Privacy Policy

This policy applies to information collected through the Site and Services. It does not apply to third-party websites or services we do not control, even if linked from our Site.

Health records: We provide clinical treatment and are a HIPAA covered entity. The use and disclosure of your protected health information (PHI) are governed by our Notice of Privacy Practices. Where this Privacy Policy and the Notice of Privacy Practices conflict regarding PHI, the Notice of Privacy Practices controls.

Information you provide directly:

• Identity and contact details (name, email, phone, mailing address, date of birth)
• Account credentials
• Health and mental health information you choose to share (e.g., symptoms, mood tracking entries, assessment responses, appointment notes, medication information)
• Emergency contact information
• Payment and insurance information
• Communications you send us (messages, intake forms, support requests)
• Email address you provide when subscribing to The Sanctuary emails or our newsletter

Information collected automatically:

• Device and browser information, IP address, and general location
• Usage data (pages viewed, features used, time spent)
• Cookies and similar technologies (see Section 8)

Information from third parties:

• Referring clinicians, insurers, or family members (with appropriate authorization)
• Analytics and service providers

We use information to:

• Provide, personalize, and improve the Services
• Facilitate appointments, assessments, and communication with care providers
• Process payments and coordinate with insurers
• Respond to inquiries and provide support
• Send administrative messages and, where permitted, appointment reminders
• Maintain safety, security, and integrity of the Services
• Comply with legal, regulatory, and professional obligations

The Sanctuary emails and our newsletter: If you subscribe through the signup on our Site, we use the email address you provide to send occasional practice updates and new journal essays. Subscribing is optional and entirely separate from your care; we do not add patients to the list automatically, subscribing is not a condition of treatment, and these emails never include clinical information about you. You can leave the list at any time using the unsubscribe link in any Sanctuary email, or by contacting us using the details in Section 14.

We do not sell your personal or health information.

We recognize that mental health information is especially sensitive. We limit access to authorized personnel for the purpose of supporting or providing your care. Additionally, we apply administrative and technical safeguards and require confidentiality commitments from our staff and vendors.

We will not use your mental health information for advertising, sell your information, or share it with data brokers.

We may share information:

• With your care providers involved in your treatment
• With service providers (e.g., secure hosting, payment processing, scheduling) under contracts requiring confidentiality and, where applicable, HIPAA Business Associate Agreements
• With your consent, including disclosures you authorize to family or others
• For legal reasons, when required by law, subpoena, or to comply with regulatory obligations
• For safety, to prevent or lessen a serious and imminent threat to the health or safety of you or others (consistent with applicable law and professional duties, such as duty-to-warn obligations)
• In a business transfer, such as a merger or acquisition, subject to this policy

The Services are not intended for medical emergencies or crisis intervention. If you are experiencing a mental health emergency or having thoughts of harming yourself or others, call 911 (or your local emergency number) or contact the 988 Suicide and Crisis Lifeline by calling or texting 988.

In situations involving imminent risk of serious harm, we may disclose information as necessary to protect you or others, as permitted or required by law.

We use administrative, technical, and physical safeguards designed to protect your information, including encryption in transit and at rest, access controls, and monitoring. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

We use cookies and similar technologies to operate the Site, remember preferences, and analyze usage. You can manage cookies through your browser settings. We do not use third-party advertising trackers. We honor recognized opt-out and Global Privacy Control signals as required by applicable law.

We retain information for as long as needed to provide the Services and to meet legal, regulatory, and professional recordkeeping requirements (for example, clinical record retention periods that vary by state). When no longer required, we securely delete or de-identify information.

Depending on your location, you may have rights to:

• Access, correct, or obtain a copy of your information
• Request deletion (subject to legal retention requirements)
• Restrict or object to certain processing
• Withdraw consent where processing is based on consent
• Opt out of non-essential communications, including The Sanctuary emails and our newsletter

To exercise these rights, contact us using the details in Section 14. We will verify your identity before responding. We will not discriminate against you for exercising your rights.

HIPAA rights: If your information is PHI, you also have rights under HIPAA as described in our Notice of Privacy Practices.

State-specific rights: Our practice is based in South Carolina. South Carolina law, including the South Carolina Medical Records Act, governs how we maintain and release your medical records. Where another state's law protects your information more strictly than South Carolina or federal law does, we follow the stricter standard.

The Services are intended for individuals aged 18 and older, or for minors only with verifiable parental/guardian consent. We do not knowingly collect information from children under 13 without required consent. If you believe a child has provided information without authorization, contact us and we will take appropriate action.

If you access the Services from outside the United States, your information may be processed in the United States, where data protection laws may differ.

We may update this Privacy Policy periodically. Material changes will be posted on this page with a revised "Last Updated" date and, where appropriate, communicated directly to you.

If you have questions or concerns about this Privacy Policy or our privacy practices, contact: