Privacy Policies

True Self Practice — A DBA of Your True Self Family Therapy

Effective Date: July 25, 2026

This Privacy Policy describes how True Self Practice (“we,” “us,” “our,” or “the Practice”) collects, uses, discloses, and protects your information when you visit our website at trueselfpractice.com or receive services from our practice.

This Privacy Policy also constitutes our Notice of Privacy Practices as required by the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”). It describes how your Protected Health Information (“PHI”) may be used and disclosed and how you may access this information. Please review this policy carefully.

By using our website, you acknowledge that you have read and understood this Privacy Policy. If you are a client of our practice, you will be asked to separately acknowledge receipt of this notice as part of the intake process.

1. Our Commitment to Your Privacy

We understand that your personal and health information is sensitive. We are committed to protecting the information we collect and maintain about you. When you receive care from True Self Practice, we create a record of the services provided to you. We need this record to deliver quality care and to comply with legal requirements. This policy explains how we may use and disclose your information, your rights with respect to your information, and our obligations regarding the use and disclosure of your information.

2. Our Legal Obligations

By law, we are required to: (i) make sure that Protected Health Information that identifies you is kept private; (ii) provide you with this notice of our legal duties and privacy practices; (iii) follow the terms of this policy as currently in effect; and (iv) notify you in the event of a breach of your unsecured PHI, as described in Section 11 of this policy.

3. Information We Collect

3.1 Information Collected from Website Visitors.

Our website does not use analytics tools, tracking pixels, or third-party data collection services. We do not automatically collect information about your browsing activity, IP address, or device when you visit our website. We may collect information you voluntarily provide through our website, including your name, email address, phone number, and any other information you submit through contact forms, consultation request forms, or other website features.

3.2 Information Collected from Clients.

When you become a client of our practice, we collect additional information necessary to provide your care, including: (i) contact and demographic information such as name, date of birth, address, phone number, email address, and emergency contacts; (ii) health and clinical information, including mental health history, diagnoses, treatment records, clinical notes, and psychotherapy notes; (iii) billing and payment information; and (iv) any other information relevant to your treatment. This information constitutes Protected Health Information under HIPAA and is subject to the protections described in this policy.

4. How We Use and Disclose Your Information

The following sections describe the different ways we may use and disclose your information. Not every specific use or disclosure in a category is listed, but all permitted uses and disclosures will fall within one of these categories.

4.1 Website Information.

We use information you voluntarily provide through our website to: (i) respond to your inquiries and contact requests; and (ii) comply with legal obligations. We do not sell, rent, or trade website visitor information to third parties for marketing purposes.

4.2 For Treatment, Payment, or Health Care Operations.

Federal privacy rules allow health care providers who have a direct treatment relationship with you to use or disclose your PHI without your written authorization for the provider’s own treatment, payment, or health care operations. For example:

(i) Treatment. If your therapist consults with another licensed health care provider about your condition, we may use and disclose your PHI to assist in the diagnosis and treatment of your mental health condition. Treatment disclosures are not limited to the minimum necessary standard because providers need access to full and complete information to provide quality care. Treatment includes coordination and management of care, consultations between providers, and referrals from one provider to another.

(ii) Clinical Director Oversight. Hanouf Alahmari, LMFT, serves as the Clinical Director of True Self Practice. In this capacity, Ms. Alahmari has access to all client clinical records and may review your file and discuss your case with your assigned therapist for purposes of clinical oversight, quality assurance, and professional consultation. This applies regardless of which therapist provides your direct care.

(iii) Payment. We may use and disclose your PHI to bill and collect payment for the services we provide, including generating superbills for out-of-network reimbursement at your request.

(iv) Health Care Operations. We may use and disclose your PHI for practice operations, including quality assessment and improvement activities, clinical supervision, professional training, and administrative functions necessary to run the practice.

4.3 AI-Assisted Treatment Activities.

As described in our separate Consent for Use of AI Tools and Session Audio Recording, we use SimplePractice’s Note Taker feature to record and transcribe therapy sessions for the purpose of preparing clinical documentation. Session recordings, transcripts, and draft notes generated through Note Taker are treated as PHI and are subject to the same privacy and security protections described in this policy. Use of Note Taker is governed by the AI Tools consent form, which is provided to you separately. Detailed information about how recordings and transcripts are created, retained, de-identified, and deleted is contained in that form.

4.4 Disclosures That Do Not Require Your Authorization.

Subject to certain limitations in law, we may use and disclose your PHI without your authorization for the following purposes: (i) when disclosure is required by state or federal law, and the use or disclosure complies with and is limited to the relevant requirements of such law; (ii) for public health activities, including reporting suspected child, elder, or dependent adult abuse, or preventing or reducing a serious threat to anyone’s health or safety; (iii) for health oversight activities, including audits and investigations; (iv) for judicial and administrative proceedings, including responding to a court or administrative order, although our preference is to obtain your authorization before doing so; (v) for law enforcement purposes, including reporting crimes occurring on our premises; (vi) to coroners or medical examiners performing duties authorized by law; (vii) for research purposes, provided appropriate safeguards are in place, including studying and comparing mental health outcomes across different forms of therapy; (viii) for specialized government functions, including military missions, protection of the President, intelligence or counterintelligence operations, or safety of persons working within or housed in correctional institutions; (ix) for workers’ compensation purposes, although our preference is to obtain your authorization; and (x) for appointment reminders and to tell you about treatment alternatives or other health care services or benefits we offer.

4.5 Lawsuits and Disputes.

If you are involved in a lawsuit, we may disclose health information in response to a court or administrative order. We may also disclose health information in response to a subpoena, discovery request, or other lawful process by someone involved in the dispute, but only if efforts have been made to notify you of the request or to obtain an order protecting the information.

4.6 Disclosures That Require Your Authorization.

The following uses and disclosures of your PHI require your written authorization:

(i) Psychotherapy Notes. We make and keep psychotherapy notes. Any use or disclosure of such notes requires your authorization unless the use or disclosure is: (a) for our use in treating you; (b) for our use in training or supervising mental health practitioners to improve their skills in counseling or therapy; (c) for our use in defending ourselves in legal proceedings; (d) for use by the Secretary of Health and Human Services to investigate our compliance with HIPAA; (e) required by law and limited to the requirements of such law; (f) required by law for certain health oversight activities pertaining to the originator of the notes; (g) required by a coroner performing duties authorized by law; or (h) required to help avert a serious threat to the health and safety of others.

(ii) Marketing. We will not use or disclose your PHI for marketing purposes.

(iii) Sale of PHI. We will not sell your PHI.

4.7 Disclosures to Family Members or Others Involved in Your Care.

We may provide your PHI to a family member, friend, or other person you indicate is involved in your care or payment for your health care, unless you object in whole or in part. In emergency situations, the opportunity to object may be provided after the fact.

5. Cookies and Tracking Technologies

Our website does not use cookies, analytics tools, tracking pixels, or similar technologies. We do not use Google Analytics, Meta Pixel, Google Maps, or any other third-party tracking or advertising services on our website. No data about your browsing behavior is collected, stored, or shared with third parties when you visit our website.

6. Technology Platforms

We use the following technology platforms in connection with your care. Each platform is subject to a Business Associate Agreement as required by HIPAA:

SimplePractice — Electronic Health Record and practice management platform used for clinical documentation, scheduling, billing, client portal access, and AI-assisted note-taking (Note Taker). SimplePractice is HIPAA-compliant and HITRUST certified. Our client portal is hosted and operated by SimplePractice. When you access the client portal, your use of that platform is also subject to SimplePractice’s own privacy policy, available at www.simplepractice.com/privacy.

Additional platforms may be used for scheduling, communication, or payment processing. We will notify you if material changes are made to the platforms used in connection with your care.

7. Third-Party Websites

Our website may contain links to third-party websites, services, or resources that are not operated or controlled by us. This Privacy Policy does not apply to third-party websites. We are not responsible for the privacy practices, content, or security of any third-party websites. We encourage you to review the privacy policies of any third-party websites you visit before providing any personal information.

8. Your Rights

8.1 Right to Request Limits on Uses and Disclosures.

You have the right to ask us not to use or disclose certain PHI for treatment, payment, or health care operations purposes. We are not required to agree to your request, and we may decline if we believe it would affect your health care.

8.2 Right to Request Restrictions for Services Paid Out-of-Pocket in Full.

You have the right to request restrictions on disclosures of your PHI to health plans for payment or health care operations purposes if the PHI pertains solely to a health care item or service that you have paid for out-of-pocket in full. We are required to agree to this request.

8.3 Right to Choose How We Contact You.

You have the right to ask us to contact you in a specific way or to send communications to a different address, and we will agree to all reasonable requests.

8.4 Right to Access and Copy Your PHI.

Other than psychotherapy notes, you have the right to get an electronic or paper copy of your medical record and other information that we maintain about you. We will provide you with a copy of your record, or a summary of it if you agree to receive a summary, within 30 days of receiving your written request. We may charge a reasonable, cost-based fee for copies.

8.5 Right to an Accounting of Disclosures.

You have the right to request a list of instances in which we have disclosed your PHI for purposes other than treatment, payment, health care operations, or disclosures you authorized. We will respond within 60 days of receiving your request. This list will include disclosures made in the last six years unless you request a shorter period. We will provide the first list in any 12-month period at no charge; we may charge a reasonable fee for additional requests within the same period.

8.6 Right to Request Corrections.

If you believe there is a mistake in your PHI or that important information is missing, you have the right to request that we correct or add to the existing information. We may decline your request, but we will tell you why in writing within 60 days.

8.7 Right to a Copy of This Policy.

You have the right to get a paper or electronic copy of this Privacy Policy at any time, even if you previously agreed to receive it electronically.

8.8 California Online Privacy Rights.

Under the California Online Privacy Protection Act, California residents who use our website have the right to know what personal information we collect, how we use it, and with whom we share it. This Privacy Policy satisfies those disclosure requirements. We do not track website visitors across third-party websites and do not respond to Do Not Track browser signals.

California Confidentiality of Medical Information Act (CMIA)

In addition to the federal protections described above, we comply with California’s Confidentiality of Medical Information Act (CMIA) (Cal. Civ. Code §56 et seq.). As a mental health practice, we give particular attention to the CMIA’s expansion under Assembly Bill 2089 (AB 2089), which extends the CMIA’s confidentiality protections to mental health information — including information relating to a person’s mental or behavioral health and substance use — and treats providers and businesses that offer mental health services, including digital mental health services, to California residents as subject to the CMIA. We treat your mental health information as confidential medical information: we do not sell it, we do not use or disclose it for marketing or advertising, and we do not share it with third parties except as necessary to provide your care or as required or permitted by law. Consistent with California law, we also will not disclose your medical information in response to out-of-state inquiries or legal process concerning care that is lawful in California, except where disclosure is required by California or federal law.

9. Data Security

We implement appropriate administrative, technical, and physical safeguards to protect your information from unauthorized access, use, alteration, or disclosure. These safeguards include encryption, access controls, secure data storage, and workforce training on privacy and security practices. However, no method of electronic transmission or storage is completely secure, and we cannot guarantee absolute security of your information.

10. Data Retention

10.1 Clinical Records.

Your clinical records, including treatment records and billing information, will be retained in accordance with applicable California and federal law. Under California law, adult client records are retained for a minimum of seven (7) years following the date of the last service provided. Records of minor clients are retained for a minimum of seven (7) years following the date the minor reaches eighteen (18) years of age. At the end of the applicable retention period, records will be securely destroyed in a manner that prevents unauthorized access or disclosure.

10.2 Website Data.

Information you voluntarily provide through our website, such as contact form submissions, is retained only as long as necessary to respond to your inquiry and is then securely deleted unless you become a client, in which case relevant information becomes part of your clinical record.

11. Breach Notification

In the event of a breach of your unsecured PHI, we will notify you as required by federal law. Notification will be made without unreasonable delay and in no event later than 60 days following the discovery of the breach. Notification will include: (i) a description of what happened; (ii) the types of information involved; (iii) the steps you should take to protect yourself; (iv) what we are doing to investigate and mitigate the breach; and (v) contact information for you to ask questions or obtain additional information.

12. Children’s Privacy

Our website is not directed to children under 13 years of age. We do not knowingly collect personal information from children under 13 through our website. If you believe we have inadvertently collected personal information from a child under 13, please contact us immediately using the information in Section 14 so that we may delete the information. Our practice may provide clinical services to minor clients with appropriate parental or legal guardian consent as described in our Informed Consent for Treatment.

13. Changes to This Policy

We reserve the right to change the terms of this Privacy Policy at any time. Any changes will apply to all information we have about you, including information created or received before the change. The current version of this policy will be posted on our website and will be available upon request through our client portal. We will notify you of material changes to this policy.

14. Contact Us

If you have questions about this Privacy Policy or wish to exercise any of your rights described in this policy, please contact us at:

Filing a Complaint. If you believe we may have violated your privacy rights, you may file a complaint with our Privacy Officer at the contact information above. You may also file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights: (i) By mail: 200 Independence Avenue, S.W., Washington, D.C. 20201; (ii) By phone: 1-877-696-6775; or (iii) Online: www.hhs.gov/ocr/privacy/hipaa/complaints.

We will not retaliate against you for filing a complaint.