Privacy Policy

Your privacy is important to me. It is my policy to respect your privacy and comply with any applicable law and regulation regarding any personal information I may collect about you, including across my website, https://nursupportservices.com, and other sites I own and operate.

Personal information is any information about you which can be used to identify you. This includes information about you as a person (such as name, address, and date of birth), your devices, payment details, and even information about how you use a website or online service.

Nur Support Services is owned and operated solely by Esra Nur Altun, a Board Certified Behavior Analyst (BCBA) with active certification from the Behavior Analyst Certification Board (BACB). When this policy says "I," "me," or "my," it means Esra Nur Altun, doing business as Nur Support Services. There are no other owners, employees, or affiliated companies involved in the operation of this business.

In the event my site contains links to third-party sites and services, please be aware that those sites and services have their own privacy policies. After following a link to any third-party content, you should read their posted privacy policy information about how they collect and use personal information. This Privacy Policy does not apply to any of your activities after you leave my site.

This policy is effective as of September 5, 2026.

Last updated: October 4, 2026

Information I Collect

Information I collect falls into one of two categories: "voluntarily provided" information and "automatically collected" information.

"Voluntarily provided" information refers to any information you knowingly and actively provide me when using or participating in any of my services and promotions.

"Automatically collected" information refers to any information automatically sent by your devices in the course of accessing my products and services.

1. Voluntarily Provided Information

You knowingly provide this information when you contact me, schedule a service, or submit content on my website. This includes, but is not limited to:

  • Identifiers: Your name, email address, phone number, and mailing address.

  • Child's Information: Name and date of birth of a child (if applicable).

  • Behavioral Information: This includes sensitive information related to the purpose of my services, such as:

    • Behavioral concerns

    • Information from Individualized Education Programs (IEPs) or Behavior Intervention Plans (BIPs)

    • Progress notes, medical history, or any information shared during behavior analysis, coaching sessions, and assessments.

2. Automatically Collected Information

This is information automatically sent by your device when you visit my website. This may include your IP address, browser type, pages visited, and the time and date of your visit (Log Data).

Log Data

When you visit my website, my servers may automatically log the standard data provided by your web browser. It may include your device's Internet Protocol (IP) address, your browser type and version, the pages you visit, the time and date of your visit, the time spent on each page, and other details about your visit.

Additionally, if you encounter certain errors while using the site, I may automatically collect data about the error and the circumstances surrounding its occurrence. This data may include technical details about your device, what you were trying to do when the error happened, and other technical information relating to the problem. You may or may not receive notice of such errors, even in the moment they occur, that they have occurred, or what the nature of the error is.

Please be aware that while this information may not be personally identifying by itself, it may be possible to combine it with other data to personally identify individual persons.

Personal Information

I may ask for personal information — for example, when you submit content to me or when you contact me — which may include one or more of the following:

  • Name

  • Email

  • Phone/mobile number

  • Behavioral Information

Legitimate Reasons for Processing Your Personal Information

I only collect and use your personal information when I have a legitimate reason for doing so. In which instance, I only collect personal information that is reasonably necessary to provide my services to you.

Collection and Use of Information

I may collect personal information from you when you do any of the following on my website:

  • Use a mobile device or web browser to access my content

  • Contact me via email, social media, or on any similar technologies

  • When you mention me on social media

I may collect, hold, use, and disclose information for the following purposes, and personal information will not be further processed in a manner that is incompatible with these purposes:

  • To provide my behavior analysis, coaching, consultation, and assessment services, including developing data trackers, "Your Roadmap," and assessments.

  • To contact and communicate with you regarding your services, appointments, and payments.

  • To process your payment and manage your account.

  • For internal record-keeping and administrative purposes.

  • To improve my website and services.

I may combine voluntarily provided and automatically collected personal information with general information or research data I receive from other trusted sources. For example, my marketing and market research activities may uncover data and insights, which I may combine with information about how visitors use my site to improve my site and your experience on it.

Security of Your Personal Information

When I collect and process personal information, and while I retain this information, I will protect it within commercially acceptable means to prevent loss and theft, as well as unauthorised access, disclosure, copying, use or modification.

Although I will do my best to protect the personal information you provide to me, I advise that no method of electronic transmission or storage is 100% secure and no one can guarantee absolute data security.

You are responsible for selecting any password and its overall security strength, ensuring the security of your own information within the bounds of my services. For example, ensuring you do not make your personal information publicly available via my platform.

How Long I Keep Your Personal Information

I keep your personal information, including behavioral data, assessments, or plans, for 7 years. This time period may depend on what I am using your information for, in accordance with this privacy policy. For example, if you have provided me with personal information such as an email address when contacting me about a specific enquiry, I may retain this information for the duration of your enquiry remaining open, as well as for my own records so I may effectively address similar enquiries in future. If your personal information is no longer required for this purpose, I will delete it or make it anonymous by removing all details that identify you after 7 years.

However, if necessary, I may retain your personal information for my compliance with a legal, accounting, or reporting obligation or for archiving purposes in the public interest, scientific, or historical research purposes or statistical purposes.

California Confidentiality of Medical Information Act (CMIA)

Because I provide behavior analysis, coaching, consultation, and assessment services, the information I collect may qualify as "medical information" under the California Confidentiality of Medical Information Act (Civil Code § 56 et seq.). Under CMIA, I may not disclose medical information to third parties without your written authorization, except as required or permitted by law.

CMIA provides heightened protection for mental health and behavioral health information. In general, if a disclosure is not specifically permitted or required by the statute, I must obtain your authorization prior to disclosing medical information. I maintain appropriate confidentiality in creating, storing, accessing, transferring, and disposing of records under my control, in accordance with applicable federal and state law.

I may disclose confidential information without your consent only as mandated by law, or where permitted by law for a valid purpose, such as: (1) to provide needed professional services to you; (2) to obtain appropriate professional consultations; (3) to protect you or others from harm; or (4) to obtain payment for services, in which instance disclosure is limited to the minimum that is necessary to achieve the purpose.

Mandated Reporting (CANRA)

As a Board Certified Behavior Analyst (BCBA) and Qualified Autism Service Professional in California, I am a mandated reporter under the California Child Abuse and Neglect Reporting Act (CANRA), Penal Code § 11164 et seq.

California law requires that I report known or reasonably suspected incidents of child abuse or neglect to the appropriate authorities. This duty applies regardless of any confidentiality obligations I may otherwise have under CMIA or the BACB Ethics Code. Reports must be made immediately or as soon as practicably possible by telephone, followed by a written follow-up report within 36 hours.

The BACB Ethics Code explicitly permits disclosure of confidential information when mandated by law, so reporting as a mandated reporter does not violate my professional ethical obligations.

Children's Privacy

I do not aim any of my products or services directly at children under the age of 13 and I do not knowingly collect personal information about children under 13.

Note for California and behavioral services: If you provide me with information about a child as part of behavior analysis, coaching, consultation, or assessment services, you represent that you have the authority to share that information with me. Where required, I will obtain parental or guardian consent before collecting or using a child's personal information. California law, including the CCPA/CPRA, provides special protections for minors' personal information, including the right to opt out of the sale or sharing of personal information for consumers under 16 (and under 13 requires opt-in consent). I do not sell or share the personal information of minors.

Disclosure of Personal Information to Third Parties

Because Nur Support Services is operated solely by me, I do not disclose personal information to employees, affiliates, or related entities of a company. However, I may disclose personal information in the following limited circumstances:

  • To service providers, contractors, or agents who assist me in providing information, products, services, or direct marketing to you (for example, scheduling or payment processors).

  • To credit reporting agencies, courts, tribunals, and regulatory authorities, in the event you fail to pay for goods or services I have provided to you.

  • To courts, tribunals, regulatory authorities, and law enforcement officers, as required by law, in connection with any actual or prospective legal proceedings, or in order to establish, exercise, or defend my legal rights.

  • To third parties to collect and process data on my behalf.

  • To an entity that buys, or to which I transfer all or substantially all of my assets and business.

Third parties I currently use include:

  • Calendly (booking appointments)

  • PayPal (payment processing)

  • Squarespace Payments (payment processing, including credit and debit cards, Google Pay, Link by Stripe, ACH Direct Debit, Apple Pay, Afterpay, and Klarna)

If you choose a buy-now-pay-later option at checkout, the provider of that option collects and processes your information under its own privacy policy.

I do not sell your personal information. I do not share your personal information for cross-context behavioral advertising.

Your Rights and Controlling Your Personal Information

Your choice: By providing personal information to me, you understand I will collect, hold, use, and disclose your personal information in accordance with this privacy policy. You do not have to provide personal information to me, however, if you do not, it may affect your use of my website or the products and/or services offered on or through it.

Information from third parties: If I receive personal information about you from a third party, I will protect it as set out in this privacy policy. If you are a third party providing personal information about somebody else, you represent and warrant that you have such person's consent to provide the personal information to me.

Marketing permission: If you have previously agreed to me using your personal information for direct marketing purposes, you may change your mind at any time by contacting me using the details below.

Access: You may request details of the personal information that I hold about you.

Correction: If you believe that any information I hold about you is inaccurate, out of date, incomplete, irrelevant, or misleading, please contact me using the details provided in this privacy policy. I will take reasonable steps to correct any information found to be inaccurate, incomplete, misleading, or out of date.

Non-discrimination: I will not discriminate against you for exercising any of your rights over your personal information. Unless your personal information is required to provide you with a particular service or offer (for example providing user support), I will not deny you goods or services and/or charge you different prices or rates for goods or services, including through granting discounts or other benefits, or imposing penalties, or provide you with a different level or quality of goods or services.

Notification of data breaches: I will comply with laws applicable to me in respect of any data breach.

Complaints: If you believe that I have breached a relevant data protection law and wish to make a complaint, please contact me using the details below and provide me with full details of the alleged breach. I will promptly investigate your complaint and respond to you, in writing, setting out the outcome of my investigation and the steps I will take to deal with your complaint. You also have the right to contact a regulatory body or data protection authority in relation to your complaint.

Opt out of communications: You may opt out of receiving communications from me, including marketing and promotional messages, at any time. To do so, use the opt-out facilities provided in the communication. For example, you can click the "unsubscribe" link included in any marketing email I send you, reply "STOP" to any SMS messages I send you, visit https://nursupportservices.com, or contact me directly using the contact information provided in this privacy policy. In certain cases, I may request additional information to verify your identity before processing your opt-out request.

Please be aware that even if you opt out of communications, I may still contact you when necessary for non-promotional purposes, including, but not limited to, managing your account, responding to service inquiries, or providing important updates related to your use of my services.

Business Transfers

If I or my assets are acquired, or in the unlikely event that I go out of business or enter bankruptcy, I would include data, including your personal information, among the assets transferred to any parties who acquire me. You acknowledge that such transfers may occur, and that any parties who acquire me may, to the extent permitted by applicable law, continue to use your personal information according to this policy, which they will be required to assume as it is the basis for any ownership or use rights I have over such information.

Limits of My Policy

My website may link to external sites that are not operated by me. Please be aware that I have no control over the content and policies of those sites, and cannot accept responsibility or liability for their respective privacy practices.

Changes to This Policy

At my discretion, I may change my privacy policy to reflect updates to my business processes, current acceptable practices, or legislative or regulatory changes. If I decide to change this privacy policy, I will post the changes here at the same link by which you are accessing this privacy policy.

If required by law, I will get your permission or give you the opportunity to opt in to or opt out of, as applicable, any new uses of your personal information.

Additional Disclosures for U.S. States Privacy Law Compliance

The following section includes provisions that comply with the privacy laws of these states (California, Colorado, Delaware, Florida, Virginia, and Utah) and is applicable only to the residents of those states. Specific references to a particular state (in a heading or in the text) are only a reference to that state's law and applies only to that state's residents. Non-state specific language applies to all of the states listed above.

Do Not Track

Some browsers have a "Do Not Track" feature that lets you tell websites that you do not want to have your online activities tracked. At this time, I do not respond to browser "Do Not Track" signals.

I adhere to the standards outlined in this privacy policy, ensuring I collect and process personal information lawfully, fairly, transparently, and with legitimate, legal reasons for doing so.

California Privacy Laws – CCPA/CPRA

Under California Civil Code Section 1798.83, if you live in California and your business relationship with me is mainly for personal, family, or household purposes, you may ask me about the information I release to other organizations for their marketing purposes. In accordance with your right to non-discrimination, I may offer you certain financial incentives permitted by the California Consumer Privacy Act and the California Privacy Rights Act (collectively, CCPA) that can result in different prices, rates, or quality levels for the goods or services I provide. Any CCPA-permitted financial incentive I offer will reasonably relate to the value of your personal information, and I will provide written terms that describe clearly the nature of such an offer. Participation in a financial incentive program requires your prior opt-in consent, which you may revoke at any time.

Under California Civil Code Section 1798.83, if you live in California and your business relationship with me is mainly for personal, family, or household purposes, you may ask me about the information I release to other organizations for their marketing purposes. To make such a request, please contact me using the details provided in this privacy policy with "Request for California privacy information" in the subject line. You may make this type of request once every calendar year. I will email you a list of categories of personal information I revealed to other organisations for their marketing purposes in the last calendar year, along with their names and addresses. Not all personal information shared in this way is covered by Section 1798.83 of the California Civil Code.

California Notice of Collection

In the past 12 months, I have collected the following categories of personal information enumerated in the CCPA:

  • Identifiers, such as name, email address, phone number, account name, IP address, and an ID or number assigned to your account.

  • Customer records, such as billing and shipping address, and credit or debit card data.

  • Demographics, such as your age or gender. This category includes data that may qualify as protected classifications under other California or federal laws.

  • Audio or visual data, such as photos or videos you share with me or post on the service.

  • Employment and education data, such as data you provide when you apply for a job with me.

  • Inferences, such as information about your interests, preferences and favorites.

  • Sensitive personal information, including behavioral information, IEP/BIP information, progress notes, and medical history, where you provide it in connection with my behavior analysis, coaching, consultation, or assessment services.

For more information on information I collect, including the sources I receive information from, review the "Information I Collect" section. I collect and use these categories of personal information for the business purposes described in the "Collection and Use of Information" section, including to provide and manage my Service.

I do not sell your personal information. I do not share your personal information for cross-context behavioral advertising. I do not use or disclose sensitive personal information for purposes other than those permitted by the CCPA/CPRA without your consent.

Your California Privacy Rights

If you are a California resident, you have the right to:

  • Know the categories and specific pieces of personal information I have collected about you, the categories of sources, the business or commercial purposes for collecting or selling it, and the categories of third parties with whom I share it.

  • Delete personal information I have collected from you, subject to certain exceptions.

  • Correct inaccurate personal information I hold about you.

  • Opt out of the sale or sharing of personal information. I do not sell or share your personal information.

  • Limit the use and disclosure of sensitive personal information. I only use sensitive personal information as permitted by the CCPA/CPRA.

  • Non-discrimination for exercising your privacy rights.

To exercise any of these rights, please contact me using the details provided in this privacy policy. I will verify your request using the information you provide, and I may ask for additional information to confirm your identity.

You may also designate an authorized agent to make a request on your behalf, subject to verification.

Right to Know and Delete

You have rights to delete your personal information I collected and know certain information about my data practices in the preceding 12 months. In particular, you have the right to request the following from me:

  • The categories of personal information I have collected about you;

  • The categories of sources from which the personal information was collected;

  • The categories of personal information about you I disclosed for a business purpose or sold;

  • The categories of third parties to whom the personal information was disclosed for a business purpose or sold;

  • The business or commercial purpose for collecting or selling the personal information; and

  • The specific pieces of personal information I have collected about you.

To exercise any of these rights, please contact me using the details provided in this privacy policy.

Shine the Light

In addition to the rights discussed above, you have the right to request information from me regarding the manner in which I share certain personal information as defined by applicable statute with third parties and affiliates for their own direct marketing purposes.

To receive this information, send me a request using the contact details provided in this privacy policy. Requests must include "Privacy Rights Request" in the first line of the description and include your name, street address, city, state, and ZIP code.

Contact Me

For any questions or concerns regarding your privacy, you may contact me using the following details:

Esra Nur Altun, BCBA
Nur Support Services
esra@nursupportservices.com