Pamper session requests. When you request a session for yourself or a loved one, we collect the information you provide: the patient’s name, contact details, birthdate, hospital or care location, and style preferences. Requests are signed with an electronic consent: we record the signer’s name and role, an image of the signature, the consent text and version signed, and the date, time, IP address, and device information of the signing — this creates the legal record of consent.

Optional demographics. The request form includes optional questions (age range, gender, ethnicity, and participation in assistance programs). These are entirely optional — you can skip them and it never affects whether we serve you. We use them only in aggregate totals to report our community impact to grantmakers; we do not use them to make decisions about individuals.

Volunteer accounts. If you apply to volunteer or hold a volunteer account, we collect your name, email, phone, application answers, shift signups, and volunteer hours. Passwords are stored only in securely hashed form — we cannot see them.

Donations. Donations are processed by third-party platforms (such as GiveSmart). We never see or store your card or bank details; we receive donor name, contact information, and gift amount for receipting and records.

Website basics. Our marketing website does not use advertising trackers or sell data. Our servers keep standard technical logs (IP address, pages requested) for security and reliability.

We use information solely to run our mission: scheduling and delivering pamper sessions, coordinating volunteers, maintaining the legal record of consent, sending service communications (like volunteer shift reminders), receipting donations, and reporting aggregate — never individual — impact statistics to grantmakers and regulators.

We do not sell personal information. We do not use it for advertising. We do not track you across other apps or websites.

Serving patients in hospitals means some information we handle is sensitive — for example, the fact that a person is receiving care at a particular hospital. We treat all patient information with heightened care: access is limited to the staff and vetted volunteers who need it to deliver the session, and it is never used for marketing. SFTH is a charitable service organization, not a healthcare provider or insurer.

Many of the patients we serve are children. Session requests for a minor must be submitted and signed by a parent or legal guardian. We do not knowingly collect information directly from children under 13. Volunteer accounts are for adults and teens with guardian permission per our volunteer policies.

We share information only with:

• Service providers that help us operate (website hosting, email delivery, donation processing) — bound to use it only on our behalf;
• Hospital partners — only the scheduling details needed to deliver a requested session;
• Legal requirements — if required by law or to protect the safety of patients, volunteers, or the public.

Signed consent records are retained as legal records. Volunteer and request data is kept while relevant to our operations and legal obligations, then deleted. Data is stored on access-controlled servers with encryption in transit (HTTPS everywhere) and is backed up securely.

You may request a copy of your information, ask us to correct it, or ask us to delete it by emailing info@sftheart.org. Volunteers can delete their account directly in the volunteer portal or mobile app (Profile → Delete account); deletion removes your personal details, while anonymized totals (like aggregate volunteer hours) may be retained for nonprofit reporting. Signed patient consent records are retained as required for legal purposes even if other data is deleted.

Questions? Email info@sftheart.org or write to Simply From The Heart, 13 East First Street Unit H, Hinsdale, IL 60521. If we make material changes to this policy, we will update the date above and post the new version here.