Privacy Policy

Who we are

ESA Verified operates this website and the service it describes. If you have a privacy question or want to exercise a right below, contact us or email privacy@esaverified.com.

Information you give us

• Contact details: your name, email address, and (if you choose to provide it) phone number.
• Assessment responses: your housing situation and, in your own words, how an emotional support animal supports you. This is health-related and we treat it as sensitive information.
• Your animal: its name and species.
• Consent record: which acknowledgements you accepted, when, the policy version, and the IP address you accepted them from.
• Messages: anything you send us through the contact or "ask a question" forms.
• Clinicians who apply to review cases give us their name, email, license state and number, NPI (optional), and an attestation that the details are accurate.

Information collected automatically

• Payment status: our payment processor tells us whether a payment succeeded, the amount, and a reference id. We never receive or store your full card number.
• Verification lookups: when anyone checks a letter on our public register, we log the ESA ID entered, the result, the time, and the requester's IP address and browser user-agent. This protects the register from scraping and abuse and creates an audit trail.
• Security logs: short-lived records used for rate-limiting and abuse prevention, which include IP addresses and timestamps.

Cookies and local storage

We keep this deliberately minimal:

• Session cookie (esa_session): set only after you sign in to a portal. It is strictly necessary to keep you signed in, is HTTP-only and Secure, and is not used for tracking.
• Theme preference: stored in your browser's local storage to remember light or dark mode. It never leaves your device.

We do not use analytics, advertising, or cross-site tracking cookies, and we do not run third-party trackers. Because we only use strictly-necessary and functional storage, there is no consent banner. If you begin a payment, our payment processor may set its own cookies on its checkout page under its own policy. Your browser's Do Not Track / Global Privacy Control signal is respected; we have nothing to opt out of because we do not sell or share personal information.

How we use your information

• Route your assessment to a licensed clinician in your state.
• Let that clinician review it and, if appropriate, issue a letter.
• Operate the public verification register.
• Process your payment and issue refunds.
• Send you transactional email: order confirmation, receipt, "letter ready", and a one-time reminder before your letter expires.
• Respond to your messages.
• Prevent fraud and abuse, and keep records we are required to keep.

Where the law requires a legal basis, we rely on performing our contract with you, your consent (for processing the sensitive assessment information and for any marketing), and our legitimate interest in security and record-keeping.

The public verification register

For any letter issued to you, the register shows only: the ESA ID, your animal's name and species, the issue and expiry dates, and the current status (valid, expired, or revoked). It never shows your name, contact details, assessment answers, or any diagnosis. Consenting to this listing is a condition of receiving a letter, because a letter that cannot be verified has little value to a housing provider.

Marketing

We do not add you to any mailing list automatically. If a newsletter or tips list is offered, it is a separate, unchecked opt-in, and every such message has a one-click unsubscribe. Unsubscribing does not stop transactional email about your own assessment or letter.

Who we share it with

We do not sell your personal information and we do not "share" it for cross-context behavioral advertising. We disclose it only to:

• The reviewing clinician, who needs your assessment to make a clinical decision.
• Service providers acting on our instructions, meaning our payment processor (Stripe), email delivery, and hosting/database infrastructure (Cloudflare). They may use your data only to provide those services to us.
• Authorities, if required by law or to protect someone's safety or our legal rights.
• A successor, if the business is merged or acquired, in which case this policy continues to apply.

How long we keep it

• Assessment and letter records are kept for as long as applicable clinical record-keeping rules require, generally at least seven years, then deleted or de-identified.
• Verification-lookup logs are kept for up to 24 months.
• Security and rate-limit logs are kept for a matter of days.
• Contact and "ask" messages are kept for up to 24 months unless they relate to an ongoing matter.

Security

Data is encrypted in transit. Access to assessment content is limited to the reviewing clinician and support staff, and every staff action on a record is logged. No system is perfectly secure, but we design for data minimization and least-privilege access.

Your rights

Depending on where you live, you may have the right to: know what we hold about you and get a copy; correct it; delete it; receive it in a portable format; limit how we use sensitive information; withdraw a consent; and not be discriminated against for exercising a right. We do not sell or share personal information, so there is nothing to opt out of on that front.

To make a request, email privacy@esaverified.com or use the contact form. We will verify your identity and respond within 45 days (extendable once, with notice). An authorized agent may submit a request with your written permission. Some requests are limited by record-keeping obligations. For example, we may retain a record of an issued or revoked letter even after a deletion request, and the register entry for a still-valid letter remains until it expires or is revoked.

California residents

In the past 12 months we have collected these categories of personal information: identifiers (name, email, phone, IP address); customer records (phone number, payment status); internet activity (verification lookups, security logs); and sensitive personal information (health- related assessment responses). We collected them for the purposes listed above, from you and from our payment processor. We did not sell or share any of it, and we did not use or disclose sensitive personal information for any purpose other than providing the service you requested. You may request the specific pieces of information we hold, and California's "Shine the Light" law lets you ask about disclosures to third parties for their own marketing (we make none).

Children

This service is for adults. You must be at least 18 to submit an assessment. We do not knowingly collect information from anyone under 18; if we learn we have, we delete it.

Changes

If we change this policy we will update the date above and, for material changes, note it on the site. Continued use after a change means you accept the updated policy.