The Jehovah Jireh Community Development Center Inc. ("The JJ Center," "we," "us," or "our") is a 501(c)(3) nonprofit organization located in Ward 8, Washington, DC, founded in 2005. Our mission is to serve our community through free food distributions and health education programs grounded in the principle of "food as medicine."
This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our website at jjcenter.org, our member portal, our mobile application, or interact with us in person at our food pantry events.
Questions about this policy?
Contact our Privacy Team at hello@jjcenter.org. All privacy requests are handled by our operations team and reviewed by JJ Center leadership.
Section 2
What Information We Collect
Information You Provide Directly
Account registration: First name, last name, email address, and password when you create a member account.
Walk-in pantry visits: Name, ZIP code, household size, and optionally email address or phone number when you check in at our welcome desk.
Health program opt-in (voluntary only): Health topics of interest and any health-related information you choose to share with our health professionals. This information is entirely optional and is never required to use our services or receive food assistance.
Communications: Messages or feedback you send to us.
Information Collected Automatically
Visit logs: Date and time of each pantry visit when you check in using our QR system.
Device information: Browser type, operating system, and IP address for security purposes.
Usage data: Pages viewed and features used within your member dashboard.
Information We Do NOT Collect
Social Security numbers or government ID numbers
Financial information or payment data
Immigration status
Race, ethnicity, or national origin (unless voluntarily shared for program purposes)
🔒 HIPAA Notice — Health Information
Any health-related information you share is collected under your explicit consent only, is governed by HIPAA's Privacy Rule (45 CFR Part 164), and is handled with the highest level of protection. You may withdraw consent at any time without affecting your access to our food pantry or other services.
Section 3
How We Use Your Information
We use the information we collect only to:
Operate and maintain your member account and dashboard
Log and display your pantry visit history
Send notifications about pantry events, schedule changes, and program updates (only if you opt in)
Deliver personalized health education content and videos from our medical professionals (only if you opt into the health program)
Post community announcements from JJ Center leadership to your dashboard feed
Measure and report our community impact using anonymous, aggregate statistics — individual data is never published
Maintain the security of our systems and prevent fraud
Comply with applicable federal and DC laws
Support grant reporting requirements (anonymous aggregate data only)
We will never use your information to discriminate against you, sell advertising, or share data with any party for commercial purposes.
Section 4
Protected Health Information (HIPAA)
The JJ Center operates in compliance with the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and its implementing regulations, including the Privacy Rule (45 CFR Part 164) and the Security Rule (45 CFR Part 164, Subpart C).
What Is Protected Health Information (PHI)
PHI is any information that both (a) relates to your health condition, treatment, or payment, and (b) could be used to identify you. At the JJ Center, PHI is only created when you voluntarily opt into our health program and share health-related information in combination with your identity.
How We Handle PHI
PHI is stored in a separate, encrypted database table with access restricted to authorized health professionals and administrators only
All staff and volunteers who may access PHI have signed HIPAA confidentiality agreements
PHI is never shared with any third party without your explicit written consent, except as required by law
PHI is retained for a minimum of 6 years from the date of creation, as required by HIPAA
You have the right to access, amend, and request deletion of your PHI at any time
Breach Notification
In the event of a breach of unsecured PHI, we will notify affected individuals without unreasonable delay, and no later than 60 calendar days from the discovery of the breach. Breaches affecting 500 or more individuals will also be reported to the U.S. Department of Health & Human Services (HHS) Office for Civil Rights.
⚠️ Your Health Opt-In Is Always Voluntary
Opting into the health program is completely voluntary. Choosing not to participate will never affect your ability to receive food assistance or any other JJ Center services. You may withdraw from the health program at any time by visiting your dashboard or contacting us at hello@jjcenter.org.
Section 5
How We Protect Your Data (NIST)
The JJ Center implements security controls aligned with the NIST Cybersecurity Framework (CSF) and NIST Special Publication 800-53 (Security and Privacy Controls for Information Systems). Our security program includes:
Technical Safeguards
Encryption at rest: All data stored using AES-256 encryption via Supabase (AWS infrastructure)
Encryption in transit: All data transmitted using TLS 1.3
Access control: Role-based access control (RBAC) — members see only their own data; supervisors see only what their role requires
Authentication: Secure password requirements, email verification, and optional two-factor authentication (2FA) via SMS
Session management: Automatic session timeout after 30 minutes of inactivity
Audit logging: All access to sensitive data is logged with timestamp, user identity, and action performed
Administrative Safeguards
HIPAA training required for all staff and volunteers before accessing any member data
Annual security review conducted each June
Minimum necessary access principle — personnel only access data required for their specific role
Immediate access revocation upon staff or volunteer departure
Physical Safeguards
No sensitive member data stored on physical devices or paper records
All data is cloud-hosted with Supabase (SOC 2 Type II certified infrastructure)
Welcome desk tablets are secured and require login before use
ℹ️ NIST Framework Alignment
Our controls map to the NIST CSF functions: Identify, Protect, Detect, Respond, and Recover. A full technical safeguards checklist is maintained internally and reviewed annually by the System Administrator and CEO.
Section 6
Email Communications (CAN-SPAM)
The JJ Center complies with the CAN-SPAM Act of 2003 (15 U.S.C. § 7701 et seq.). All commercial and promotional emails we send will:
Clearly identify The JJ Center, Inc. as the sender
Include our organization name: The Jehovah Jireh Community Development Center Inc.
Include a clear and conspicuous unsubscribe mechanism in every email
Honor all unsubscribe requests within 10 business days
Never use deceptive subject lines or sender information
Types of Emails We Send
Transactional: Account confirmation, password reset, visit confirmation — these are required for account operation and cannot be unsubscribed from while your account is active
Pantry notifications: Event reminders and schedule changes — opt in/out in your dashboard at any time
Health content: Personalized health tips and video recommendations — only if you opt into the health program
Announcements: Updates from JJ Center leadership — only sent to active member accounts
Walk-in invitation: A one-time account creation invitation sent after your first pantry visit if you provide your email — you may decline with no consequence
Unsubscribe
You may unsubscribe from any non-transactional emails at any time by:
Clicking the "Unsubscribe" link at the bottom of any email
Updating your notification preferences in your member dashboard
Emailing us at hello@jjcenter.org with "Unsubscribe" in the subject line
Section 7
Third Parties & Data Sharing
The JJ Center does not sell, rent, trade, or share your personal information with third parties for marketing or commercial purposes — ever.
Service Providers
We use the following service providers to operate our platform. All are bound by confidentiality agreements and may only use your data to perform services for us:
Supabase (database and authentication) — U.S.-based, SOC 2 certified; a HIPAA Business Associate Agreement (BAA) is in place
Vercel (website hosting) — U.S.-based; no user data is stored
Google Workspace (email and operations) — a HIPAA BAA is in place; PHI is never sent via email
Required Disclosures
We may disclose your information only when required by law, including:
In response to a valid subpoena, court order, or government request
To report a HIPAA breach to HHS as required by federal law
To protect the safety of any person in an emergency situation
Section 8
Your Rights
You have the following rights regarding your personal information and PHI:
Your Right
What It Means
How to Exercise It
Access
See all information we hold about you
Log in to your dashboard or contact us at hello@jjcenter.org
Correction
Fix any inaccurate information
Update in your dashboard or contact us
Deletion
Delete your account and all associated data
Contact us at hello@jjcenter.org — processed within 30 days
Withdraw Consent
Stop participating in the health program at any time
Toggle off in your dashboard — immediate effect
Data Portability
Receive a copy of your data in a readable format
Contact us at hello@jjcenter.org — delivered within 30 days
Complaint (HIPAA)
File a complaint if you believe your privacy rights were violated
Contact HHS OCR at hhs.gov/ocr or call 1-800-368-1019
We will never retaliate against you for exercising any of these rights. All requests are processed within 30 days.
Section 9
Children's Privacy
Our member portal and mobile application are intended for individuals 13 years of age and older. We do not knowingly collect personal information from children under 13 without verifiable parental consent, in compliance with the Children's Online Privacy Protection Act (COPPA).
Individuals under 18 may use our food pantry services and have an account created by a parent or guardian. If you believe we have inadvertently collected information from a child under 13, please contact us immediately at hello@jjcenter.org and we will delete the information promptly.
Section 10
Data Retention
Account data (name, email): Retained until you delete your account
Visit history: Retained for 3 years for program reporting purposes
Protected Health Information (PHI): Retained for a minimum of 6 years from the date of creation, as required by HIPAA
Walk-in records (no account): Retained for 2 years for impact reporting, then permanently deleted
Security and audit logs: Retained for 6 years
HIPAA confidentiality agreements: Retained for duration of service plus 3 years
When data is deleted, it is permanently and irreversibly removed from all systems, including backups, within 90 days.
Section 11
Mobile App
The JJ Center mobile application (currently in development) will use the same Supabase backend and apply identical privacy protections as described in this policy. The app will:
Request only the permissions necessary for its features (camera for QR scanning, notifications if you opt in)
Never access your contacts, location, microphone, or photos without explicit permission
Operate under the same session timeout and 2FA protections as the web portal
Be available on iOS (App Store) and Android (Google Play), both of which require and have reviewed this Privacy Policy
This Privacy Policy URL (jjcenter.org/privacy.html) is the policy submitted to Apple App Store and Google Play Store for app review and approval.
Section 12
Changes to This Policy
We review and update this Privacy Policy annually each June, or sooner if required by changes in law or our data practices. When we make material changes, we will:
Update the "Last Updated" date at the top of this page
Send a notification to all active member accounts via email
Post a notice in the member dashboard for 30 days
Your continued use of our services after the effective date of a revised policy constitutes your acceptance of the updated policy. If you do not agree with the changes, you may delete your account at any time.
Section 13
Contact Us
For any questions, requests, or concerns regarding this Privacy Policy or our data practices:
Privacy Team
The Jehovah Jireh Community Development Center Inc. All privacy requests are reviewed by JJ Center leadership.