Privacy & Security Policy

1. Introduction

At In Therapy, your privacy and trust are paramount. This Privacy & Security Policy outlines how we collect, use, protect, and disclose your information when you access our website, use our online therapy platform, or engage with our mental health services. We are committed to complying with applicable privacy laws, including HIPAA in the United States and equivalent data protection regulations globally.

By using our services, you acknowledge that you have read and understood this policy. If you do not agree, please discontinue use of our platform immediately.

2. Information We Collect

We collect information necessary to provide safe, effective, and compliant mental health services. This includes:

• Personal Identifiers: Name, date of birth, email, phone number, mailing address, and government-issued ID (when required for verification).
• Protected Health Information (PHI): Medical history, symptoms, therapy notes, assessment results, treatment plans, and communication with your therapist.
• Payment & Billing Data: Credit card numbers, insurance details, and billing addresses. We never store full payment credentials on our servers; all transactions are processed by PCI-DSS compliant third-party processors.
• Technical & Usage Data: IP address, browser type, device information, session duration, pages visited, and platform interaction logs to improve security and user experience.
• Consent & Communication Records: Signed consent forms, intake questionnaires, and messages exchanged through our secure portal.

3. How We Use Your Information

Your information is used strictly to support your care and maintain compliant operations:

• Treatment: Coordinating care, scheduling sessions, documenting progress, and facilitating communication with your care team.
• Payment Processing: Billing services, verifying insurance eligibility, and managing financial accounts.
• Platform Operations: Maintaining secure video/audio sessions, account management, and technical support.
• Legal & Compliance: Fulfilling reporting obligations, responding to lawful requests, and protecting the rights and safety of our clients and staff.
• Improvement & Research: Using de-identified, aggregated data to improve service quality, develop educational resources, and conduct ethical clinical research.

4. Security & Safeguards

We implement industry-leading technical, administrative, and physical safeguards to protect your data:

• Encryption: All data in transit is secured via TLS 1.3 encryption. Data at rest is encrypted using AES-256 standards.
• Access Controls: Role-based authentication, multi-factor authentication (MFA), and session timeouts restrict access to authorized personnel only.
• Compliance: Our platform and business practices are designed to meet HIPAA, GDPR, and CCPA requirements where applicable.
• Staff Training: All employees and contracted therapists undergo mandatory privacy, security, and ethical compliance training annually.
• Incident Response: We maintain a documented breach response protocol and will notify affected individuals and authorities within legally mandated timeframes if a compromise occurs.
• Audits & Monitoring: Regular third-party security assessments, penetration testing, and continuous system monitoring ensure ongoing protection.

5. Information Sharing

We do not share your information except in the following circumstances:

• With Your Consent: When you explicitly authorize release to a specialist, primary care provider, or family member.
• For Treatment & Coordination: With other licensed healthcare providers involved in your care, under a Business Associate Agreement (BAA).
• Legal Requirements: When required by court order, subpoena, or government investigation. We will make reasonable efforts to notify you before disclosing unless legally prohibited.
• Safety & Emergency: If we believe there is an imminent risk of harm to you or others, we may disclose necessary information to emergency services or authorities.
• Service Providers: With trusted vendors who assist with hosting, payment processing, analytics, or customer support, all bound by strict confidentiality and data processing agreements.

6. Your Rights & Choices

Depending on your location, you may have the right to:

• Access & Copy: Request a copy of your records and PHI we hold.
• Amend: Request corrections to inaccurate or incomplete information.
• Restrict or Opt-Out: Limit how certain information is used for non-essential purposes or marketing communications.
• Delete: Request erasure of personal data, subject to legal retention requirements for healthcare records.
• File a Complaint: Contact us or the relevant privacy regulator if you believe your rights have been violated.

To exercise these rights, please contact our Privacy Officer using the details below. We will respond within 30 days and may verify your identity before processing requests.

7. Minors & Dependents

Our platform does not knowingly collect information from individuals under 13 without verifiable parental consent. For clients aged 13–17, therapy may be provided with appropriate parental/guardian consent where required by law. Minors' privacy rights are protected to the fullest extent permitted by applicable jurisdictional laws.

8. Cookies & Tracking

We use essential cookies to maintain session security, remember preferences, and ensure platform functionality. We do not use advertising or behavioral tracking cookies on our therapy platform. Analytics cookies are strictly first-party and anonymized to help us improve navigation and performance. You may manage or disable cookies through your browser settings.

9. Policy Updates

We may update this policy to reflect changes in services, technology, or legal requirements. Significant changes will be communicated via email and/or a prominent notice on our website. The "Last Updated" date at the top of this page will be revised accordingly. Continued use of our services constitutes acceptance of the updated policy.

10. Contact Us

If you have questions, concerns, or requests regarding this policy or your personal information, please reach out to our Privacy & Compliance team: