Privacy Policy

01 About Us and Scope

This Privacy Policy ("Policy") applies to the website healingmindstudio.com (the "Website") and describes how Healing Mind Studio, a psychotherapy practice led by Ganna Skrypnyk, Licensed Marriage and Family Therapist (LMFT), California, collects, uses, discloses, and protects your personal information.

By using the Website, you agree to this Policy. If you do not agree, please do not use the Website.

Data Controller Contact Information

Healing Mind Studio / Ganna Skrypnyk, LMFT
751 S Weir Canyon Rd, Ste 157-1009, Anaheim Hills, CA 92808
Email: healingmindstudio@gmail.com
Tel.: +1 (626) 667-4303

02 Information We Collect

2.1 Information You Provide to Us

When you submit a contact form or request a consultation, we may collect:

• First and last name
• Email address
• Phone number
• Message content or concern description

2.2 Protected Health Information (PHI)

After a therapeutic relationship is established and services are provided, we may collect and process Protected Health Information (PHI) in accordance with HIPAA requirements. PHI may include, but is not limited to:

• Demographic data (name, date of birth, address)
• Mental health information, diagnoses, and treatment details
• Medical history and session notes
• Insurance data and payment details

PHI is processed only as described in Section 4 of this Policy (HIPAA Notice of Privacy Practices).

2.3 Automatically Collected Technical Data

When you visit the Website, the following may be collected automatically:

• IP address and approximate geolocation
• Browser type and version, operating system
• Pages viewed and visit timestamps
• Referring URL

With your explicit consent through the cookie settings banner, the Website may also use analytics tools (Google Analytics) and advertising tools (Google Ads, Facebook Pixel). Without your consent, these categories are not activated.

03 How We Use Your Information

We use collected information for the following purposes:

• Responding to inquiries and scheduling consultations
• Providing psychotherapy services and maintaining client records
• Billing insurance providers and processing payments
• Complying with legal requirements, including HIPAA and California law
• Maintaining Website security and preventing fraud
• Analyzing Website usage and improving services (with your consent via Google Analytics)
• Serving personalized ads on third-party services (with your consent via Google Ads and Facebook Pixel)

We do not sell your personal data to data brokers or other commercial third parties. Data sharing with advertising platforms (Google, Meta) occurs only with your explicit consent for advertising cookies and may be considered "sharing" under CCPA/CPRA (see Section 5).

04 HIPAA Notice of Privacy Practices

4.1 Permitted Uses and Disclosures of PHI

Without special authorization, we may use and disclose PHI for:

• Treatment: coordinating care with other healthcare professionals, referrals, and mental health consultations.
• Payment: billing insurance providers (Blue Shield of California, Aetna, Anthem Blue Cross California, Carelon Behavioral Health, Quest Behavioral Health, Cigna) and processing payments.
• Healthcare Operations: quality improvement, staff training, and accreditation.
• Legal Requirements: disclosures required by courts, government authorities, or mandatory reporting laws.
• Threat Prevention: preventing a serious threat to your health/safety or the health/safety of others.
• Mandatory Reporting: as required under California Mandated Reporter Law (Cal. Penal Code 11166), including suspected abuse of children, elders, or dependent adults.

4.2 Uses and Disclosures Requiring Authorization

We will request your written authorization for:

• Most disclosures of PHI not listed in Section 4.1
• Psychotherapy notes (a specially protected category)
• Marketing communications
• Sale of PHI (we do not sell PHI)

4.3 Your Rights Regarding PHI

Under HIPAA, you have the right to:

• Right of Access: obtain a copy of your medical record within 30 days of request.
• Right to Amend: request correction of inaccurate information in your medical record.
• Right to an Accounting of Disclosures: receive a list of PHI disclosures for the past 6 years.
• Right to Request Restrictions: request limits on use/disclosure of PHI (we are not always required to agree, except when disclosure is not needed by an insurer and you paid in full out-of-pocket).
• Right to Confidential Communications: request communications at an alternative address or by an alternative method.
• Right to a Copy of this Notice: request a paper copy of this Notice at any time.
• Right to File a Complaint: file a complaint with our office or with the U.S. Department of Health and Human Services Office for Civil Rights (OCR): www.hhs.gov/hipaa/filing-a-complaint.

4.4 Our Duties

We are required to: maintain PHI privacy; notify you of breaches of unsecured PHI; follow the terms of the current Notice; and notify you when this Notice changes.

05 California Residents' Rights (CCPA / CPRA)

Under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA), California residents have the following rights regarding personal data:

5.1 Right to Know

You may request information about categories and specific pieces of personal data we collected about you in the last 12 months, including purposes of use and third parties to whom data was disclosed.

5.2 Right to Delete

You may request deletion of personal data we collected, subject to legal retention requirements (for example, HIPAA compliance, medical recordkeeping, or defense of legal claims).

5.3 Right to Correct

You may request correction of inaccurate personal data.

5.4 Right to Opt Out of Sale/Sharing

We do not sell your personal data to data brokers or ad exchanges. However, sharing data with advertising platforms (Google Ads, Facebook Pixel) with your consent may be considered "sharing" under CCPA/CPRA. You may opt out at any time by disabling the "Advertising" category in cookie settings via the "Cookie Settings" link in the footer.

PHI (Protected Health Information) is never shared with advertising networks, under any circumstances.

5.5 Right to Non-Discrimination

Exercising your privacy rights will not result in denial of services, different pricing, or reduced quality of care.

5.6 How to Exercise Your Rights

Send your request by email to healingmindstudio@gmail.com with "Privacy Request" in the subject line. We respond within 45 days (extendable to 90 days with notice). Identity verification may be required.

Note. PHI protected under HIPAA and California's Confidentiality of Medical Information Act (CMIA, Cal. Civ. Code 56 et seq.) is primarily governed by HIPAA and CMIA, not by CCPA.

06 Children and Minors (COPPA)

The Website is not intended for children under 13 and we do not knowingly collect personal data from children under 13, in accordance with the Children's Online Privacy Protection Act (COPPA).

For clients ages 13 to 17 (teen therapy services), written consent from a parent or legal guardian is required before therapy begins. Minor records are handled in accordance with Cal. Health & Safety Code 124260 and applicable California mental health confidentiality laws.

If you believe a child under 13 provided personal data without parental consent, please contact us at healingmindstudio@gmail.com.

07 Cookies and Third-Party Services

Analytics and advertising tools are activated only with your explicit consent through the cookie settings banner. You may change your consent at any time using the "Cookie Settings" link in the footer. See our Cookie Policy for details.

CalOPPA - Do Not Track

As required by CalOPPA (Cal. Bus. & Prof. Code 22575), the Website does not respond to browser Do Not Track (DNT) signals. Instead, we provide transparent consent controls: you may disable analytics and advertising cookie categories through the "Cookie Settings" button in the footer.

08 Information Sharing with Third Parties

We may share your data only in the following cases:

• Insurance providers: for billing and reimbursement, limited to PHI necessary to process insurance claims.
• Technical providers: hosting providers and payment processors acting as HIPAA Business Associates under applicable BAA agreements.
• Google LLC (analytics and advertising): with your consent for analytics/advertising cookies, visit and interaction data is processed under the Google Privacy Policy. PHI is never shared.
• Meta Platforms, Inc. (Facebook/Instagram): with your consent for advertising cookies, interaction data is processed under the Meta Privacy Policy. PHI is never shared.
• Legal requirements: in response to court orders, subpoenas, or other lawful demands.
• Health and safety protection: where there is a credible threat to life or where mandatory reporting laws apply.

We do not sell data to brokers or other commercial third parties. Sharing with Google and Meta occurs only with your explicit consent and may be withdrawn at any time through cookie settings.

09 Data Security

We implement technical, administrative, and physical safeguards to protect your data, including:

• TLS/SSL encryption for data transmission (HTTPS)
• Restricted access to personal data and PHI
• Staff training on HIPAA requirements
• Regular security reviews and updates

Despite these safeguards, no internet transmission system is fully secure. In the event of a PHI breach, we will notify you within timelines required by the HIPAA Breach Notification Rule (45 CFR 164.400-414).

10 Data Retention

11 Changes to this Privacy Policy

We may update this Policy from time to time. For material changes, we will post an updated version on the Website with a revised effective date. For HIPAA clients, we will provide an updated Notice of Privacy Practices at the next scheduled visit or upon request.

Your continued use of the Website after changes are posted means you accept the updated Policy.

12 Contact Information and Complaints

For all questions about this Policy, and to exercise your rights, please contact: