Privacy Policy

DRAFT — pending attorney review

This page is a draft prepared by Managed Mental Health's website consultant, Intuitive Context Consulting, for review by Managed Mental Health's own attorney. Intuitive Context Consulting is not a law firm and this draft is not legal advice. It will not be published until Managed Mental Health's attorney has reviewed, revised, and approved it.

Please do not share health details on this site

This website is not a secure channel for health information. Please do not type symptoms, diagnoses, medications, treatment history, or any other health details into our contact form, our newsletter sign-up, or an email to us. Share only what we need in order to reach you back — your name and how to contact you.

If you need to discuss anything clinical, please call our Hialeah office at (786) 233-6721 or our Plantation office at (954) 666-5942, and we will talk with you directly.

If you are in crisis, do not wait for a reply from this website. Call or text 988 (the Suicide & Crisis Lifeline, available in English and Spanish, 24/7), call 911, or go to your nearest emergency room.

This policy covers the website only — not your medical records

This Privacy Policy describes how this website (managedmentalhealthllc.com) collects and uses information — for example, when you fill out the contact form or sign up for our email newsletter. It does not cover, and this website is not a channel for, protected health information (PHI) such as clinical records, diagnoses, or treatment history.

How we use and protect protected health information collected in the course of your care is governed by our HIPAA Notice of Privacy Practices, not by this page. If you need to share anything clinical, please call our Hialeah office at (786) 233-6721 or our Plantation office at (954) 666-5942 rather than emailing or using the contact form.

Information we collect

Contact form: if you use our contact form, we collect the information you provide — typically your name, email address, phone number, and the message you write to us.

Email newsletter: if you sign up for our email newsletter, we collect your email address, and, where you provide it, your name.

Technical information: like most websites, the companies that host this site and deliver our email may automatically log basic technical information — such as IP address and browser type — for security and operational purposes. We do not use this information to build advertising profiles.

Cookies, analytics, and tracking

This website uses Google Analytics 4 (GA4), a Google service that helps us understand how visitors use the site — for example, which pages are viewed, how visitors arrive, and basic device/location information — so we can improve it. GA4 sets first-party cookies to do this. We do not run Google Ads tags, a Meta (Facebook) pixel, or a CAPTCHA service that profiles visitors, and we have turned off Google Signals and ad-personalization signals for this property and enabled Google's restricted data processing setting — this analytics use is not used to build advertising profiles or for remarketing.

We say this deliberately, because health-related browsing is sensitive and mental health browsing especially so; our analytics use is limited to aggregate site-usage patterns, never anything about a specific visitor's health condition or reason for visiting. If our use of analytics or cookies changes further, we will update this Privacy Policy before turning the change on.

[TO BE CONFIRMED BY COUNSEL: this section now reflects that GA4 is live on the rebuilt site (measurement ID configured via an environment variable, not hardcoded — see VITE_GA4_ID). Before adoption, counsel should confirm (1) whether GA4's first-party cookies require a cookie-consent banner under any law applicable to this site's patient population, (2) that Google's standard terms for GA4 are an acceptable data-processing arrangement for a healthcare-adjacent site absent a signed BAA (Google does not offer a BAA for standard GA4), and (3) that no other tracking, advertising, scheduling-widget, or chat-widget script is added by any other party — for example a marketing vendor, a directory listing, or a future scheduling integration — because a statement like this one that stops being true is a materially worse exposure than never having made it. (docs/OUTSTANDING-ITEMS.md O12.)]

How we use your information

We use the information you submit to respond to your message, schedule or discuss an appointment, send you materials you requested (such as our 5 Minutes of Calm guide), and, if you've opted in, send you our email or text newsletter with appointment reminders, wellness tips, and occasional promotional messages. We do not sell your information, and we do not use it for third-party advertising.

Who we share it with

We share information only with the service providers that help us operate this website and communicate with you — our website hosting provider (Railway), our email-delivery provider (Mailgun), and our media-hosting provider (Cloudflare), which delivers the videos on this site — and only as needed for them to provide that service to us. We do not sell your personal information to third parties, and we do not share it with third parties for their own marketing purposes.

We may also disclose information where required by law, such as in response to a valid legal request.

[TO BE CONFIRMED BY COUNSEL — DECISION REQUIRED: whether this policy commits Managed Mental Health to a HIPAA business associate agreement with every vendor that receives information submitted through this Site. The redline prepared for the practice contains that commitment, naming form, scheduling, and email/text providers. The site as built takes the opposite approach — it collects only name, contact details, and a non-clinical reason for contact, stores nothing, and relays the message to the practice's own inbox — so the commitment as written is broader than what the current vendor stack was chosen to support, and Mailgun's own HIPAA/BAA posture has not been verified by Intuitive Context. Counsel must either narrow this clause to match the collect-nothing/store-nothing reality, or keep it and direct the practice to BAA-capable vendors. Publishing the clause without honoring it would be worse than either option. (docs/OUTSTANDING-ITEMS.md O3 and L4.)]

How long we keep it

Messages submitted through our contact form are sent directly to our staff by email through our email-delivery provider; the message content itself is not stored in a database on this website. If you sign up for our email newsletter, we keep your email address for as long as you remain subscribed, and remove it when you unsubscribe.

How we protect your information, and what happens if there is a breach

We use reasonable administrative and technical safeguards to protect the information submitted through this website. No website or email system can be guaranteed completely secure, which is why we ask you not to send health details through this site.

If a security breach affects personal information we hold, we will notify affected individuals and any government agency that the law requires us to notify, within the time limits the law sets.

[TO BE CONFIRMED BY COUNSEL: whether to state specific breach-notification deadlines on this page, and which. Fla. Stat. § 501.171(4)(a) sets 30 days for individual notice; 45 CFR § 164.404(b) allows up to 60 days for breaches of protected health information. IMPORTANT — an earlier draft of this paragraph said the shorter deadline simply governs wherever both apply, and that is too crude: Fla. Stat. § 501.171(4)(g) provides a SAFE HARBOR under which notice given in accordance with the rules of the entity's primary or functional federal regulator is deemed to satisfy the Florida statute, so HIPAA-compliant breach notification can itself discharge the Florida obligation. That materially changes what this page should promise, and it is a legal determination rather than a drafting preference. This draft is therefore deadline-neutral so it cannot overstate or understate either clock. Counsel should decide whether to name any number here at all or leave it to the practice's incident-response policy — and confirm that someone at the practice actually owns that process, because it is an operational commitment, not just a sentence. Note also that the Federal Trade Commission's Health Breach Notification Rule (16 CFR Part 318) does NOT add a third regime here: § 318.1(a) expressly excludes HIPAA-covered entities.]

[TO BE CONFIRMED BY COUNSEL: the response time this policy commits to for access, correction, and deletion requests. The redline stated 45 days. That is a reasonable commitment and a common one, but it is an operational promise — the practice must name someone who owns intake, tracking, and response for these requests before it is published. Counsel should also confirm whether any of these website-level requests could in fact reach protected health information, in which case the HIPAA rights and timelines in our Notice of Privacy Practices govern instead, and this page should say so rather than create a second, conflicting standard.]

Children's privacy

This website's contact form and newsletter sign-up are intended for use by adults. We do provide counseling services for children and teens, and we have a page describing those services — but information about a minor submitted through this website should be submitted by a parent or guardian rather than by the minor.

[TO BE CONFIRMED BY COUNSEL: whether "intended for adults" accurately describes how this practice actually receives inquiries about minors, and whether it sits correctly alongside Florida law. This practice serves children and teens and publishes a dedicated page for them, so some website inquiries will predictably come from adolescents themselves. Fla. Stat. § 394.4784 lets a minor 13 or older consent on their own to a limited course of outpatient therapy, which means a blanket "adults only" framing on the website can understate a right the minor actually has. Counsel should reconcile this paragraph with the intake reality and with the minors section of our Notice of Privacy Practices so the two documents do not say different things. (docs/OUTSTANDING-ITEMS.md §Redline item 9.)]

Changes to this policy

We may update this Privacy Policy from time to time. The current version will always be posted on this page.

Contact us

Questions about this Privacy Policy can be sent to [email protected], or you may call our Hialeah office at (786) 233-6721 or our Plantation office at (954) 666-5942.

[TO BE CONFIRMED BY COUNSEL: effective/last-updated date — to be set when this draft is approved and published.]