Privacy policy
Privacy and HIPAA notice
How this practice handles the information you give it, online and in the room.
Part A. Notice of Privacy Practices
This is the HIPAA notice. It is the formal document the law requires a health care provider to give you, and it is dated and revised on its own, separately from Part B. You receive it through the client portal at or before your first appointment, and you sign there to say you have it. Everything you sign stays available to you in that portal. You are entitled to a paper copy at any time: ask, and we will print one for you.
We are required by law to keep your health information private, to give you this notice explaining our legal duties and privacy practices, and to follow the terms of the notice currently in effect.
How we use and share your information without asking you first
There are three ordinary purposes. The law calls them treatment, payment and health care operations.
- Treatment. Your clinician uses what you tell them to do the work. If you are seeing more than one of us, or if we coordinate with a doctor you have asked us to speak to, we share what is relevant to your care. Example: with your agreement, your clinician writes to your physician about a medication that is affecting your sleep.
- Payment. If you use insurance, we give your plan the information it requires to pay the claim, which includes a diagnosis. Example: submitting a claim with dates of service and a diagnostic code. If you pay us directly, see the box below.
- Health care operations. Running the practice. Scheduling, record keeping, quality review, and clinical supervision. Example: an associate discusses your care with their clinical supervisor. That is what supervision is, and your clinician’s professional disclosure statement, which you receive in the first session, names who that supervisor is. Where the Board requires a supervisor outside this practice, that supervisor sees what supervision requires and nothing else.
Other times we may share information without your authorization
These are narrow, and each one is set by law rather than by us.
- When the law requires a report. Suspected abuse or neglect of a child or of an elderly or vulnerable adult. Certain court orders and subpoenas.
- When there is a serious and imminent threat to your safety or someone else’s, and disclosure could reduce it.
- Health oversight, public health, and law enforcement in the specific circumstances the law defines.
- Workers’ compensation, where the claim requires it.
- To our business associates, the companies that help us run the practice, each under a written agreement that binds them to protect your information on the same terms we do. They are listed in Part B.
Your clinician goes through these with you in the first session. If any of it matters to your decision to start, ask before you book.
What we will not do without your written permission
- Psychotherapy notes. A clinician’s separate session notes are held apart from the rest of your record and are not disclosed without your written authorization, except in the few situations the law specifically allows.
- Marketing. We do not use your health information to market anything to you without your written authorization first.
- Sale. We do not sell your information. Not to anyone, not ever.
Any authorization you give, you can withdraw in writing at any time. That stops future use; it cannot undo something already done.
Your rights over your own information
- See it and get a copy. Of your record, in paper or electronically. We may charge a reasonable cost‑based fee.
- Ask us to correct it if you think it is wrong or incomplete. If we decline, we will tell you why in writing.
- Ask us to limit what we use or share. We do not have to agree, except in the paid‑in‑full case above.
- Ask us to contact you a particular way or at a particular address. A different phone, no voicemail, post to an address that is not your home. We will accommodate reasonable requests and we will not ask you why.
- Get a list of who we have shared it with, going back six years, other than for treatment, payment and operations.
- Get a paper copy of this notice at any time, even if you have already agreed to receive it electronically.
- Be told if there is a breach of unsecured information about you.
Our duties
We are required by law to protect the privacy of your health information, to give you this notice, to follow the terms currently in effect, and to notify you if a breach compromises the privacy of your information. We may change this notice, and a change applies to information we already hold as well as to information we receive afterwards. The current version is always posted here, with its effective date at the top.
Part B. This website, and the forms on it
Part A is about health information held by a health care provider. This part is about what happens when you visit this site or one of our pages, which for most people happens well before any of Part A applies.
Part B last updated: 26 August 2026. It is dated separately on purpose. This half changes whenever a tool or a supplier changes; Part A is a formal notice with its own effective date and its own revision rules.
What we collect
- When you fill in a form or request a consultation: your name, the contact details you give us, and whatever you choose to write in the message. You decide how much to write. A first name and a phone number is enough to book a call.
- When you just read: the ordinary technical information any web server receives, and whatever the tools in the list below collect. This site runs no analytics, advertising or tracking tags of any kind. Nothing here profiles you and nothing is shared with an advertising network. If that changes, this section changes with it.
Who else handles it
We use outside companies to run the practice. Each of them handles information on our behalf under a written agreement that binds them to protect it on the same terms we do.
- Booking, forms and scheduling. Valant Medical Solutions. The booking form on this site is Valant’s own, embedded here, so a request you send through it goes into the practice’s record system.
- Clinical records. Valant Medical Solutions, the practice’s electronic health record, which holds the clinical record and the client portal.
- Payments. Converge, which processes card payments.
- Secure messaging. Secure messaging runs through the Valant portal. The practice does not use a separate secure messaging service, which is why the section above asks you not to put clinical detail in ordinary email.
- Email and newsletters, if you ask for them. GoDaddy and Microsoft 365, which carry the practice’s email.
Those are the companies that handle what you send through this website. None of it is sold.
Cookies, analytics and advertising
No analytics or advertising tags run on this site.
This section has to describe what actually runs, not what we would like to be true. If we advertise these pages, an advertising tag may record that a form was submitted. Where that is the case it is stated here plainly, and it is worth knowing that you can reach us by telephone on (971) 268 5620 without going through any form at all.
Email is not secure by default
Ordinary email travels in the clear and we cannot control what happens to it once it leaves us. If you would rather not send something by email, say so and we will find another way. Nothing you decline to put in writing counts against you.
Young people
This site is not aimed at children. On the clinical side, Oregon law is specific: a person 14 or older may obtain outpatient diagnosis or treatment for a mental or emotional disorder without a parent’s knowledge or consent, and the provider is required to involve a parent before treatment concludes unless that would be clinically inappropriate, which must be documented. That is the law. This practice’s own position is separate from it: we work with adults and with young people from sixteen, and we are not the right service for anybody younger. If you are under sixteen and looking for help, call us anyway and we will point you somewhere that is.
How long we keep things
Clinical records are kept for the period Oregon law and our professional obligations require. An enquiry that never becomes an appointment is kept only as long as it is useful for answering you, and you can ask us to delete it sooner. Ask, and we will.
How to reach us, and how to complain
If you think your privacy rights have been violated
Tell us, and we will look into it. You can also complain directly to the Secretary of the U.S. Department of Health and Human Services, Office for Civil Rights, and you do not have to tell us first. Complaints can be filed at hhs.gov/ocr/complaints.
We will not retaliate against you for making a complaint. Not in your care, not in your scheduling, not in any way.