Privacy Policy

1. Overview

The International Commission on Professional Care Accreditation and Standards ("ICPCAS," "we," "our," or "us") respects the privacy of visitors, accreditation applicants, accredited organizations, reviewers, complainants, and others who interact with us. This Privacy Policy describes how personal information is collected, used, disclosed, retained, and protected in connection with www.icpcas.org (the "Website") and ICPCAS-related activities.

"Personal information" means information that identifies, relates to, describes, or can reasonably be linked to an identifiable person, subject to the definitions and exceptions in applicable law. Information about an organization may also contain personal information if it identifies an individual.

This Policy concerns ICPCAS-controlled activities. A separate written agreement, application notice, or third-party platform policy may also apply to a particular submission or service.

2. Information We Collect

Depending on how you engage with ICPCAS, information may include:

• Identity and contact details: names, professional titles, organizational affiliations, mailing addresses, email addresses, telephone numbers, and country or location.
• Accreditation materials: application and eligibility details, program descriptions, training records, curricula, policies, faculty qualifications, quality-improvement documents, supporting evidence, responses to standards, and related correspondence.
• Evaluation and professional records: reviewer or site visitor applications, credentials, relevant experience, availability, conflict-of-interest disclosures, review notes, interview feedback, and reports.
• Complaints and appeals: information included in complaints, appeals, responses, witness statements, investigation materials, and decisions.
• Payments and administration: transaction amounts, payment status, invoices, billing contact details, and transaction references. Complete payment-card information, if payment functionality is offered, is generally handled by the applicable payment processor rather than by ICPCAS.
• Website and technical data: IP address, approximate location derived from it, browser or device type, pages viewed, referring pages, cookie or similar identifiers, and usage or security logs, to the extent collected by our Website and configured services.
• Communications: messages and attachments submitted through forms, emails, and other authorized channels, together with records of our replies.

We ask you not to provide sensitive information, such as detailed medical records, government identifiers, or information about children, unless it is specifically necessary for an authorized review and an appropriate submission process is available.

3. How Information Is Collected

We collect information when you submit a contact inquiry, complete an accreditation or reviewer form, send a complaint or appeal, apply for a service, provide supporting documentation, participate in interviews or visits, or otherwise communicate with ICPCAS.

We may also receive relevant information from your organization, its authorized representatives, reviewers, references, participating third parties, or publicly available professional and regulatory sources when reasonably necessary for an accreditation or compliance purpose.

Some technical data may be collected automatically when you visit the Website through hosting services, website functionality, security tools, cookies, or analytics technologies, depending on the services enabled.

4. How We Use Information

ICPCAS may use personal information to:

• Respond to questions and manage requests, applications, and administrative communications.
• Assess eligibility, administer self-studies, conduct site visits and interviews, evaluate evidence, and make or review accreditation decisions.
• Manage reviewer assignments, independence, conflict-of-interest safeguards, and quality assurance.
• Process and document fees, maintain organizational records, and carry out agreed services.
• Review complaints and appeals, investigate concerns, and carry out monitoring or corrective-action processes.
• Maintain the accuracy and integrity of public accreditation status information.
• Operate, secure, troubleshoot, and improve the Website, forms, information systems, and user experience.
• Comply with applicable legal obligations, enforce our policies, and establish or defend legal rights.

If ICPCAS sends optional newsletters or promotional announcements, it will do so in accordance with applicable law and available communication preferences. Unsubscribing from optional communications does not necessarily stop service-related or legally required notices.

5. Legal Bases for Processing

Where law requires a legal basis for processing, ICPCAS relies on the basis appropriate to the activity. This may include steps taken at your request before entering into an agreement, performance of a contract, compliance with a legal obligation, legitimate interests in operating an impartial accreditation system, or consent where required.

Legitimate interests may include reviewing training programs, preventing fraud, safeguarding accreditation integrity, maintaining accurate public records, and securing information systems, balanced against individuals' rights. Where processing depends on consent, you may withdraw it as allowed by law, without affecting processing already performed lawfully.

6. Accreditation Records and Public Information

Transparency is an important part of accreditation. ICPCAS may publish factual information about accreditation decisions and program status, including the organization and program names, accreditation identifiers, approved scope, disciplines, location or country, status (including conditions or adverse actions where applicable), decision dates, review dates, and other details authorized by applicable policies.

Not every document submitted to ICPCAS becomes public. Applications, self-studies, financial documents, confidential review evidence, and internal deliberations are handled under applicable confidentiality rules, contracts, and law. However, ICPCAS may disclose relevant information to reviewers, decision-makers, or other authorized participants when needed to conduct a review.

Before submitting materials, applicants should identify legitimately confidential information and avoid including unnecessary personal data about learners, patients, clients, or families. Submitting a document does not automatically guarantee that every part of it will remain confidential if disclosure is required by law or applicable accreditation procedures.

7. When We Share Information

ICPCAS does not disclose personal information indiscriminately. Depending on the circumstances, we may share information with:

• Authorized ICPCAS personnel and participants: commissioners, staff, contractors, trained reviewers, site visitors, or advisers who need the information for their assigned duties and are subject to appropriate obligations.
• Service providers: companies supporting website hosting, form submission, document storage, email, payment processing, security, administration, and analytics, subject to their roles and applicable contractual protections.
• Accreditation participants: applicants or accredited entities, complainants, respondents, and representatives to the extent reasonably necessary for a fair review, response, appeal, or regulatory obligation.
• Public recipients: visitors to ICPCAS directories, published decisions, or notices containing information designated as public under applicable accreditation policies.
• Legal and safety recipients: authorities, courts, regulators, or advisers where reasonably necessary to comply with law, address misconduct, protect rights, or respond to valid legal process.
• Organizational successors: an entity involved in a lawful reorganization or transfer of operations, subject to applicable legal requirements.

ICPCAS does not treat an applicant's submission as authorization to share unrelated personal information for third-party marketing. Any practices that constitute a "sale" or "sharing" of personal information under applicable privacy laws must be disclosed and accompanied by the legally required choices, where relevant.

8. Cookies and Website Technologies

The Website is built using Squarespace and may use cookies, local storage, or similar technologies needed for page operation, site security, session management, preferences, analytics, or other enabled features.

Essential technologies help deliver the Website. Optional analytics or marketing technologies, if enabled, may collect information about how visitors interact with the Website. The technologies actually in use can change with Squarespace settings, embedded content, and connected services.

You can control some cookies through your browser settings and, where provided, the Website's cookie-consent or preference controls. Blocking certain technologies may affect the way parts of the Website function. Browser-based signals, such as Global Privacy Control, will be addressed to the extent required by applicable law and supported by the technologies in use.

9. Data Retention

ICPCAS retains personal information for as long as reasonably necessary for the purposes described in this Policy, including evaluation, accreditation-cycle management, monitoring, historical records, dispute resolution, accounting, fraud prevention, and legal compliance.

Retention periods may differ by record type and applicable policy. For example, formal accreditation decisions and public status records may be kept for historical accuracy, while routine correspondence and technical logs may be retained for shorter periods. At the end of an applicable retention period, information will be deleted, de-identified, or archived where law and legitimate recordkeeping needs permit.

10. Information Security

ICPCAS uses administrative, technical, and organizational measures reasonably designed to protect information against unauthorized access, alteration, loss, or disclosure. Measures may include access restrictions, staff and reviewer confidentiality obligations, appropriate service-provider controls, and reasonable system-security practices.

No website, electronic transmission, or information-storage system can be guaranteed to be completely secure. Please use authorized submission channels for sensitive documents and contact us promptly if you believe information submitted to ICPCAS has been exposed or misdirected.

11. International Visitors and Transfers

ICPCAS serves professional care education programs that may operate in multiple countries. Information may be accessed or processed in the United States or other jurisdictions where ICPCAS and its service providers operate. Data protection laws in those locations may differ from the laws where you live.

Where applicable law requires safeguards for cross-border transfers, ICPCAS will use a lawful transfer mechanism or other permitted basis appropriate to the processing.

12. Your Privacy Rights and Choices

Depending on your location and the applicable law, you may have the right to request access to personal information held about you; correction of inaccuracies; deletion; restriction or objection to certain processing; a portable copy of eligible data; withdrawal of consent; or an appeal of a privacy-request decision. Some jurisdictions also provide a right to opt out of certain targeted-advertising, sale, profiling, or similar practices, if those practices occur.

To submit a privacy request, use the ICPCAS contact page and describe the request and the relevant information. We may need to take reasonable steps to verify your identity or authority before responding. A request may be limited where an exception applies, including obligations to preserve accreditation integrity, maintain legally required records, protect others' rights, or handle pending disputes.

We will evaluate and respond to privacy requests within the time required by applicable law. If you believe our handling of a request is improper, you may have the right to complain to a relevant data protection or privacy authority.

13. Children and Sensitive Information

The Website and ICPCAS accreditation services are intended for adult representatives of organizations, professional participants, and general visitors; they are not directed to children under 13. We do not knowingly seek personal information directly from children under 13 through the Website.

Accreditation submissions should ordinarily use anonymized, aggregated, or redacted examples when evidence could identify a learner, patient, family member, or child. If you think a child has submitted personal information to us through the Website, please contact ICPCAS so the matter can be evaluated.

14. Third-Party Websites and Services

ICPCAS may link to independent third-party websites, training providers, payment services, embedded resources, or external documents. Those services may collect or use personal information under their own privacy policies, terms, and practices. ICPCAS does not control the privacy practices of websites that it does not operate.

15. Changes to This Privacy Policy

ICPCAS may revise this Privacy Policy to reflect changes in our services, technologies, legal obligations, or information practices. We will post the revised version on this page and update the "Last updated" date. When required by law, we will provide additional notice or request consent for material changes.

16. Contact and Privacy Inquiries

If you have questions about this Privacy Policy, how ICPCAS handles information, or a privacy-rights request, please contact us through the official ICPCAS contact page.

International Commission on Professional Care Accreditation and Standards (ICPCAS)