Privacy Policy
Effective Date: February 10, 2026
Introduction
Elevated Therapy (“we,” “us,” or “our”) provides psychotherapy, counseling, and related mental‑health services to individuals residing in Maryland. Protecting the confidentiality and privacy of your personal and health information is a core professional and legal obligation. This Privacy Policy explains what information we collect, how we use and protect it, and your rights under applicable federal and Maryland law.
Information We Collect
Personal Identifiers
Examples: Name, date of birth, address, phone, email, emergency‑contact details
Why We Collect:To identify you, schedule appointments, and communicate with you.
Health Information
Examples: Diagnosis, treatment notes, progress notes, medication lists, test results
Why We Collect: To provide, coordinate, and document clinical care (HIPAA‑covered information).
Payment & Billing
Examples: Insurance information, credit‑card data, invoices, receipts
Why We Collect: To submit claims, process payments, and fulfill financial obligations.
Website Interaction
Examples: IP address, browser type, cookies, analytics data
Why We Collect: To improve our website, monitor security, and comply with legal requirements.
Tele‑health Session Data
Examples: Audio/video recordings (if expressly consented), session logs
Why We Collect: To deliver remote therapy in compliance with Maryland tele‑health statutes.
How We Collect Information
During intake – electronic forms completed via secure patient portal, or during a tele‑health session.
Through our website – Cookies and web‑beacon technologies (see Website Cookies & Tracking section).
From third parties – Health‑insurers, referral sources, or other providers (only as needed for treatment or billing).
All electronic collection is performed over encrypted (TLS/SSL) connections that meet HIPAA standards.
Uses of Your Information
We may use your information for the following legitimate purposes:
Treatment & Clinical Care – Diagnosis, therapy, coordination with other health professionals, and continuity of care.
Administrative Functions – Scheduling, reminders, record‑keeping, and quality‑improvement activities.
Billing & Collections – Claim submission, payment processing, and insurance verification.
Legal & Regulatory Compliance – Reporting child abuse or neglect, responding to subpoenas, court orders, or other lawful requests (Maryland Courts & Judicial Proceedings § 5‑609).
Communications – Sending appointment confirmations, newsletters, or practice updates (you may opt out at any time).
Security & Auditing – Detecting unauthorized access, protecting against breaches, and maintaining system integrity.
We never sell or rent your personal information to third parties for marketing purposes.
Disclosure of Your Information
We may disclose your information only as permitted or required by law, including:
With your explicit written consent (e.g., to share records with another therapist).
To health‑care providers involved in your treatment, under a Business Associate Agreement.
To insurers for claim processing.
To law‑enforcement or courts when we receive a valid subpoena, court order, or mandatory reporting request (e.g., suspected child abuse).
To emergency contacts when a safety risk is identified and you have authorized such contact.
Any disclosure follows the “minimum necessary” standard under HIPAA and Maryland privacy statutes.
Data Security Measures
Technical safeguards – Encryption at rest and in transit, firewalls, intrusion‑detection systems, and regular vulnerability assessments.
Physical safeguards – Secure storage rooms, locked cabinets for paper records, and controlled access to server facilities.
Administrative safeguards – Staff training on confidentiality, signed confidentiality agreements, role‑based access controls, and incident‑response procedures.
We retain records in accordance with Maryland law: generally seven (7) years after the last patient contact for adult records and ten (10) years for minor‑patient records, unless a longer retention period is required by a specific statute.
Your Rights
Under HIPAA and Maryland law you have the right to:
Access – Request a copy of your health record (reasonable fees may apply).
Amend – Request corrections to inaccurate information.
Accounting of disclosures – Receive a list of disclosures made in the past six years.
Restrict – Request limits on certain uses/disclosures (subject to professional judgment).
Confidential communications – Request that we communicate with you at an alternate address or phone number.
File a complaint – Submit a grievance to our Privacy Officer or to the U.S. Department of Health & Human Services Office for Civil Rights.
Website Cookies & Tracking
Our website uses session cookies to keep you logged in to the patient portal and analytics cookies (e.g., Google Analytics) to understand site usage. All analytics data is aggregated and anonymized; no personally identifiable information is shared with third parties. You may disable cookies through your browser settings, though doing so may affect site functionality.
Third‑Party Service Providers
We may engage vendors for:
Cloud hosting – HIPAA‑compliant cloud services (Business Associate Agreements in place).
Electronic health‑record (EHR) system – Secure, encrypted platform meeting all federal and state privacy standards.
Email/communication tools – Encrypted mailing services for patient correspondence.
Each vendor is contractually obligated to protect your data consistent with HIPAA and Maryland privacy requirements.
Changes to This Policy
We review this Privacy Policy annually or whenever a material change in law or practice occurs. Updated versions will be posted on our website with a revised “Effective Date.” Continued use of our services after posting constitutes acceptance of the revised terms.
Contact Information
Privacy Officer: Vanessa Senatus, LCPC
Phone: 240-863-2836
Email: info@elevatedtherapy.co
Mailing Address: 5850 Waterloo Road, Suite 140, Columbia, MD 21045
If you have questions, concerns, or wish to exercise any of your rights, please contact the Privacy Officer using the information above.