Privacy Policy
PART I — HIPAA NOTICE OF PRIVACY PRACTICES
(For U.S. Clients)
This Notice describes how medical and mental health information about you may be used and disclosed and how you can access this information. Please review it carefully.
​
Our Legal Duty
This practice is required by law to:
-
Maintain the privacy of your Protected Health Information (PHI)
-
Provide you with this Notice of our legal duties and privacy practices
-
Abide by the terms of this Notice currently in effect
-
Notify you if a breach of unsecured PHI occurs
We reserve the right to change the terms of this Notice. Any revised Notice will apply to all information we maintain and will be available upon request and through the client portal.
How We May Use and Disclose Your Information
We may use or disclose your PHI without your written authorization for the following purposes:
1. Treatment
To provide, coordinate, or manage your mental health care and related services.
2. Payment
To obtain payment for services, including billing, claims processing, and collection activities.
3. Health Care Operations
For practice management activities such as quality assessment, supervision, licensing, compliance, and administrative functions.
Uses and Disclosures Requiring Authorization
​
We will obtain your written authorization for uses and disclosures not described in this Notice, including:
-
Psychotherapy notes (if maintained separately)
-
Marketing communications
-
Sale of PHI
You may revoke your authorization in writing at any time. Revocation will not affect actions already taken in reliance on your authorization.
Disclosures Permitted or Required by Law
​
We may disclose your PHI without authorization when required or permitted by law, including:
-
To prevent a serious threat to health or safety
-
Suspected abuse or neglect reporting
-
Public health activities
-
Health oversight activities
-
Judicial or administrative proceedings
-
Law enforcement purposes
-
Workers’ compensation claims
-
As required by federal or state law
​
Your Rights Under HIPAA
You have the right to:
-
Inspect and obtain a copy of your records (with limited exceptions)
-
Request correction (amendment) of your record
-
Request restrictions on certain uses or disclosures
-
Request confidential communications
-
Receive an accounting of certain disclosures
-
Receive a paper copy of this Notice upon request
-
File a complaint without retaliation
To file a complaint, you may contact:
Practice Contact for Privacy Matters:
Name: Kathryn Soule, PhD, LPC
Phone: 347-525-8754
Email: ksoule@souletherapy.com
You may also file a complaint with the U.S. Department of Health & Human Services:
Office for Civil Rights
https://www.hhs.gov/ocr/privacy/hipaa/complaints/
We will not retaliate against you for filing a complaint.
​
-
Lodge a complaint with your local Data Protection Authority
Requests must be submitted in writing.
PART II — GDPR DATA PROTECTION NOTICE
(For Clients in the European Union)
​
If you are located in the European Union, your personal data is processed in accordance with the General Data Protection Regulation (GDPR).
Data Collected
We collect personal and sensitive health data necessary to provide professional services, including identifying information, contact information, health history, session notes, billing information, and documents you submit.
Lawful Basis for Processing
Your data is processed on the basis of:
-
Provision of healthcare services
-
Compliance with legal and professional obligations
-
Your explicit consent
Health information is considered “special category data” under GDPR.
Electronic Records & International Data Transfers
This practice uses Practice Better, a secure, encrypted electronic record system.
Your information may be stored or processed on secure servers located outside the European Union, including in the United States or Canada. Appropriate safeguards and contractual protections are used to protect your information.
By signing this document, you acknowledge and consent to this international transfer and electronic storage of your data.
Data Retention
Records are retained for a minimum of 7 years after the last date of service, or longer if required by professional or legal standards.
Your Rights Under GDPR
You have the right to:
-
Access your personal data
-
Request correction of inaccurate data
-
Request restriction of processing
-
Request deletion (subject to legal and ethical retention requirements)
-
Withdraw consent (which may affect continuation of services)