Español

SFAF Website Privacy Policy

SFAF Website Privacy Policy

Effective Date: October 15, 2026

San Francisco AIDS Foundation (SFAF, we, us, or our) is a California nonprofit public benefit corporation. This Website Privacy Policy explains how we collect, use, disclose, and protect personal information through sfaf.org and other online services that link to this policy (collectively, the Website).

This policy covers information collected through the Website, including cookies, analytics, newsletter subscriptions, donations, event registrations, job applications, and general website forms.

This policy does not describe how San Francisco AIDS Foundation or its wholly owned subsidiary, Strut SFAF LLC, doing business as SFAF Pharmacy, uses or discloses protected health information when providing health care or pharmacy services. Those practices and patient rights are described in our Notice of Privacy Practices at https://www.sfaf.org/notice-of-privacy-practices/.

Do not submit medical information, test results, prescription information, or other sensitive health information through a general website form or email address unless the page specifically states that it is intended for that purpose. Use the patient portal or another method provided by our clinical staff.

3.1 Information You Provide

We may collect information that you provide when you subscribe to communications, make a donation, register for an event, apply for a position, volunteer, submit a general inquiry, or complete another Website form. Depending on the activity, this may include your name, contact information, organization, communication preferences, donation or transaction information, employment information, and the contents of your message.

Payment card and bank information may be collected and processed by our payment processors and fundraising platforms. Their processing is governed by their own privacy terms and our agreements with them.

3.2 Information Collected Automatically

When you use the Website, we and our service providers may automatically collect:

• Internet Protocol (IP) address;
• browser, operating system, and device information;
• referring and exit pages;
• dates, times, and duration of visits;
• pages, links, and features used;
• approximate location derived from an IP address; and
• cookie, pixel, and similar technology identifiers.

We use cookies and similar technologies to operate the Website, remember settings, understand Website use, improve performance, maintain security, and support outreach about SFAF programs and events.

Our cookie consent widget allows you to accept or reject nonessential cookies. Nonessential analytics and advertising technologies do not load unless you accept the relevant category. You can change your selection at any time through the Cookie Settings link displayed on the Website. Essential cookies cannot be disabled because they are necessary for security and core Website functions.

We may use analytics services, including Google Analytics, to understand how visitors use the Website. We may use advertising technologies from Meta (Facebook and Instagram) and X on donation, fundraising, event, advocacy, or general information pages. These technologies load only after the visitor accepts advertising cookies. We do not use advertising pixels on pages concerning health services, appointments, pharmacy services, billing, patient rights, the Notice of Privacy Practices, or Spanish-language versions of those pages.

Browser-based Do Not Track signals are not consistently recognized across the industry. We respond to choices made through our cookie consent widget. Where applicable law requires recognition of another browser-based preference signal, we will process that signal as required.

We may use Website information to:

• operate, secure, maintain, and improve the Website;
• respond to questions and requests;
• process donations and event registrations;
• send communications requested by the visitor;
• administer volunteer and employment applications;
• understand Website use and evaluate outreach;
• prevent fraud, misuse, and security incidents;
• comply with legal obligations and enforce applicable terms; and
• support SFAF’s mission, programs, advocacy, and fundraising.

We may disclose Website information in the following circumstances:

6.1 Service Providers: To vendors that provide website hosting, security, analytics, payment processing, fundraising, constituent relationship management, email delivery, event administration, recruiting, technical support, and data storage. These vendors may use information only to provide services to us or as otherwise permitted by their agreements and applicable law.

6.2 SFAF-Related Entities: To Strut SFAF LLC, doing business as SFAF Pharmacy, when necessary for the Website activity requested by the visitor and subject to applicable privacy requirements.

6.3 Legal and Safety Purposes: When we reasonably believe disclosure is necessary to comply with law or legal process; protect the rights, property, or safety of SFAF, Website visitors, or others; investigate fraud, misuse, or security incidents; or establish, exercise, or defend legal claims.

6.4 Organizational Transactions: In connection with a merger, reorganization, financing, transfer of assets, or similar organizational transaction, subject to appropriate confidentiality and privacy protections.

6.5 With Your Direction or Consent: For another purpose that we disclose when requesting the information or with your direction or consent.

We do not sell personal information for money. Our use of advertising technologies is described in Section 4 (Cookies, Analytics, and Advertising Technologies) and is controlled through the cookie consent widget.

You may unsubscribe from marketing or informational email by using the unsubscribe link included in the message. You may also contact privacyofficer@sfaf.org to manage your email preferences. Transactional, service-related, or legally required messages may not include an unsubscribe option.

If you enroll in text messages, the applicable form or message will explain how to opt out. We do not sell mobile numbers or text-message consent information.

You may:

• change cookie choices through the Cookie Settings link on the Website;
• unsubscribe from marketing email;
• opt out of text messages as instructed in the message; and
• ask about, correct, or request deletion of personal information submitted through the Website.

We will consider requests under applicable law and our retention obligations. We may need to verify your identity before completing a request. Some information may be retained to complete transactions, maintain security, comply with law, resolve disputes, or preserve required records.

Website-information requests may be submitted to privacyofficer@sfaf.org. Requests concerning patient health information should be made under the Notice of Privacy Practices at https://www.sfaf.org/notice-of-privacy-practices/.

We retain Website information only for as long as reasonably necessary for the purposes described in this policy, including providing requested services, maintaining security, meeting legal and accounting obligations, resolving disputes, and enforcing agreements.

When retention is no longer required, we delete, destroy, or de-identify the information consistent with applicable requirements and our retention practices.

We use reasonable administrative, technical, and physical safeguards designed to protect Website information from unauthorized access, use, alteration, and destruction.

No website, Internet transmission, or electronic storage system can be guaranteed to be completely secure. If a security incident triggers a legal notification duty, we will provide notice as required by applicable law.

The Website is not directed to children under 13, and we do not knowingly collect personal information online from children under 13. A parent or guardian who believes a child submitted information through the Website may contact us to request its deletion.

This section concerns general Website use. California law allows minors to consent to certain health services. Information arising from those services is governed by the Notice of Privacy Practices and applicable health privacy laws.

The Website may link to third-party websites, scheduling systems, social media platforms, fundraising services, or telehealth providers. These third-party services are not operated or controlled by SFAF. A third party’s own privacy policy governs information collected directly by that third party.

SFAF is not responsible for the privacy practices, content, or security of any third-party website or service. We encourage visitors to review the applicable privacy policy before submitting information to any third party, even when the link originates from the Website.

SFAF is based in the United States. Website information may be processed in the United States and in other locations where our service providers operate. Those locations may have privacy laws that differ from those in a visitor’s home jurisdiction. Where applicable law requires safeguards for a cross-border transfer of personal information, we will use appropriate safeguards as required by that law.

We may update this policy periodically. We will post the updated policy on the Website with a revised effective date. Where required by applicable law, we will provide additional notice or obtain consent before a material change applies to information previously collected.

We encourage visitors to review this policy each time they use the Website to stay informed about our information practices.

For questions or requests about this Website Privacy Policy, contact:

Privacy Officer
San Francisco AIDS Foundation
940 Howard Street
San Francisco, CA 94103
Email: privacyofficer@sfaf.org
Phone: (415) 487-3000

For questions about patient health information, review the Notice of Privacy Practices at https://www.sfaf.org/notice-of-privacy-practices/.