Privacy Policy

1.1 Information you give us

We collect information you choose to provide, including:

• Contact form submissions: your name, phone number, email address, and the content of the message you write in the “How can we help?” field.
• Phone and email inquiries: your name, contact information, the general nature of the support you are seeking, insurance carrier and plan information, and scheduling preferences.
• Insurance and benefits verification information: member identification number, group number, date of birth, plan name, and employer or plan sponsor.
• Information about another person: if you contact us on behalf of a family member or loved one, the information you provide about that person.
• Employment inquiries: resume, work history, credentials, and licensure information submitted by job applicants.

Once information you provide is used or maintained by us in connection with treatment, payment, or health care operations, it becomes PHI and is protected under our Notice of Privacy Practices and applicable federal and Texas law.

1.2 Information collected automatically

When you visit the Site, our servers and the technology providers we use may automatically collect:

• IP address and approximate geographic location derived from it
• Browser type and version, operating system, device type, and screen size
• Referring URL and exit pages
• Pages viewed, time spent on pages, scroll depth, and links or buttons clicked
• Date and time of your visit and a session or device identifier
• Whether you clicked a phone number, directions link, or contact form

1.3 Information from other sources

• Analytics and advertising platforms that report aggregate campaign performance to us
• Health plans and payers, in response to benefits verification requests
• Referring physicians, therapists, employee assistance programs, and other providers
• Publicly available business directories and mapping services

The Site uses cookies, pixels, tags, local storage, and similar technologies. We group them into three categories.

Strictly necessary

Required for the Site to function, including security, load balancing, form submission, and spam prevention. These cannot be disabled through the Site.

Performance and analytics

Help us understand how visitors find and use the Site so we can improve navigation, page speed, and content. Currently in use: Microsoft Clarity.

Advertising and conversion measurement

Used to measure the performance of paid campaigns and, where applicable, to show you Saltwood advertising on other sites. Currently in use: None.

2.1 Session replay

One of the tools above, Microsoft Clarity, does more than count visits. It records your interaction with a page — pointer movement, clicks and taps, scrolling, and the sequence of pages you move through — and lets us play that interaction back as a recording of the visit, and view it combined with other visits as a heat map. We use this to find navigation and layout problems, not to identify you.

We are telling you this plainly because a recording of a visit is different in kind from a count of visits, and because of what this Site is about. The pages you read here can reveal what you may be seeking care for.

• What is masked. The contact form is configured so that what you type into it — your name, your email address, your phone number, and the free-text description of what you are experiencing — is not captured in the recording. This is set on the form itself, not left to the vendor’s defaults.
• What is recorded. Which pages you viewed and in what order, how far you scrolled, and where you clicked. Combined with the technical details in section 1.2, this can indicate which conditions or programs you were reading about.
• Where it goes. Recordings are processed and stored by Microsoft as the analytics provider. Microsoft’s handling of that data is governed by its own privacy statement.
• Where it does not run. Consistent with the controls in section 2.2, session replay is not present in any authenticated patient portal, scheduling system, telehealth platform, or electronic health record.

If you would rather not be recorded, you can block the tool through your browser’s tracking-protection or content-blocking settings, or by using an extension that blocks analytics scripts. Doing so does not affect your ability to use the Site, reach us, or receive care.

2.2 Our controls on tracking technologies

Because we are a mental health provider, we apply tighter controls to tracking than a general commercial website would:

• We do not place third-party advertising or analytics tags inside any authenticated patient portal, patient scheduling system, telehealth platform, or electronic health record.
• We do not configure third-party tags to capture the contents of contact form fields, the text of your message, or any free-text entry.
• We do not send information to an advertising platform for the purpose of identifying you as a person seeking treatment for a specific condition.
• Where a vendor may receive information that constitutes PHI, we execute a business associate agreement with that vendor before it receives the information, or we obtain your written HIPAA authorization.
• We review the tags loading on the Site on a recurring basis and remove any that are not covered by an executed agreement.

Legal background. In June 2024, a federal court in the Northern District of Texas vacated the portion of guidance from the HHS Office for Civil Rights that had treated the combination of a visitor’s IP address and a visit to an unauthenticated public webpage about a health condition or provider as protected health information. HHS withdrew its appeal in August 2024. We describe our practices here so you can see what we actually do, regardless of how that guidance evolves.

2.3 Your cookie choices

• Most browsers let you refuse or delete cookies through their settings. Blocking strictly necessary cookies may prevent parts of the Site from working.
• If we use Google Analytics, you can install the Google Analytics Opt-out Browser Add-on.
• You can limit interest-based advertising through the settings offered by the relevant ad platform and through industry opt-out tools such as the Digital Advertising Alliance and the Network Advertising Initiative.
• To stop session replay specifically, block analytics scripts in your browser or through a content-blocking extension, as described in section 2.1.
• Global Privacy Control: we honor the Global Privacy Control (GPC) browser signal as an opt-out of targeted advertising and any sharing of personal data for that purpose.

• To respond to your inquiry, answer questions, and schedule a confidential admissions call
• To verify insurance benefits and explain coverage and estimated cost
• To determine clinical fit and the appropriate level of care
• To provide, coordinate, and manage treatment, and to obtain payment for it
• To operate, secure, troubleshoot, and improve the Site
• To measure which pages, search terms, and campaigns bring people to us
• To send appointment reminders and administrative messages you have asked to receive
• To send treatment-related communications and, where permitted, information about our programs. We obtain your written authorization for any communication that qualifies as marketing under HIPAA
• To comply with law, respond to lawful requests, and enforce our Terms of Use
• To evaluate employment applications

We share information only as described below.

• Service providers and business associates: website hosting, form processing, telephony, secure messaging, electronic health record, practice management, billing and claims clearinghouse, telehealth, analytics, and IT security vendors. Any vendor that handles PHI on our behalf signs a business associate agreement requiring it to safeguard the information and to use it only for the purposes we specify.
• Health plans and payers: for benefits verification, prior authorization, claims, and appeals.
• Other health care providers: for treatment and care coordination, consistent with our Notice of Privacy Practices and Texas law.
• Legal, regulatory, and safety: when required by law, in response to a valid subpoena, court order, or government request, to report abuse or neglect as Texas law requires, or to prevent a serious and imminent threat to the health or safety of any person.
• Professional advisors: attorneys, accountants, auditors, and insurers, under confidentiality obligations.
• Business transfers: in connection with a merger, acquisition, financing, or sale of assets, subject to the protections HIPAA requires.
• At your direction: when you ask us to share information or sign a valid authorization.

We do not sell your personal information. We do not sell PHI, and we do not disclose PHI to third parties for their own marketing purposes without your written authorization. We do not use or disclose psychotherapy notes for marketing under any circumstances without your written authorization.

Phone calls

When you call us, we collect the information you share during the call. Yes — calls to the published number are monitored through call-tracking software.

Text messages

If you provide a mobile number and consent to text messages, we may send appointment reminders, scheduling messages, and administrative updates. Message frequency varies. Message and data rates may apply. Reply STOP to opt out at any time and HELP for assistance. Consent to receive text messages is not a condition of receiving treatment.

Mobile opt-in data and consent are never shared with third parties or affiliates for their own marketing purposes.

Email

Standard email is not a secure channel and can be intercepted or misdirected. Do not send clinical information to our general email address. Once you are in our care, we will offer a secure method for exchanging clinical information, and you may request confidential communications through an alternative means or at an alternative address as described in our Notice of Privacy Practices.

We maintain administrative, physical, and technical safeguards designed to protect information against unauthorized access, use, disclosure, alteration, and destruction. These include access controls and unique user credentials, encryption of PHI in transit and at rest in our clinical systems, workforce training, role-based access limits, audit logging, vendor due diligence, and an incident response process. Our security program is designed to meet the requirements of the HIPAA Security Rule and Chapter 181 of the Texas Health and Safety Code.

No method of transmission or storage is completely secure. If a breach of unsecured PHI occurs, we will notify affected individuals and the appropriate authorities as required by the HIPAA Breach Notification Rule and Section 521.053 of the Texas Business and Commerce Code.

We retain website inquiry information for as long as needed to respond to you and for a reasonable period afterward, and then delete or de-identify it. Clinical and billing records are retained in accordance with Texas Medical Board rules, Texas Health and Safety Code Chapter 611, our payer agreements, and applicable statutes of limitation. Our current retention schedule is seven years from the date of last service for adult patients; for minors, until the patient reaches age 21 or seven years after the last date of service, whichever is longer. HIPAA compliance records, including Notice of Privacy Practices acknowledgments and policies, are retained for six years. Data submitted through website contact forms is retained for twenty-four months.

Rights in your health information

Your rights to access, amend, restrict, and receive an accounting of disclosures of your PHI are described in our Notice of Privacy Practices. Two Texas provisions are worth calling out here:

• Electronic records within 15 business days. Under Section 181.102 of the Texas Health and Safety Code, if we use an electronic health record system capable of fulfilling your request, we will provide your electronic health record in electronic form no later than the 15th business day after we receive your written request, unless you agree to another format or an exception under 45 C.F.R. 164.524 applies.
• Authorization for electronic disclosure. Under Section 181.154 of the Texas Health and Safety Code, we do not electronically disclose your PHI without a separate authorization from you for each disclosure, except where the disclosure is to another covered entity for treatment, payment, health care operations, or an insurance function, or is otherwise authorized or required by state or federal law. The required notice appears in our Notice of Privacy Practices and is posted at our clinic.

Rights in other personal information

The Texas Data Privacy and Security Act contains an entity-level exemption for covered entities governed by HIPAA, so it does not generally apply to Saltwood. As a matter of practice, and subject to verification of your identity, you may ask us to:

• Confirm whether we hold personal information about you and provide a copy
• Correct inaccurate personal information
• Delete personal information you submitted through the Site, where we are not required to retain it
• Opt out of targeted advertising

We do not discriminate against anyone for exercising these rights. Requests that concern PHI are handled under the process in our Notice of Privacy Practices, which sets its own deadlines and grounds for denial.

Marketing preferences

You may unsubscribe from marketing email using the link in any such message, reply STOP to any text message, or contact our Privacy Officer using the details in Section 13.

Saltwood provides treatment to adults only. The Site is directed to adults 18 and older. We do not knowingly collect personal information from anyone under 18 through the Site. If you believe a minor has submitted information to us, contact our Privacy Officer and we will delete it. If you are under 18 and in crisis, call or text 988.

The Site links to and embeds content from third parties, including a map provided by Mapbox, directions links to Google Maps, and, where applicable, a telehealth platform, an online scheduling tool, and a payment processor. Those services have their own privacy practices, and this Privacy Policy does not govern them. Review their policies before providing information to them.

Saltwood provides in-person care in Dallas, Texas, and telehealth to individuals located in Texas. The Site is operated from and hosted in the United States. If you access the Site from another state or country, you do so on your own initiative and your information will be processed in the United States under United States law.

We may update this Privacy Policy. The “Last Updated” date at the top reflects the most recent version. Material changes will be posted on this page, and where the law requires, we will provide additional notice. Changes to how we handle PHI are made through our Notice of Privacy Practices.

Direct questions, requests, or complaints about privacy to our Privacy Officer:

You may also file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights, or with the Consumer Protection Division of the Office of the Attorney General of Texas. We will not retaliate against you for filing a complaint.