Updated HUD narrowed federal ESA enforcement on May 22, 2026. Your state law now does most of the work. See what changed →
BestESALetter
Home/Privacy Policy

Updated August 31, 2026

Privacy Policy

What we collect, why, who sees it, and how to get it back or get it deleted.

Reviewed for clinical accuracy by Andrew Patel, LCSW, Licensed Clinical Social Worker. Last reviewed August 31, 2026.

  • HIPAA CompliantClinical data handled under HIPAA safeguards
  • 256-bit SSL EncryptedEncrypted in transit and at rest
  • Written to Fair Housing Act StandardsDocuments disability and disability-related need
  • ADA-Accurate on Service AnimalsNo fake access claims — we explain the real rule
  • No Charge If Not ApprovedYou only pay when a clinician issues a letter

Every claim above is one we are willing to be held to. How we handle health information · refund policy · what the ADA actually requires.

Last updated August 31, 2026

What We Collect

Information you give us

  • Account and contact details: name, email address, phone number, state of residence.
  • Screening responses: what you enter in the questionnaire before an evaluation.
  • Payment details: processed by a third-party payment processor. We do not store full card numbers.
  • Support correspondence: what you send us by email.

Information collected automatically

  • IP address, browser type, device type, operating system
  • Pages viewed, referring URL, time on site
  • Cookies and similar technologies

Clinical information

What you discuss with a clinician during an evaluation, and the records they create, are protected health information held by that clinician. Handling is described on our HIPAA compliance page.

Why We Use It

PurposeWhat it involves
Providing the serviceMatching you with a licensed clinician in your state, scheduling, delivering your letter
PaymentsProcessing charges and refunds through our payment processor
SupportAnswering your questions and arranging letter revisions
Legal complianceMeeting state licensure, healthcare and consumer protection obligations
Improving the siteAggregate analytics on which pages people use and where they get stuck
SecurityDetecting fraud and abuse

Who We Share It With

  • Your clinician. The licensed professional evaluating you receives what they need to do so.
  • Service providers. Hosting, scheduling, video, email delivery, payment processing and analytics vendors, bound by contract and, where applicable, by business associate agreements.
  • Legal process. Where required by law, subpoena or court order.
  • Business transfer. If the company is acquired or merged, subject to the protections in this policy.

What we do not do

We do not sell your personal information. We do not share health-related information with advertisers or data brokers. We do not send your information to your landlord — your letter goes to you, and you decide what to do with it.

Cookies

We use strictly necessary cookies to run the site, and analytics cookies to understand usage. You can block cookies in your browser; strictly necessary cookies are required for parts of the site to function. Where required by law, we ask for consent to non-essential cookies before setting them.

How Long We Keep It

  • Account and contact data: while your account is active, then for a limited period afterwards.
  • Payment records: as long as tax and accounting rules require.
  • Clinical records: retained by your clinician for the period their state licensure requires.
  • Analytics: in aggregated or de-identified form.

Your Rights

Depending on where you live, you may have the right to access, correct, delete or port your personal information, to opt out of sale or sharing, to limit use of sensitive personal information, and not to be discriminated against for exercising these rights. Residents of California, Colorado, Connecticut, Virginia, Utah and a growing number of other states have specific statutory rights of this kind.

To make a request, email privacy@bestesaletter.com. We will verify your identity before acting and respond within the timeframe your state's law requires. Requests about clinical records are routed to the clinician who holds them.

Security

We use encryption in transit and at rest, access controls, audit logging and vendor due diligence. No system is perfectly secure, and we will notify affected users as the law requires if a breach occurs.

Children

This service is not directed at children under 13, and we do not knowingly collect their personal information. Evaluations concerning a minor are arranged by a parent or legal guardian.

Changes

We will post any updated version here with a new date at the top. Material changes will be communicated to registered users by email.

Contact

Privacy questions and requests: privacy@bestesaletter.com. General support: support@bestesaletter.com. Details on our contact page.

Template notice

This policy is a starting draft. It must be reviewed and adapted by qualified privacy counsel — and reconciled with your actual vendors, retention schedules and state registrations — before it goes live.

Sources

  1. HIPAA for individuals — your health information privacy rights U.S. Department of Health and Human Services
  2. 45 C.F.R. Parts 160 and 164 — the HIPAA Privacy and Security Rules Electronic Code of Federal Regulations
  3. Federal Trade Commission — consumer protection and advertising rules Federal Trade Commission
  4. State consumer protection offices USA.gov
  5. File a health information privacy complaint HHS Office for Civil Rights
  6. Report a scam or a deceptive business practice Federal Trade Commission

Find Out Where You Stand in About Ten Minutes

Answer a short screening questionnaire, talk to a clinician licensed in your state, and get a real answer either way.

Book Your Evaluation See Pricing