Privacy & Data Protection Policy

1. Introduction & Commitment to Privacy

At In Therapy, your privacy and the confidentiality of your personal and health information are our highest priorities. This Privacy & Data Protection Policy outlines how we collect, use, store, and protect your information in accordance with applicable privacy laws, including HIPAA, GDPR, and CCPA where applicable.

By using our website, booking a consultation, or engaging with our services, you acknowledge that you have read and understand this policy. If you do not agree with the practices described here, please refrain from using our services.

2. Information We Collect

We collect information only when necessary to provide, improve, and secure our therapeutic services. This includes:

• Personal Information: Name, date of birth, contact details (email, phone, address), and emergency contact information.
• Health & Clinical Information: Intake forms, medical history, therapy notes, assessment results, and communication related to your treatment.
• Technical & Usage Data: IP address, browser type, device information, pages visited, and session duration for security and website optimization.
• Communication Records: Emails, chat messages, and phone call logs with our administrative and clinical staff.
• Payment Information: Processed securely through PCI-compliant third-party payment providers. We do not store full credit card numbers.

3. How We Use Your Information

Your information is used strictly for the following purposes:

• Delivering, coordinating, and documenting your therapy and mental health services
• Scheduling appointments, sending reminders, and managing cancellations
• Processing payments and handling insurance billing claims
• Ensuring platform security, preventing fraud, and complying with legal obligations
• Improving our website, services, and client experience through aggregated, anonymized analytics
• Communicating important updates regarding your care, policy changes, or service availability

4. Information Sharing & Disclosure

We do not sell, trade, or rent your personal information. We may share your data only in the following circumstances:

• Healthcare Providers: With your written consent, we may share relevant information with other licensed professionals involved in your care.
• Service Providers: Trusted third parties that assist with secure cloud storage, telehealth platforms, payment processing, and IT infrastructure, all bound by strict confidentiality and data processing agreements.
• Legal Requirements: When required by court order, subpoena, or mandatory reporting laws (e.g., suspected abuse, imminent harm to self or others).
• Insurance & Billing: Necessary information to verify coverage and process claims, limited to what is legally permitted.

5. Data Security & Confidentiality

We implement industry-leading technical and organizational measures to safeguard your information:

• End-to-end encryption for all telehealth sessions and data in transit (TLS 1.3 / AES-256)
• Role-based access controls ensuring only authorized clinical staff can view your records
• Regular security audits, vulnerability scanning, and staff privacy training
• HIPAA-compliant electronic health record (EHR) systems with automatic session timeouts and audit trails
• Physical security measures for any paper records, including locked storage and secure disposal

While we strive to protect your data, no electronic system is 100% secure. We encourage you to use strong passwords and report any suspected security concerns immediately.

6. Your Rights & Choices

Depending on your jurisdiction, you may have the right to:

• Access: Request a copy of your personal and health records
• Correction: Request amendments to inaccurate or incomplete information
• Deletion: Request removal of your data, subject to legal retention requirements for medical records
• Portability: Receive your data in a structured, commonly used format
• Opt-Out: Unsubscribe from marketing communications or limit certain data processing activities
• Complaint: File a grievance with our Privacy Officer or relevant regulatory authority

To exercise these rights, please contact our Privacy Officer using the details in Section 10. We will respond within 30 days as required by law.

7. Cookies & Tracking Technologies

Our website uses essential cookies to maintain session security, remember preferences, and ensure platform functionality. We may also use anonymized analytics cookies to understand site usage and improve navigation. These do not contain personal health information.

You can manage or disable cookies through your browser settings. Please note that disabling essential cookies may affect certain website features, including secure login and appointment scheduling.

8. Children & Minors

Our services are primarily designed for adults and older adolescents. We do not knowingly collect personal information from individuals under 13 without verifiable parental or guardian consent. For clients aged 13–17, we require a signed parental consent form and comply with state-specific minor consent laws regarding mental health treatment.

9. Changes to This Policy

We may update this policy periodically to reflect changes in our practices, technology, or legal requirements. The "Last Updated" date at the top of this page will reflect revisions. Material changes will be communicated via email or a prominent notice on our website. Continued use of our services after updates constitutes acceptance of the revised policy.

10. Contact Us

If you have questions about this Privacy & Data Protection Policy, wish to exercise your rights, or need to submit a privacy request, please contact our Data Protection Officer: