Privacy Policy

1. Introduction

At In Therapy, your trust and privacy are our highest priorities. We understand that sharing personal and mental health information requires confidence in how that data is handled. This Privacy Policy explains how we collect, use, store, and protect your information when you use our website, book sessions, or receive therapeutic services.

By accessing our website or using our services, you acknowledge that you have read, understood, and agree to the practices described in this policy.

2. Information We Collect

We collect information to provide safe, personalized, and compliant mental health care. This includes:

• Identifying Information: Name, date of birth, email, phone number, mailing address, and emergency contact details.
• Clinical & Health Data: Session notes, treatment plans, intake forms, mental health history, and progress reports collected during therapy.
• Financial Information: Payment details, insurance information, and billing records processed securely through PCI-compliant third-party processors.
• Technical & Usage Data: IP address, browser type, device information, session duration, and pages visited for website optimization and security.
• Communications: Messages, emails, or chat logs exchanged with our administrative staff or therapists through secure portals.

3. How We Use Your Information

We use your information solely to support your well-being and maintain compliant operations:

• Providing, coordinating, and documenting therapy and counseling services
• Scheduling appointments, sending reminders, and communicating updates
• Processing payments, verifying insurance eligibility, and managing billing
• Improving our website, platform security, and client experience
• Complying with legal obligations, regulatory standards, and professional ethics

4. Confidentiality & HIPAA Compliance

We implement the minimum necessary standard for sharing PHI. Therapists, administrative staff, and authorized vendors are bound by confidentiality agreements and undergo regular training on data privacy and ethical standards.

5. Information Sharing & Disclosure

We do not sell, trade, or rent your personal or health information. We may share data only in the following circumstances:

• With Your Consent: When you explicitly authorize sharing with other providers, family members, or insurance companies.
• Legal Requirements: To comply with court orders, subpoenas, or mandatory reporting laws (e.g., imminent risk of harm, abuse reporting).
• Service Providers: Trusted, contractually bound third parties for payment processing, secure cloud hosting, appointment scheduling, and email communication.
• Emergency Situations: If disclosure is necessary to prevent serious bodily harm or death.

6. Data Security & Protection

We employ industry-standard technical and organizational safeguards to protect your data:

• AES-256 encryption for data at rest and TLS 1.3 for data in transit
• Role-based access controls, multi-factor authentication, and activity logging
• Regular security audits, vulnerability assessments, and employee training
• Secure, HIPAA-compliant cloud infrastructure with geographically redundant backups
• Incident response protocols to detect, contain, and report potential breaches within legally mandated timeframes

7. Cookies & Tracking Technologies

Our website uses essential cookies to maintain secure logins, remember preferences, and ensure platform functionality. We do not use cookies to track clinical interactions or mental health data. Analytics cookies help us understand website traffic patterns and improve user experience. You may manage or disable cookies through your browser settings.

8. Your Rights & Choices

Depending on your jurisdiction, you have the right to:

• Access, review, and request copies of your personal and clinical records
• Request corrections or amendments to inaccurate information
• Opt out of non-essential communications and marketing
• Request deletion of non-clinical data where legally permissible (note: clinical records may be retained per legal retention requirements)
• File a complaint with us or a relevant regulatory authority (e.g., HHS Office for Civil Rights)

9. Minors & Guardians

For clients under 18, we require verifiable consent from a parent or legal guardian before collecting or processing personal health information. We respect appropriate confidentiality boundaries for adolescent clients as permitted by law, while keeping guardians appropriately informed when required.

10. Policy Updates

We may update this Privacy Policy to reflect changes in our practices, technology, or legal requirements. Updates will be posted on this page with a revised "Last Updated" date. Material changes will be communicated via email or website notice. Continued use of our services constitutes acceptance of the updated policy.