Privacy Policy

This Privacy Policy applies to the H.R. 1 Communications Toolkit website, operated by the Colorado Department of Health Care Policy & Financing (HCPF). It describes what information we collect when you use this site, how we use it, who we share it with, and the rights you have under Colorado, federal, and applicable international law.

1. Who we are

This website (https://hr1toolkit.healthfirstcolorado.gov) is published by the Colorado Department of Health Care Policy & Financing (HCPF) — the State of Colorado agency that administers the Health First Colorado (Colorado’s Medicaid) program. The site provides communication materials to community organizations, providers, and partner organizations who help inform Health First Colorado members about upcoming federal policy changes.

If you have questions about this Privacy Policy, contact the Toolkit team at hcpf_communications@state.co.us.

2. Information we collect

Information you give us

• Email correspondence — if you email the toolkit team, we receive your email address, your name (if provided), and the contents of your message.
• Form submissions — if you submit a contact or support form on the site, we receive the information you enter. Forms are processed using Gravity Forms and stored on this site’s server.

Information collected automatically

• Server logs — like most web servers, our hosting provider (SiteGround) records standard request data including IP address, browser type, referring page, and pages visited. Logs are retained for limited periods for security and troubleshooting purposes.
• Google Analytics 4 (with your consent) — if you accept analytics cookies on the consent banner, Google Analytics sets cookies that measure aggregated, pseudonymous usage of the site (pages viewed, time on site, approximate location). IP addresses are anonymized. No analytics cookies are set unless you opt in. You can change your choice any time using the “Cookie Preferences” link in the footer.
• Functional cookies — small cookies necessary for the site to operate (such as remembering your consent choice). These are set regardless of consent because the site cannot function without them.

For a complete list of cookies used, including expiration and purpose, see our Cookie Policy.

3. How we use information

• To deliver the toolkit content and respond to inquiries from partner organizations
• To understand, in aggregate, which materials are being used and how the site is performing
• To operate, secure, and improve the site
• To comply with state and federal recordkeeping obligations

We do not use information collected on this site for advertising, retargeting, profiling, or automated decision-making. We do not sell personal information.

4. Who we share information with

• Service providers — SiteGround (hosting), Google (Analytics, only if you consent). These providers process data on our behalf under their own contractual privacy and security obligations.
• Other Colorado state entities — where required for the operation of the Health First Colorado program or in response to lawful requests.
• Legal process — when required by court order, subpoena, or other lawful legal process.

We do not share personal information with third parties for their own marketing purposes.

5. Your rights under the Colorado Privacy Act (CPA)

If you are a Colorado resident, the Colorado Privacy Act gives you the right to:

• Access — confirm whether we process personal data about you, and obtain a copy.
• Correct — request that inaccurate personal data be corrected.
• Delete — request deletion of personal data we hold about you.
• Portability — receive personal data in a portable, readily usable format.
• Opt out — opt out of the processing of personal data for targeted advertising, the sale of personal data, or certain profiling. (We do not sell personal data, conduct targeted advertising, or perform consequential profiling on this site.)
• Universal Opt-Out Mechanism — we honor the Global Privacy Control (GPC) browser signal. If your browser sends a GPC signal, we treat it as an opt-out request for analytics cookies.

To exercise any of these rights, contact hcpf_communications@state.co.us. We will respond within 45 days as required by the CPA. If we decline a request, you have the right to appeal; we will provide instructions for appeal in our written response. You may also contact the Colorado Attorney General’s Office.

6. Your rights under the California Consumer Privacy Act (CCPA / CPRA)

California residents have similar rights of access, correction, deletion, portability, and opt-out under the California Consumer Privacy Act, as amended by the California Privacy Rights Act. We also honor the GPC browser signal as a valid opt-out request. To exercise these rights, use the contact information above.

7. Children’s privacy

This site is intended for partner organizations communicating with adults. We do not knowingly collect personal information from children under 13. If you believe a child has provided personal information through this site, please contact us so we can delete it.

8. Security

We use industry-standard administrative, technical, and physical safeguards to protect information transmitted to or stored on this site, including TLS encryption for all connections. No system can be guaranteed 100% secure; we encourage you to use a current browser and not transmit sensitive personal information through public forms.

9. Retention

Server logs are retained for short operational windows (typically 7–30 days). Form submissions and email correspondence are retained as long as needed to respond to your request and to satisfy applicable state recordkeeping rules. Analytics data, where consent has been given, is retained according to Google Analytics’ default settings (currently 14 months) and is aggregated and pseudonymous.

10. International visitors

This site is operated from the United States and is intended for use in Colorado. If you access the site from outside the United States, your information will be transferred to and processed in the United States, which may have different data protection laws than your home jurisdiction.

11. Accessibility

HCPF is committed to making this site accessible to all users in conformance with WCAG 2.1 AA. If you encounter an accessibility barrier, contact us using the address above and we will work to provide the information you need in an accessible format.

12. Changes to this Policy

We may update this Privacy Policy from time to time. The “Last updated” date at the top of this page reflects the most recent change. Material changes will be highlighted on the site.