy
Our Commitment to Client Privacy
United Way Monterey County is committed to protecting its clients' privacy and safeguarding their personal information.
This Privacy Policy explains what information United Way Monterey County collects, how it is used, when it may be shared, how it is protected, and the rights available to clients regarding their personal information.
Client Information We Collect
Depending upon the services requested or provided, United Way Monterey County may collect information including:
- Name
- Date of birth
- Phone number
- Email address
- Residential address
- City, county, and ZIP code
- Language preference
- Race and ethnicity
- Gender
- Veteran status
- Disability status
- Education
- Household composition
- Income category
- Housing status
- Health insurance and Medi-Cal eligibility
- Services requested and received
- Referral history
- Progress toward economic mobility and other quality-of-life indicators
- Protected Health Information (PHI), behavioral health information, substance use information, school-related information, or other sensitive information only when necessary to determine eligibility for services and when permitted by applicable law and the client's authorization.
How Client Information Is Used
United Way Monterey County uses client information to:
- Connect clients with programs and services that meet their needs.
- Determine eligibility for services.
- Coordinate referrals among service providers.
- Coordinate services between organizations when authorized.
- Track whether referrals result in services.
- Improve service coordination and reduce duplicate intake.
- Measure community outcomes using aggregated and de-identified information.
- Meet legal, contractual, reporting, and funding requirements.
Client information is used only for legitimate service delivery, care coordination, program administration, evaluation, and reporting purposes.
Partner organizations agree to use personal information solely for providing services, coordinating referrals, evaluating program outcomes, and fulfilling legal and contractual responsibilities.
How Client Information Is Shared
Client personal information is shared only with organizations that are involved in providing or coordinating services authorized by the client.
Information may be shared:
- With organizations providing requested services.
- With partner organizations coordinating authorized referrals.
- With service providers supporting United Way Monterey County operations under contractual confidentiality obligations.
- When required by law, court order, or governmental regulation.
- To protect the health or safety of an individual or the public when permitted by law.
Sensitive information is shared only when necessary to determine eligibility for a specific service and only as permitted by applicable law and the client's authorization.
We Do Not Sell or Share Client Information for Marketing
United Way Monterey County does not sell or share mobile or personal data with third parties, affiliates, or partners for marketing or promotional purposes.
Client information is shared with third parties only when it is strictly necessary to deliver requested services and only under binding agreements requiring confidentiality, appropriate security safeguards, and compliance with applicable privacy laws.
Under no circumstances will mobile phone numbers, SMS consent, or other personal information be shared or sold for advertising, marketing, or promotional purposes.
Service providers supporting United Way Monterey County operations receive only the minimum information necessary to perform contracted services and are prohibited from using client information for any other purpose.
Text Messaging (SMS)
When a client chooses to receive text messages from United Way Monterey County:
- Message frequency may vary.
- Message and data rates may apply.
- Clients may reply STOP at any time to stop receiving messages.
- Clients may reply HELP for assistance.
- Consent to receive text messages is voluntary.
- Clients may continue receiving services even if they decline SMS communications.
Client mobile phone numbers and SMS consent preferences are used only to communicate regarding services, referrals, appointments, program participation, and other United Way Monterey County activities.
Mobile information will never be sold or shared for advertising or marketing purposes.
Client Authorization
Before personal information is shared with partner organizations or participating service providers, United Way Monterey County will obtain the client's informed authorization through the appropriate consent or release-of-information forms.
Client authorization may permit participating organizations to:
- Receive referrals.
- Coordinate services.
- Exchange referral status information.
- Communicate with clients regarding services.
- Share only the minimum information necessary to provide requested services.
Unless otherwise stated in a specific program, client authorization generally remains valid for twelve (12) months unless revoked sooner.
Client Privacy Rights
Clients have the right to:
- Request a copy of their personal information.
- Request correction of inaccurate information.
- Request information regarding participating service providers.
- Request information regarding how personal information is used.
- Limit certain information sharing when permitted by law.
- Revoke authorization at any time.
- Request deletion of personal information when legally permitted.
- Receive notice of unauthorized disclosures as required by law.
Requests to revoke authorization are generally processed within ten (10) business days. Certain information may be retained when required by law or legitimate record retention requirements.
Information Security
United Way Monterey County maintains administrative, technical, and physical safeguards designed to protect client information against unauthorized access, disclosure, alteration, or destruction.
Security measures include:
- Encryption of data in transit and at rest.
- Role-based access controls.
- Unique user accounts and passwords.
- Multi-factor authentication, where appropriate.
- Secure cloud infrastructure.
- Audit logging and activity monitoring.
- Disaster recovery and redundant data storage.
- Security awareness training.
- Regular vulnerability assessments and penetration testing.
Data Breach Notification
If client personal information is involved in a security incident requiring notification under applicable law, United Way Monterey County will notify affected individuals and appropriate authorities in accordance with federal and California law.
Notifications will describe:
- The nature of the incident.
- The information involved.
- Actions taken to mitigate the incident.
- Steps clients may take to protect themselves.
Confidentiality
United Way Monterey County employees, volunteers, contractors, and participating partner organizations agree to protect confidential information using appropriate administrative, technical, and physical safeguards.
Access to client information is limited to individuals with a legitimate business need and only for purposes of providing services, coordinating care, administering programs, evaluating outcomes, or meeting legal obligations.
Children's Information
When services involve minors, parents, legal guardians, or authorized representatives may provide consent when required by law.
Additional legal protections may apply to educational, behavioral health, and medical records.
Compliance with Privacy Laws
United Way Monterey County is committed to complying with all applicable federal, California, and local privacy and security laws, including, where applicable:
- Health Insurance Portability and Accountability Act (HIPAA)
- California Confidentiality of Medical Information Act (CMIA)
- California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA)
- Family Educational Rights and Privacy Act (FERPA)
- 42 CFR Part 2 governing federally protected substance use disorder records
- Other applicable federal, state, and local privacy laws
Artificial Intelligence (AI)
United Way Monterey County may use artificial intelligence (AI) technologies to assist clients with navigating available services, completing intake forms, identifying potentially eligible programs, answering questions, or supporting staff in providing services.
AI-generated recommendations are intended to assist—not replace—the judgment of qualified professionals.
Client information processed through AI-enabled tools is used solely to deliver requested services, remains protected under this Privacy Policy, and is not used to train publicly available AI models or sold or shared for advertising or marketing purposes.