Confidentiality & Privacy Policy

Introduction

At In Therapy, we recognize that sharing personal information requires courage and trust. This Confidentiality & Privacy Policy outlines how we collect, use, store, and protect your health information in compliance with applicable privacy laws, including HIPAA (in the United States) and relevant regional data protection regulations.

By engaging our services, you acknowledge that you have read, understood, and agreed to the terms outlined in this policy. Our commitment to your privacy extends beyond legal requirements—it is central to our therapeutic ethos.

What We Collect

To provide effective, personalized care, we collect and maintain certain personal and health information, including:

• Identifying Information: Full name, date of birth, address, phone number, email, and emergency contact details.
• Clinical Information: Medical history, mental health history, current medications, therapy notes, progress reports, and assessment results.
• Administrative & Financial Data: Insurance details, billing information, payment records, and session attendance logs.
• Technical Data: For online clients, IP addresses, device information, and platform usage logs to ensure secure and uninterrupted sessions.

We only collect information necessary for treatment, payment, and healthcare operations. You have the right to decline providing certain information, though this may limit the effectiveness of your care.

How We Protect Your Information

Your privacy is safeguarded through strict administrative, physical, and technical measures:

• Encrypted Storage: All digital records are stored on HIPAA-compliant, end-to-end encrypted servers with multi-factor authentication.
• Access Controls: Only your assigned treatment team members have authorized access to your file. Access is logged and audited regularly.
• Secure Communication: Video sessions occur on encrypted, SOC2-compliant platforms. Emails and messages use secure, clinical-grade messaging systems.
• Physical Security: Paper records (if any) are kept in locked cabinets within restricted-access offices. All printed materials are shredded when no longer needed.
• Staff Training: All clinicians and administrative staff complete annual privacy and security training, and sign confidentiality agreements.

Exceptions to Confidentiality

While confidentiality is a cornerstone of therapy, the law and ethical guidelines require or permit disclosure in specific circumstances:

• Imminent Harm: If you pose a serious, imminent threat of harm to yourself or others, we may break confidentiality to ensure safety.
• Abuse or Neglect: We are mandatory reporters and must disclose suspected abuse or neglect of children, elders, or vulnerable adults to appropriate authorities.
• Court Orders: We may release information if legally compelled by a valid court order or subpoena, though we will notify you first when legally permitted.
• Client Authorization: With your written consent, we may share information with other healthcare providers, insurers, or third parties for coordinated care.
• Professional Consultation: Clinicians may discuss cases with supervisors or consultants to ensure quality care, without revealing identifying information unless necessary and consented to.

Your Rights & Choices

You have the right to:

• Access & Review: Request a copy of your clinical records and billing information within 15 business days.
• Amend: Request corrections to incomplete or inaccurate information in your file.
• Restrict Use: Request limitations on how your information is used or shared (subject to legal and operational requirements).
• Receive an Accounting: Request a log of certain disclosures of your information made without your authorization.
• Revoke Consent: Withdraw previously given authorizations for information sharing at any time, in writing.
• File a Complaint: Contact our Privacy Officer or file a complaint with the relevant regulatory body if you believe your privacy rights have been violated.

Data Retention

We retain your clinical records in accordance with state and federal regulations, typically for 7–10 years after your last session or until the age of majority plus 7 years for minors, whichever is longer. After the retention period, records are securely destroyed using certified data erasure or cross-cut shredding methods.

You may request early deletion, though we may be legally required to retain certain administrative or billing records.

Contact & Complaints

If you have questions about this policy, wish to exercise your rights, or have concerns about how your information is handled, please contact our Privacy Officer:

• Email: privacy@intherapy.com
• Phone: (555) 123-4567
• Mail: In Therapy, Privacy Department, 123 Wellness Blvd, Suite 200, NY 10001

We respond to all privacy inquiries within 5 business days. No retaliation or adverse treatment will occur for exercising your privacy rights.