Privacy & HIPAA.
How we handle the information you share with us on this website, and how we protect the health information of the young people and families we serve.
Effective October 26, 2026 · Last updated October 26, 2026
Part 1
Website Privacy Policy
This policy explains what information we collect through forstter.org, why we collect it, who helps us handle it and the choices you have. We keep it short and we only collect what we need to answer you.
Who we are
Forstter Youth Center (“Forstter”, “we”, “us”) is a 501(c)(3) nonprofit in Salina, Kansas (EIN 84-2974336). We provide residential care, emergency shelter, day respite, crisis support and sitter services for young people.
This policy covers this website, forstter.org, including the Forstter: Backoffice product page. Our Forstter: Sitter platform at sitter.forstter.org has its own privacy policy. The Forstter: Backoffice app itself, which agencies use under a license from us, isn’t covered by this policy.
Questions about this policy? Email info@forstter.org, call (785) 833-2473 or write to Forstter Youth Center, 301 N 9th Street, Salina, KS 67401.
What we collect, form by form
You can read this website without telling us who you are. We only collect personal information when you choose to fill in one of the forms below.
Please don’t send health or medical information through this website. Our forms are for general questions, not for referrals or care records. For a placement or emergency shelter referral, call our 24/7 line at (785) 833-2473. See the website is not for health information.
Contact form (/contact)
Your name, email address, phone number (optional), organization (optional), what your message is about and your message. We save it so our team can reply and follow up, email it to our team, and send you a short confirmation email.
Newsletter sign-up (site footer)
Your email address and when you signed up or unsubscribed. We save it and add it to our newsletter list in Mailchimp, the service we use to send the newsletter.
Forstter: Backoffice license request (/backoffice)
Your name, your agency’s name, your work email, phone number (optional), the programs your agency runs, where you are with CARF accreditation (optional) and any notes. We save it and email it to our team so we can set up your license.
Job applications (/careers)
Your first and last name, email address, phone number, the job you’re applying for, the shifts you can work, an optional message and your resume (a PDF or Word file).
- We read only the text of your resume. The file itself is never stored or forwarded. When you upload it, we check that it really is a PDF or Word document, and we refuse documents that contain macros or are password-protected.
- We copy the text out of the file in memory. Scanned resumes are read with text recognition (OCR) on our own servers. Then the file is discarded.
- We save the text of your resume and the details we pick out of it (such as your work history, education, certifications and skills), plus the file’s name, type, size and a digital fingerprint (SHA-256) of the file.
- This automated step only reads and organizes your resume. It doesn’t score, rank or reject applications. Our hiring staff read your application.
- Our team gets an email with your answers and a link to your application. The email doesn’t include your resume.
Donations (/donate)
When you give, you choose an amount and whether to give once or monthly on our site. Then you pay on a secure page run by Stripe, our payment processor. Your card or bank details go straight to Stripe. They never touch our website, and we never see or store them.
Stripe tells us your name, email address, the amount, whether the gift is one-time or monthly, the payment status and Stripe’s reference numbers for the payment. We save these to keep our donation records and to thank you, and our team gets an email about each gift. Stripe emails your receipt.
Technical information and spam protection
- Cloudflare Turnstile checks that a real person is sending our forms. To do this, Cloudflare receives your IP address and information about your browser and device.
- Hashed IP address. To stop people from flooding our forms, we save a scrambled, one-way version (a “hash”) of your IP address with each form you send. We never save your actual IP address.
- Browser type. With contact messages, license requests and job applications, we save the browser description your browser sends (for example, “Chrome on Windows”). It helps us spot spam and fix problems.
- Server logs. Like every website, our hosting provider handles your IP address and basic request details to deliver pages and keep the site secure, and keeps short-term logs.
Youth Zone (/youth)
The Youth Zone games collect nothing. There’s no sign-in, no names and nothing is sent to us or saved. Your answers stay on your screen and are gone when you close the page.
How we use information
- To answer your message and follow up on your request.
- To review job applications and contact applicants.
- To process donations, keep donation records and thank donors.
- To send our newsletter to people who signed up for it.
- To set up and support Forstter: Backoffice licenses.
- To keep the website secure and stop spam and abuse.
- To meet our legal, tax and reporting duties.
We don’t sell or rent personal information, and we don’t use it for advertising.
As a youth care provider, if something you send us suggests a young person may be at risk of harm, the law may require us to report it to the Kansas Department for Children and Families or to law enforcement.
Children’s privacy
Our forms are meant for adults: families, agencies, job seekers and donors. We don’t knowingly collect personal information from children under 13 through this website, and we don’t ask young people to make an account or sign in.
The Youth Zone pages are made for young people and collect no personal information at all (see Youth Zone).
If you think a child under 13 has sent us personal information through this website, email info@forstter.org and we’ll delete it.
Information about young people in our care isn’t collected through this website. It is handled under our HIPAA Notice of Privacy Practices and the laws that apply to youth care in Kansas.
How we protect information
- Every page and form uses an encrypted (HTTPS) connection, and our database connections are encrypted too.
- Form submissions can only be read by authorized staff who sign in to the admin area. Accounts are locked after repeated failed sign-in attempts.
- We save a hash of your IP address, never the address itself.
- Resume files are checked for their real file type and never stored; documents with macros or passwords are refused.
- Card and bank details are handled only by Stripe, never by our website.
No website or email system is perfectly secure, so please don’t send us sensitive details through the website. If you think something has gone wrong, tell us at info@forstter.org.
How long we keep it
We keep information only as long as we need it for the reason you gave it to us, or as the law requires:
- Contact messages and Backoffice license requests: 2 years.
- Job applications from people we don’t hire: 1 year after the position is filled, as employment law generally requires.
- Donation records: 7 years, for tax and audit purposes.
- Newsletter sign-ups: until you unsubscribe. We keep a note that you unsubscribed so we don’t add you again by mistake.
When the time is up, we delete the record, including its IP hash and browser details.
Your choices and rights
- Unsubscribe from our newsletter at any time with the link at the bottom of every newsletter email, or by emailing info@forstter.org.
- See, correct or delete the information you sent us through this website by emailing info@forstter.org. We may ask you to confirm who you are first.
- Change or stop a monthly gift by emailing info@forstter.org or calling (785) 833-2473.
We’ll answer within 30 days. Some records, like donation records, we may need to keep for tax or legal reasons. If so, we’ll tell you.
Other websites
This website links to sites we don’t run. Their own privacy policies apply there:
- Forstter: Sitter at sitter.forstter.org (opens in a new tab) has its own privacy policy (opens in a new tab) and terms of use (opens in a new tab).
- Stripe, for donations: stripe.com/privacy (opens in a new tab).
- Mailchimp, for the newsletter: mailchimp.com/legal/privacy (opens in a new tab).
- Cloudflare, for spam protection: cloudflare.com/privacypolicy (opens in a new tab).
- Social media such as Facebook, if we link to our pages there, and helplines like 988.
Changes to this policy
If we change how we handle information, we’ll update this page and the date below. If a change is significant, we’ll say so at the top of this page.
Effective date
This Website Privacy Policy takes effect on October 26, 2026. Last updated October 26, 2026.
Part 2
HIPAA Notice of Privacy Practices
This notice describes how medical information about you may be used and disclosed and how you can get access to this information. Please review it carefully.
The website is not for health information
The forms on this website (contact, newsletter, Backoffice license, job applications and donations) are not a secure way to send us medical or health information. Please don’t include diagnoses, medications, treatment details or information about a young person’s care in a form or an email.
HIPAA protects the health information Forstter creates and receives while providing care. It doesn’t cover general website inquiries, which are handled under our Website Privacy Policy. To make a referral or talk about someone’s care, call us at (785) 833-2473.
If health information does reach us through the website, we will keep it confidential, share it only with the staff who need it to respond, and delete it from the website system once we no longer need it there.
Who this notice covers
This notice applies to the young people we serve and the health information Forstter keeps about them in any of our care programs. Our staff, volunteers and contractors follow it.
For a young person in our care, a parent, legal guardian or the agency with legal custody can usually use the rights in this notice on the young person’s behalf, as Kansas law allows. If you’re not sure who can act for a young person, contact our Privacy Officer.
How we may use and share health information
Treatment
We use health information to care for a young person, and share it with others who are caring for them. For example, we may talk with their doctor, therapist or school nurse, or with the facility they move to next.
Payment
We use and share health information to bill and get paid for our services, for example with the health plans, agencies or others that pay for a young person’s care.
Health care operations
We use health information to run our programs and improve care, for example for quality reviews, staff training and supervision, licensing reviews and accreditation surveys such as CARF.
Other uses the law allows or requires
We may also share health information without written permission when the law allows or requires it, including:
- to report suspected abuse or neglect of a child to the Kansas Department for Children and Families or law enforcement;
- to prevent a serious threat to someone’s health or safety;
- for public health purposes, such as reporting certain diseases;
- to health oversight and licensing agencies, such as DCF and the Kansas Department for Aging and Disability Services (KDADS), for inspections and audits;
- in response to a court order or other lawful process, and for certain law enforcement purposes;
- with family members or others involved in a young person’s care, when appropriate and allowed;
- to medical examiners and funeral directors, for workers’ compensation, and for certain government functions;
- when any other federal, state or local law requires it.
Your rights
To use any of these rights, contact our Privacy Officer.
- Get a copy of your health records. You can ask to see or get a paper or electronic copy. We’ll usually respond within 30 days and may charge a reasonable, cost-based fee.
- Ask us to correct your records. If you think information is wrong or incomplete, you can ask us to change it. We may say no, but we’ll tell you why in writing within 60 days.
- Get a list of those we’ve shared information with (an “accounting of disclosures”) for the six years before you ask. It won’t include treatment, payment, operations or disclosures you authorized. One list a year is free.
- Ask us to limit what we use or share. We don’t have to agree, but if we do, we’ll keep to it unless it’s needed in an emergency. If you pay for a service in full out of pocket, you can ask us not to share it with your health plan, and we’ll agree unless the law requires it.
- Ask us to contact you confidentially, for example at a different address or phone number. We’ll agree to reasonable requests.
- Get a paper copy of this notice at any time, even if you agreed to get it electronically.
- Choose someone to act for you. A legal guardian or someone with medical power of attorney can use your rights. We’ll check they have that authority first.
Our responsibilities
- The law requires us to keep health information private and secure.
- We’ll let you know promptly if a breach happens that may have put your information at risk.
- We must follow the practices in this notice and give you a copy of it.
- We won’t use or share your information in ways not described here unless you tell us we can in writing.
We can change this notice, and the changes will apply to all information we have about you. The new notice will be available on request, at our office and on this page.
Kansas law and substance use records
Some records have extra protection beyond HIPAA, and when another law is stricter, we follow it. Examples include Kansas laws on records about children in state custody and on mental health treatment.
If we provide substance use disorder treatment, those records are also protected by federal law (42 CFR Part 2), which limits how they can be shared.
Questions and complaints
If you think we haven’t protected your privacy rights, you can file a complaint with us by contacting our Privacy Officer.
You can also file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights: online at hhs.gov/hipaa/filing-a-complaint (opens in a new tab), by calling 1-877-696-6775, or by writing to 200 Independence Avenue, S.W., Washington, D.C. 20201.
We will not retaliate against you for filing a complaint.
Privacy Officer
Forstter’s Privacy Officer handles questions, requests and complaints about this notice. Contact the Privacy Officer at:
Forstter Youth Center, 301 N 9th Street, Salina, KS 67401. Phone (785) 833-2473. Email info@forstter.org.
Effective date of this notice
This Notice of Privacy Practices takes effect on October 26, 2026. Last updated October 26, 2026.