Privacy Policy

Effective date: July 10, 2026

This Privacy Policy describes how the Chicago College of Oriental Medicine (“CCOM”, “we”, “us”) collects, uses, and shares information about visitors to www.ccom.edu and its subdomains (the “Site”). By using the Site, you agree to the practices described here.

Note to CCOM staff: This is a working starter policy that reflects the technical practices currently in place on the Site. It has not been reviewed by legal counsel. Before treating it as authoritative, please have it reviewed by an attorney familiar with U.S. education-sector privacy and applicable state, federal, and international regulations (CCPA/CPRA, FERPA, GDPR).

Information we collect

Information you provide

You provide information to us when you submit any form on the Site. That includes:

• Application for Admission (/admissions/apply-online/) — full application information including your legal name, contact details, permanent and current addresses, date of birth, U.S. citizenship or visa status, prior enrollment, education level, emergency contact, financial information, references, ethnic background, felony history, essay, and how you heard about CCOM.
• Request Information form (/admissions/request-info/) — your name, email, phone, program of interest, applicant type, target enrollment, and any message you write.
• Contact form (/contact/) — your name, email, phone, and message.
• Transcript Request form (/student-services/request-transcript/) — student information needed to fulfill the transcript request.

We use this information solely to respond to your inquiry, evaluate your application, communicate with you about your enrollment or request, and (with your explicit consent on forms that require it) to send you information about our programs. We do not sell your information to third parties.

Information collected automatically

When you visit the Site, our infrastructure and analytics providers automatically collect certain technical information:

• Server logs — your IP address, browser type and version, operating system, the pages you view, the time and date of your visit, and referring URLs. Handled by Cloudflare on our behalf.
• Cookies and pixels — see the “Cookies and Tracking” section below.

Third-party services we use

Running the Site depends on a small number of third-party services. Each has its own privacy policy that governs what they do with your data:

We do not share the contents of form submissions with any advertising, marketing, or data-broker service. Form submissions travel from your browser to Cloudflare, from Cloudflare to Resend, and from Resend to the CCOM Outlook inbox.

Cookies and tracking

The Site uses the following cookies and pixels:

• Meta Pixel — a JavaScript tracker from Meta (Facebook) that records when you visit the Site. This lets us measure the effectiveness of our advertising and show follow-up ads to visitors on Meta platforms. The pixel sets cookies from facebook.com.
• Google Analytics 4 — will be added shortly. Records anonymized page-view analytics. Uses the _ga and _gid cookies. We have configured Google Analytics with allow_google_signals: false and allow_ad_personalization_signals: false to minimize the data shared with Google.
• Cloudflare Turnstile — sets a short-lived cookie during the anti-spam check on our forms.

How to opt out of tracking

• Meta Pixel opt-out — you can adjust your ad preferences at facebook.com/settings/?tab=ads, or use the Meta Pixel opt-out via the Digital Advertising Alliance at optout.aboutads.info.
• Google Analytics opt-out — install the Google Analytics opt-out browser add-on.
• Browser-level “Do Not Track” — most modern browsers offer settings that block third-party cookies and trackers. We recommend Firefox with “Enhanced Tracking Protection” set to Strict, or Safari with Intelligent Tracking Prevention enabled.
• Browser extensions — uBlock Origin, Privacy Badger, and DuckDuckGo Privacy Essentials all block Meta Pixel and Google Analytics by default.

If you use any of these opt-outs, the Site will continue to function normally. Only our marketing analytics are affected.

Data retention

• Form submissions are retained in the CCOM Outlook inbox indefinitely until deleted by staff. Application data may become part of your student record if you are admitted; in that case it is retained per our academic records retention policy.
• Server logs at Cloudflare are retained per Cloudflare’s default policies — typically 30 days for the free tier.
• Analytics data at Meta and (when live) Google is retained per each provider’s default retention window — currently up to 26 months for Google Analytics, up to 2 years for Meta.

Your rights and choices

Depending on where you live, you may have specific rights regarding your personal information:

• California residents (under CCPA/CPRA) have the right to know what personal information we collect, request deletion of your personal information, request correction of inaccurate information, and opt out of the sale or sharing of personal information. We do not sell personal information. To exercise these rights, email info@ccom.edu.
• EU/UK residents (under GDPR/UK GDPR) have the right to access, rectify, erase, restrict processing of, port, and object to processing of their personal information. To exercise these rights, email info@ccom.edu.
• All visitors may email info@ccom.edu at any time to request that we delete a form submission you made or correct information you provided.

We will respond to verifiable requests within 30 days.

Children’s privacy

The Site is intended for adults exploring graduate education. We do not knowingly collect information from children under 13. If you believe a child has submitted information to us, please email info@ccom.edu and we will delete it promptly.

International users

CCOM is located in Chicago, Illinois, U.S.A. If you visit the Site from outside the United States, the information you provide is transferred to and processed in the United States. By using the Site, you consent to this transfer.

Security

We use commercially reasonable technical and administrative safeguards to protect the information you share with us — including HTTPS on every page, encrypted email transport, and access controls on the CCOM Outlook inbox. No system is perfectly secure. If you believe your interaction with the Site has been compromised, please email info@ccom.edu promptly.

Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices or in applicable law. The “Effective date” at the top of this page shows when it was last updated. Substantive changes will be announced on the Site.

Contact us

Questions or requests regarding this policy or how we handle your information should be directed to:

Chicago College of Oriental Medicine 180 N Michigan Avenue, Suite 1919 Chicago, Illinois 60601 Email: info@ccom.edu Phone: (312) 368-0900