Privacy Policy

1. Introduction

Mindwell ("we," "our," or "us") is committed to protecting your privacy and safeguarding your Protected Health Information ("PHI") in accordance with the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and its implementing regulations. This Privacy Policy explains how we collect, use, disclose, and protect information about visitors to our website (mindwell.madethis.app) and clients who engage with our services.

2. Information We Collect

2.1 Information You Provide

• Contact information (name, email address, phone number)
• Intake form responses and appointment requests
• Insurance and billing information
• Information you share when communicating with our staff

2.2 Automatically Collected Information

• IP address and browser type
• Pages visited and time spent on our website
• Referring URLs
• Device and operating system information

2.3 Cookies and Tracking Technologies

We use cookies and similar tracking technologies to improve user experience, analyze website traffic, and support our analytics platform (PostHog). You may disable cookies in your browser settings; however, some features of our website may not function properly as a result. We do not sell your data to third parties.

3. Protected Health Information (PHI)

As a covered entity under HIPAA, Mindwell follows all applicable rules regarding the use and disclosure of PHI. PHI includes any information that could identify you and relates to your health condition, provision of health care, or payment for health care services. We collect PHI only as necessary to provide treatment, facilitate payment, and support health care operations.

Our Notice of Privacy Practices, available at /legal/hipaa-notice, provides complete information about how we handle PHI.

4. How We Use Your Information

We use the information we collect to:

• Provide, manage, and improve our therapy services
• Schedule and confirm appointments
• Process payments and insurance claims
• Communicate with you about your care
• Comply with legal and regulatory obligations
• Analyze and improve our website
• Send administrative communications (appointment reminders, policy updates)

5. Disclosure of Information

We do not sell, trade, or rent your personal information. We may disclose your information to:

• Business Associates: Third-party vendors who assist in our operations (e.g., scheduling software, billing services) under HIPAA-compliant Business Associate Agreements
• Treatment Providers: Other licensed healthcare professionals involved in your care, with your consent
• Legal Requirements: When required by law, court order, or governmental authority
• Safety: When necessary to prevent serious harm to you or others

6. Third-Party Services

Our website uses the following third-party services:

• PostHog: Website analytics and session tracking. PostHog may set cookies to analyze usage patterns. Data is anonymized where possible.
• Convex: Secure cloud database for storing appointment and inquiry data.
• Vercel: Website hosting. Vercel may collect server logs including IP addresses.

We encourage you to review the privacy policies of these third-party services independently.

7. Your Rights

Under HIPAA and applicable state law, you have the right to:

• Access and obtain a copy of your health records
• Request corrections to inaccurate or incomplete records
• Request restrictions on how we use or disclose your PHI
• Receive an accounting of disclosures of your PHI
• Receive a copy of this Privacy Policy and our HIPAA Notice of Privacy Practices
• File a complaint if you believe your privacy rights have been violated

To exercise any of these rights, please contact us at privacy@mindwell.com.

8. Data Security

We implement reasonable administrative, technical, and physical safeguards to protect your information from unauthorized access, use, or disclosure. However, no method of transmission over the internet is completely secure, and we cannot guarantee absolute security.

9. Children's Privacy

Our website is not directed to children under the age of 13. We do not knowingly collect personal information from children under 13 without verifiable parental consent. If you believe we have inadvertently collected such information, please contact us immediately.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be posted on this page with an updated revision date. Your continued use of our website following any changes constitutes your acceptance of the revised policy.

11. Contact Us

For questions, concerns, or to exercise your privacy rights, please contact Mindwell's Privacy Officer: