Privacy Policy – C.A.T Center (Laboratory-Guided Autism Support)
Last updated: October 2025
This page is intended to explain how we collect, store, use and protect personal information of visitors and users of the website natautism.com, and the privacy policy terms detailed below constitute an integral part of the website’s Terms of Use.
Database owner (Controller): C.A.T Center, Israel.
For any questions, requests, or complaints regarding this Privacy Policy, please contact us at: ben-arie@natautism.com
1) Information We Collect
Contact details voluntarily provided when contacting us or scheduling a meeting (for example via Calendly) may include one or more of the following: full name, email address, telephone number, child’s name and date of birth, and the content of the message. It is hereby clarified that there is no legal obligation on the user to provide their details, and the provision of information depends on their will and consent.
The user declares and undertakes that all information provided by them is true, reliable and accurate, and undertakes to provide only information that they are entitled to provide and for which they have obtained the authorization of all competent parties to permit the provision of such information.
Providing details is not mandatory and depends on your will and consent; however, failure to provide contact details will prevent us from contacting you.
Basic technical data for security and operation: IP address, device/browser type, preferred language, pages viewed, as well as the use of various types of cookies (functional, analytical and marketing), as detailed in the Cookies section below.
We do not request or store medical records, test results or sensitive health information on the website. Please avoid sending sensitive medical information in the forms.
2) Purposes of Processing Personal Data
Compliance with legal and regulatory requirements; offering and providing services to customers; marketing and advertising activities; improving the customer experience and offering tailored value; information security and fraud prevention; provision of technical support and maintenance; conducting statistical analyses and data processing; generating insights and decision-making; business development; handling inquiries and providing required reports to customers and authorities; operating suppliers; conducting quality assurance, control and audit checks; backing up and retaining information; responding to an inquiry and scheduling an introductory meeting; operation, security and improvement of the user experience (including prevention of spam/fraud); responding to inquiries and managing records with active customers; as well as any additional use required for the company’s purposes, at its discretion.
3) Legal Basis for Processing
Explicit consent (submission of details via forms / Calendly); legitimate interest (responding to an inquiry, operating and securing the website); performance of a contract/provision of services (active customers); and legal obligation (record-keeping and compliance).
Withdrawal of consent shall not affect the lawfulness of processing carried out prior to such withdrawal.
4) Roles of the Parties
For the purpose of scheduling meetings, the C.A.T Center is the Controller of the data provided, and Calendly acts as a Processor in accordance with its DPA. When accessing a calendly.com widget/booking page directly, Calendly may also act as an independent Controller in accordance with its own policy and cookie preferences.
Contact details are stored on Calendly’s servers. Storage outside Israel is possible (European Union / USA), subject to recognized frameworks (GDPR / EU-US DPF / SCC). It is hereby clarified that Calendly is an independent company – you must carefully read the company’s policy and ensure that you accept its terms before leaving details via the appointment booking system provided by them, including, but not limited to, the storage and/or retention and/or deletion of information stored on the company’s servers.
5) Data Storage, Location, and Retention
Information is retained for the periods required in order to achieve the purposes set out in this policy, and subject to the requirements of the law. As a rule, information relating to relationships with customers may be retained for up to 7 years after the end of the relationship, or for a longer period if required by law.
Periodic review: we conduct an annual review to delete or anonymize information that is no longer needed, in accordance with the principle of data minimization.
It is hereby clarified that although the company acts to secure the information by taking commonly accepted security measures, it may not necessarily be able to completely prevent disruptions, intrusions or unauthorized access to the information.
6) Data Sharing and Disclosure
We do not sell, rent or trade personal information. For the purpose of providing the service, we may disclose information to the following categories of recipients, for the purposes described:
Authorities and competent bodies when we are required to do so by law/order (for example, handling legal violations, fraud prevention, compliance with regulatory obligations).
Service and infrastructure providers (such as hosting services, appointment scheduling systems, email services and security infrastructures) – for the purpose of operating the website and providing the service.
We do not knowingly collect personal information from children under the age of 18 without parental consent. If such data has been collected inadvertently, it will be promptly deleted upon request.
Professional advisers (legal/accounting/information security), where necessary and for compliance/risk management purposes.
We may use third-party service providers such as Google Analytics, Google Ads, Meta (Facebook) Ads, Reddit Ads, email service providers, website hosting services (including SiteGround), CDN services, and scheduling platforms such as Calendly, for the operation, analytics, marketing, and security of the website.
7) Cookies and Embedded Third-Party Services
When a user visits the website, certain data is automatically transmitted to us. This data may include, among other things, the URL of the page the user is visiting, IP address, time of visit, whether the user is a returning visitor, and characteristics of the device and browser, as well as date and time.
Monitoring activity on the website helps us improve the service, tailor it to the user, and maintain information security.
As part of the provision of online services through the relevant communication channels, we use various software and technologies based, among other things, on Cookies, Tags, Pixels and similar, alternative or equivalent technologies (collectively – “Cookies”) for the use described above. There may be additional use in the future of similar technologies.
This may include the use of Cookies originating from, or used by, third parties, including services such as Google Analytics, Meta, all in accordance with the terms of use and privacy policies of those third parties.
The user may, at any time, change or revoke the use of Cookies on the website via the browser or device settings. However, blocking some cookies may result in certain services on the website – in whole or in part – not functioning properly.
With respect to Cookies originating from third parties, their removal or management is subject to the terms of use and privacy policies of those parties, as published on their websites.
8) Scope of This Policy & Third-Party Services
This policy applies to natautism.com only. Use of third-party components/services (Calendly and similar) is also subject to the privacy and cookie policies of that provider.
9) Aggregated / Anonymous Data
We may process information in encrypted/aggregate/anonymous form for statistical purposes, process improvement, security and monitoring. Such information does not identify an individual and is not subject to privacy protection laws.
10) Your Rights and Privacy Preferences
Subject to applicable law, you have the following rights: the right to access information (Section 13 of the Law), the right to rectify information (Section 14), deletion (in appropriate cases), restriction of processing, data portability (where applicable), objection to processing based on legitimate interest, and withdrawal of consent.
We aim to respond to requests within 30 days, and we may request reasonable identity verification. We will maintain minimal records of the request for compliance purposes.
You have the right to file a complaint with a competent data protection authority in your country of residence if you believe that your privacy rights have been violated.
11) Information Security & Breach Notifications
We implement SSL encryption, access controls and reasonable technical and organizational measures. No internet system is completely immune; in the event of a material security incident, we will act in accordance with the law, including notifying authorities and data subjects where required.
12) Children
The website is intended for parents/guardians. We do not knowingly collect information directly from minors. If information about a minor has been provided without lawful consent, please contact us so that it can be deleted.
13) Automated Decision-Making & AI
We do not make automated decisions that have legal or similarly significant effects on users. There may be basic automated mechanisms for security, spam detection and proper functioning of the website.
14) Changes to This Policy
Updates may be made from time to time. In the event of a material change, the updated version will be published here and will take effect upon its publication.
15) Accounting, Invoicing, and Payments
For the purpose of issuing invoices/receipts, maintaining financial records and complying with the law, we use accounting services/a system for issuing documents. Identification/contact details, billing document details and payment records will be processed.
When paying online, payment method details are processed directly by the payment processing provider (credit card company) / invoicing provider (Morning – Green Invoice). You must review the privacy policies of these companies before providing any payment method; we do not store credit card details on the website. Processing is based on legal obligation, legitimate interest and performance of a contract, and the data will be stored for up to 7 years after the end of the relationship and will then be deleted or anonymized. The provider’s privacy policy applies to its services. Data may be processed outside Israel (for example in the European Union and/or USA), all in accordance with applicable law and the privacy policies of the relevant service providers