Privacy Policy

1.Definitions

1. Company: Legacy Family Services, Inc., an Oklahoma Corporation, hereinafter referred to as "Company," "Legacy Family Services," "Data Controller," "we," "us," or "our."
2. Website: This Privacy Policy applies to the website http://www.legacyfs.org and any corresponding mobile applications currently in use or hereinafter developed.
3. You / Client: The individual accessing our Website or receiving mental health services from the Company, hereinafter referred to as "you," "your," "Client," or "user."
4. Services: Mental health services provided by the Company, including but not limited to individual therapy, couples therapy, family therapy, group therapy, telehealth services, and related clinical services.
5. Personal Data: Personal data and information that we obtain from you in connection with your use of the Website or receipt of Services which is capable of identifying you in any manner.
6. Protected Health Information (PHI): Individually identifiable health information related to your past, present, or future physical or mental health condition, the provision of healthcare services to you, or the payment for such services, as defined by HIPAA.
7. Psychotherapy Notes: Notes recorded by a mental health professional documenting or analyzing the contents of a conversation during a private, group, joint, or family counseling session, which are maintained separately from the rest of the Client's medical record.
8. HIPAA: The Health Insurance Portability and Accountability Act of 1996, as amended, and its implementing regulations.
9. Provider: A licensed mental health professional providing Services on behalf of the Company.
10. Minor: Any individual under the age of eighteen (18) years.
11. Business Days: Monday through Friday, excluding federal holidays and any days the Company is closed for business.

2.General Information

This Privacy Policy describes how we collect, use, disclose, and protect the Personal Data and Protected Health Information that we receive about you when you visit our Website, use our Services, or otherwise interact with Legacy Family Services. As a mental health practice, we are subject to federal and state laws governing the confidentiality of health information, including HIPAA and Oklahoma state law regarding mental health records.

This Privacy Policy applies to:

1. Information collected through our Website
2. Information collected in connection with the provision of mental health Services
3. Information collected through electronic communications, including email, text messages, and telehealth platforms

This Privacy Policy does not cover information that we may receive through sources other than those described above. Our Website may link to other websites or applications; this Privacy Policy does not apply to those linked sites.

By using our Website or receiving Services from Legacy Family Services, you acknowledge that you have reviewed this Privacy Policy and agree to its terms. If you do not agree to this Privacy Policy, please do not use our Website or Services.

3.Contact Information

The Party responsible for the processing of your Personal Data and PHI is:

For questions about this Privacy Policy, our privacy practices, or to exercise your rights regarding your information, please contact us using the information above.

4.Location of Data Processing

Data processing activities take place in the United States, specifically in Oklahoma. If you are accessing our Website or Services from outside the United States, please be aware that your information may be transferred to, stored, and processed in the United States, where data protection laws may differ from those in your jurisdiction.

5.Modifications and Revisions

We reserve the right to modify, revise, or amend this Privacy Policy at any time. If we make material changes, we will notify you by posting the updated Privacy Policy on our Website and updating the Effective Date. For significant changes affecting your PHI, we will provide direct notice and, where required by law, obtain your consent.

Changes to this Privacy Policy will apply to information collected after the Effective Date of the revised policy unless we obtain your consent to apply changes retroactively. It is your responsibility to periodically review this Privacy Policy for updates.

6.Personal Data We Collect Through the Website

Depending on how you interact with our Website, we may collect different types of Personal Data:

1. Registered Users: If you register for an account, schedule an appointment, or access our client portal, we may collect:
   1. Name
   2. Email address
   3. Phone number
   4. Physical address
   5. Date of birth
   6. Insurance information
   7. Payment and billing information
   8. Any other information you voluntarily provide
2. Appointment Requests and Contact Forms: If you submit an appointment request or contact form, we collect the information you provide, which may include your name, contact information, reason for seeking services, and any other details you choose to share.
3. Unregistered Users: If you browse our Website without registering, we may still collect certain information passively, including:
   1. IP address
   2. Browser type and version
   3. Device information
   4. Pages visited and time spent on pages
   5. Referring website
   6. General location information
4. All Users: The passive data collection described for unregistered users applies to all visitors to our Website.
5. Payment Information: If you make payments through our Website, we collect billing information necessary to process your payment. Payment card information is processed through secure third-party payment processors and is not stored on our servers.

7.Cookies and Automatic Data Collection

1. Cookies: We use cookies and similar tracking technologies to enhance your experience on our Website. Cookies are small text files stored on your device that help us recognize you, remember your preferences, and understand how you use our Website.
2. Types of Cookies We Use:
   1. Essential Cookies: Necessary for the Website to function properly, including secure login and session management.
   2. Functional Cookies: Remember your preferences and settings to provide a personalized experience.
   3. Analytics Cookies: Help us understand how visitors interact with our Website, which pages are most popular, and how we can improve user experience.
   4. Third-Party Cookies: We may allow third-party service providers to place cookies on your device for analytics and functionality purposes.
3. Managing Cookies: You can control cookies through your browser settings. Most browsers allow you to block or delete cookies. However, disabling cookies may affect the functionality of our Website. For information on managing cookies in your browser:
   • Chrome:support.google.com/accounts/answer/61416
   • Firefox:support.mozilla.org
   • Safari:support.apple.com/guide/safari
   • Edge:support.microsoft.com/microsoft-edge
4. Log Data: Our servers automatically collect certain information when you visit our Website, including:
   1. IP address
   2. Browser type and device parameters
   3. Internet Service Provider
   4. Date and time of visit
   5. Pages visited
   6. Referring and exit pages
   This information is used in aggregated form to analyze Website performance, ensure security, and improve user experience.

8.Use of Personal Data Collected Through the Website

We use Personal Data collected through the Website for the following purposes:

1. To respond to your inquiries and appointment requests
2. To schedule and manage appointments
3. To process payments
4. To send appointment reminders and confirmations
5. To communicate with you about our Services
6. To send marketing communications, if you have opted in
7. To improve our Website and Services
8. To analyze Website usage and trends
9. To ensure Website security and prevent fraud
10. To comply with legal obligations

9.Third-Party Service Providers (Website)

We may engage third-party service providers to assist with Website operations, including:

1. Website hosting
2. Payment processing
3. Email delivery
4. Analytics
5. Customer relationship management
6. Scheduling software

These providers may have access to your Personal Data only to perform services on our behalf and are obligated to protect your information in accordance with this Privacy Policy and applicable law. We do not sell your Personal Data to third parties.

10.Social Media

Our Website may include links to social media platforms and social sharing buttons. These features may collect your IP address, track which pages you visit, and set cookies to enable functionality. Your interactions with these features are governed by the privacy policies of the respective social media platforms:

• Facebook:facebook.com/policy.php
• Instagram:help.instagram.com
• LinkedIn:linkedin.com/legal/privacy-policy
• X (Twitter):twitter.com/en/privacy

11.HIPAA Compliance

1. Commitment to HIPAA: Legacy Family Services is committed to protecting your Protected Health Information in accordance with HIPAA, the HITECH Act, and applicable Oklahoma state laws governing mental health records.
2. Notice of Privacy Practices: In addition to this Privacy Policy, we maintain a separate Notice of Privacy Practices (NPP) as required by HIPAA. The NPP describes in detail how your PHI may be used and disclosed for treatment, payment, and healthcare operations, as well as your rights regarding your PHI. You will receive a copy of our NPP at intake, and it is available upon request.
3. Relationship Between Documents: This Privacy Policy provides a comprehensive overview of our privacy practices for both Website and clinical information. Our Notice of Privacy Practices provides additional detail specifically required by HIPAA. In the event of any conflict regarding PHI, the Notice of Privacy Practices shall control.

12.Protected Health Information We Collect

In connection with providing mental health Services, we collect and maintain the following types of PHI:

1. Demographic Information: Name, date of birth, address, phone number, email address, emergency contacts, and insurance information.
2. Clinical Information: Intake assessments, diagnoses, treatment plans, progress notes, discharge summaries, and other clinical documentation.
3. Psychotherapy Notes: Separate notes documenting or analyzing the contents of therapy sessions, maintained apart from your general treatment record.
4. Billing Information: Insurance claims, payment records, and related financial information.
5. Communications: Records of communications between you and your Provider or our staff related to your care.
6. Coordination of Care: Information shared with or received from other healthcare providers involved in your treatment.

13.Use and Disclosure of PHI

1. Treatment: We may use and disclose your PHI to provide, coordinate, and manage your mental health treatment. This includes sharing information among members of your treatment team within our practice.
2. Payment: We may use and disclose your PHI to obtain payment for Services, including submitting claims to your insurance company, verifying coverage, and collecting amounts owed.
3. Healthcare Operations: We may use and disclose your PHI for our healthcare operations, including quality improvement, training, auditing, and administrative functions.
4. With Your Authorization: For uses and disclosures not described above, we will obtain your written authorization before using or disclosing your PHI. You may revoke any authorization at any time in writing, except to the extent we have already acted in reliance on it.
5. Psychotherapy Notes: Psychotherapy notes receive heightened protection. We will not use or disclose psychotherapy notes without your specific written authorization, except in limited circumstances permitted by law (such as for our own treatment purposes, to defend against legal action, for mandatory reporting, or to avert a serious threat).

14.Confidentiality of Mental Health Records

1. Commitment to Confidentiality: We recognize that confidentiality is essential to the therapeutic relationship. All information shared during therapy is confidential and will not be disclosed without your written authorization, except as permitted or required by law.
2. Staff Access: Only staff members who need access to your information to perform their job duties will have access to your PHI. All staff are trained on confidentiality requirements and bound by confidentiality agreements.
3. Electronic Records: We maintain your treatment records in a secure electronic health record system that meets HIPAA security requirements, including encryption, access controls, and audit logging.

15.Limits of Confidentiality

There are legal and ethical circumstances under which we may be required or permitted to disclose your PHI without your authorization:

1. Danger to Self: If your Provider reasonably believes you pose an imminent danger of harm to yourself, they may disclose information necessary to protect your safety, including contacting emergency services, family members, or others who may help.
2. Danger to Others: If your Provider reasonably believes you pose a serious and imminent threat to an identifiable third party, they may be required to take protective action, including warning the potential victim or notifying law enforcement.
3. Abuse or Neglect: Our Providers are mandated reporters under Oklahoma law. If we have reasonable cause to believe that a child, elderly person, or vulnerable adult is being abused or neglected, we are required to report to the appropriate authorities.
4. Court Orders and Legal Proceedings: We may be required to disclose your PHI pursuant to a valid court order, subpoena, or other legal process. We will make reasonable efforts to notify you and limit the scope of disclosure.
5. Workers' Compensation: If you are receiving Services related to a workers' compensation claim, we may be required to disclose relevant PHI to your employer or the workers' compensation insurer.
6. Healthcare Oversight: We may disclose PHI to health oversight agencies for audits, investigations, licensure, and other activities authorized by law.
7. Public Health: We may disclose PHI for public health activities, such as reporting communicable diseases or responding to a public health emergency.
8. Law Enforcement: In limited circumstances, we may disclose PHI to law enforcement officials as required by law or in response to a valid legal process.
9. As Otherwise Required by Law: We may disclose PHI when required by federal, state, or local law.

16.Minor Clients and Parental Access

1. Treatment of Minors: We may provide mental health Services to minor Clients. Privacy rights of minors and access rights of parents or legal guardians are governed by HIPAA and Oklahoma state law.
2. Parental Consent: Generally, a parent or legal guardian must consent to mental health treatment for a minor. However, Oklahoma law permits minors to consent to certain treatment without parental involvement in limited circumstances.
3. Parental Access to Records: Parents and legal guardians generally have the right to access their minor child's treatment records. However, access may be limited when:
   1. The minor lawfully consented to treatment without parental consent
   2. A court authorized treatment without parental consent
   3. The parent agreed to confidential communications between the minor and Provider
   4. The Provider determines that access may endanger the minor
4. Confidentiality with Minors: To support effective treatment, your Provider will discuss confidentiality expectations with parents and minor Clients at the outset of treatment, balancing parental involvement with age-appropriate privacy.
5. Custody Situations: In cases involving divorced or separated parents, access to records will be governed by custody agreements, court orders, and applicable law. We may require documentation of custody arrangements.

17.Coordination of Care

1. Other Providers: With your written authorization, we may communicate with other members of your treatment team, such as physicians, psychiatrists, or other therapists, to coordinate your care.
2. Referrals: If we refer you to another provider, we may share relevant information to facilitate continuity of care, subject to your authorization.
3. Insurance and Third-Party Payers: If you use insurance, we will disclose necessary PHI to your insurer for payment purposes. This typically includes your diagnosis, dates of service, and procedure codes. By using insurance, you authorize these disclosures.

18.Group Therapy

1. Nature of Group Services: We may offer group therapy, support groups, or workshops. By participating, you acknowledge that confidentiality cannot be guaranteed in group settings.
2. Expectations: We require all group participants to maintain confidentiality of information shared by others. However, we cannot control the actions of other participants.
3. Provider Obligations: Your Provider will maintain confidentiality to the same extent as in individual therapy, subject to the exceptions in Article 15.

19.Communication Policies

1. Preferred Contact Method: During intake, you will indicate your preferred contact method and whether we may leave messages. We will make reasonable efforts to honor your preferences.
2. Response Time: We strive to respond to non-urgent communications within one to two (1 to 2) Business Days. Do not use email, text, or voicemail for emergencies.
3. Security of Electronic Communications: Email, text messaging, and other electronic communications are not completely secure. By consenting to electronic communications, you acknowledge and accept these risks.
4. Between-Session Contact: Therapy occurs during scheduled sessions. Between-session communications should be limited to scheduling and brief matters. Extensive communication may be billed.

20.SMS and Text Message Communications

1. Consent: By providing your mobile phone number, you consent to receive text messages from Legacy Family Services, including:
   1. Appointment reminders and confirmations
   2. Cancellation or rescheduling notices
   3. Billing and payment reminders
   4. Care coordination communications
   5. Responses to your inquiries
   6. Marketing messages (only with separate opt-in)
2. Message Frequency: Frequency varies based on your interaction with our Services. Appointment reminders are typically sent 24 to 48 hours before appointments.
3. Rates: Standard message and data rates may apply. We are not responsible for carrier charges.
4. Opting Out: Reply STOP to any message to opt out. You will receive confirmation. Opting out may affect our ability to send appointment reminders.
5. Not Required: Text message consent is not required to receive Services. Contact info@legacyfs.org to arrange alternative communication.
6. Help: Reply HELP for assistance or contact info@legacyfs.org or (405) 370-4594.

21.Telehealth Communications

1. Telehealth Services: We offer telehealth services using HIPAA-compliant video conferencing platforms. By participating, you consent to electronic delivery of Services.
2. Security: We use platforms with encryption and security measures. However, no electronic transmission is completely secure, and you accept inherent risks.
3. Recording: Telehealth sessions are not recorded unless agreed in writing. You agree not to record sessions without written consent.
4. Technical Requirements: You are responsible for adequate internet connectivity and a private location for telehealth sessions.
5. Location: You must be physically located in a state where your Provider is licensed during telehealth sessions.

22.Third-Party Communication Platforms

1. Platforms Used: We use third-party platforms for electronic health records, scheduling, email, text messaging, telehealth, and payment processing.
2. Data Sharing: We share necessary information with these platforms to facilitate Services, including your name, contact information, appointment details, and billing information.
3. Third-Party Obligations: These providers are contractually obligated to protect your information and, where applicable, comply with HIPAA.
4. Security: We select platforms with appropriate security measures. However, we cannot guarantee absolute security of information transmitted through third-party platforms.

23.Clinical Versus Marketing Communications

1. Clinical Communications: Communications necessary for your care are not marketing and include:
   1. Appointment scheduling and reminders
   2. Treatment-related information
   3. Billing statements
   4. Care coordination
   5. Responses to your inquiries
2. Marketing Communications: Communications encouraging you to purchase additional services or promoting third-party services require your opt-in consent.
3. Your Choices: You may opt out of marketing at any time. Opting out does not affect clinical communications.

24.How We Protect Your Information

1. Security Measures: We implement physical, technical, and administrative safeguards to protect your Personal Data and PHI, including:
   1. Encrypted electronic storage and transmission
   2. Secure physical storage of paper records
   3. Access controls and authentication
   4. Staff training on privacy and security
   5. Business associate agreements with third-party vendors
   6. Regular security assessments
2. Limitations: Despite our efforts, no security system is completely secure. We cannot guarantee the absolute security of your information.
3. Breach Notification: In the event of a breach of your Personal Data or PHI, we will notify you as required by law, including within the timeframes specified by HIPAA and applicable state law.

25.Retention of Information

1. Website Data: Personal Data collected through the Website is retained as long as necessary to fulfill the purposes described in this Privacy Policy or as required by law.
2. Mental Health Records: We retain mental health treatment records in accordance with HIPAA and Oklahoma law:
   1. Adult Clients: Minimum of seven (7) years following termination of treatment
   2. Minor Clients: Minimum of seven (7) years following termination or until three (3) years after the minor reaches age 18, whichever is longer
3. Destruction: Upon expiration of retention periods, records are securely destroyed so that information cannot be recovered.

26.Your Rights

You have the following rights regarding your Personal Data and PHI:

1. Right to Access: You have the right to inspect and obtain a copy of your PHI maintained in our records. Requests must be in writing. We may charge a reasonable fee for copies.
2. Right to Amend: If you believe information in your record is inaccurate or incomplete, you may request an amendment in writing. We will respond as required by HIPAA.
3. Right to an Accounting of Disclosures: You may request a list of certain disclosures of your PHI made by us for purposes other than treatment, payment, or healthcare operations.
4. Right to Request Restrictions: You may request restrictions on how we use or disclose your PHI. We are not required to agree to all restrictions, but if we do, we will honor them.
5. Right to Confidential Communications: You may request that we communicate with you by specific means or at specific locations (for example, only by mail to a specific address).
6. Right to a Paper Copy: You have the right to obtain a paper copy of this Privacy Policy and our Notice of Privacy Practices upon request.
7. Right to Revoke Authorization: If you have signed an authorization for disclosure of PHI, you may revoke it at any time in writing, except to the extent we have already acted in reliance on it.
8. Right to Opt Out: You may opt out of marketing communications at any time.
9. Right to File a Complaint: If you believe your privacy rights have been violated, you may file a complaint with:
   Legacy Family Services
   info@legacyfs.org
   (405) 370-4594
   
   U.S. Department of Health and Human Services, Office for Civil Rights
   www.hhs.gov/ocr
   
   Oklahoma State Board of Behavioral Health Licensure
   (405) 522-3267
   www.ok.gov/behavioralhealth
   We will not retaliate against you for filing a complaint.

27.Opting Out of Marketing

You may opt out of marketing communications at any time by:

1. Clicking the unsubscribe link in any marketing email
2. Replying STOP to any marketing text message
3. Contacting us at info@legacyfs.org

Opting out of marketing does not affect clinical or transactional communications related to your care.

28.Do Not Track

Some browsers offer a "Do Not Track" feature. Our Website does not currently respond to Do Not Track signals.

29.Children's Privacy

Our Website is not intended for children under 13. We do not knowingly collect Personal Data from children under 13 through the Website. If you believe we have collected information from a child under 13, please contact us immediately.

This provision does not affect our provision of mental health Services to minor Clients with appropriate parental or guardian consent.

30.Third-Party Links

Our Website may contain links to third-party websites. We are not responsible for the privacy practices of those sites. We encourage you to review the privacy policies of any site you visit.

31.Acceptance of Risk

By using our Website or Services, you acknowledge that no transmission of information via the internet or electronic storage is completely secure. You transmit information at your own risk.

32.Governing Law

This Privacy Policy is governed by the laws of the State of Oklahoma and applicable federal laws, including HIPAA.

33.Changes to This Privacy Policy

We may update this Privacy Policy periodically. The Effective Date at the top indicates when the policy was last revised. Material changes will be communicated as described in Article 5.

34.Contact Us

If you have questions about this Privacy Policy, wish to exercise your rights, or have concerns about our privacy practices, please contact us: