Privacy Policy

Purpose and promise

The purpose of this policy is to answer three questions honestly: what we already know about you, why we want to know it, and who else may ever see it. Counseling and psychological practice sometimes need sensitive facts so that we can give useful care. We want that trust to be deserved. As a general promise, we collect the smallest amount of information needed to run the service you ask for, we keep it for the shortest period a lawful obligation allows, and we never sell your personal information to anyone for any amount of money.

Nothing in this policy limits any legal duty we hold under laws about medical privacy, data protection, licensing or health care record keeping. Where a law guarantees you more protection than we can offer here on our own, that law wins. This document is a general statement for everyone who visits the website, submits a form, phones us, or comes in person to the studio in Bountiful. It does not replace the clinician office agreement or the intake consent form you sign at the start of care, both of which speak more directly about your records and your specific plan.

Who we are and the developer of this site

The operator of this website is Godfrey Advanced Psychological Services LLC, a registered limited liability company with its main studio at 2979 Vista Cir, Bountiful - 84010-7814, United States (US). You can always reach us by email at guide@godfreypsych.mom or by phone at +16624401762. The website itself, together with its layout, wording, and online tools, was prepared under the developer name GodfreyPsych, and references in later sections to the site or to our online presence include work completed under that developer name.

When this policy uses the words we, us, or our, it means Godfrey Advanced Psychological Services LLC and the licensed clinicians, trainees under supervision, administrative staff and approved assistants who act on its behalf. When it uses the word you, it means any visitor to the website, any person who leaves a message, and any client or prospective client of the practice. People who are younger than eighteen often contact us through a parent or guardian, and we treat the guard for a minor as acting on the behalf of that child in all matters of consent and records.

Information we collect

We group the information we collect into three baskets. The first basket is contact and identity information: your name, an email address, a phone number, a postal address, a date of birth, the name of your child if you write about a minor, and any preferred pronoun or family detail you choose to share in a message. The second basket is the content of your message: the subject line, the questions you ask, the concerns you describe, insurance questions, referral names, school names, and anything else you type into a form or tell us by voice.

The third basket is technical data collected quietly as you browse: internet protocol addresses, device type, browser type and version, the pages you view, how long you stay, the rough city suggested by your network, and referral sources that describe how you found the site. We do not actively look for this technical data to build a profile of random visitors. It mainly helps us keep the website working, keep it safe from abuse, and see which pages genuinely help families.

Ways information is collected

Information reaches us in four main ways. First, you hand it to us directly: through the contact form, through a phone call, through a voice mail, through an email, or through a conversation in the studio. Second, it arrives automatically as ordinary browser activity, through things like server counters and small cookies described later in this policy. Third, someone else may give it to us, for example a school, a physician, a court, or an insurance office that sends a referral, and we always confirm that the sender had a lawful right to share it with us.

Fourth, your device may share a bare minimum of technical data simply because you loaded a page, even if you never type a single character. In every one of these four channels we apply the same idea: if we do not need the detail to serve you, we do not hold it. We would rather collect nothing than collect too much, and we review our forms from time to time to remove fields we can do without.

Health and treatment information

Psychological and counseling services involve facts that most people would call private. Over weeks of care we may be told about moods, behaviours, family history, academic struggles, relationships, grief, medical diagnoses from other providers, medications, and the details of daily life at home. In the language of many privacy laws this material is called protected health information or personal data of a special category, and it receives a higher level of care than an ordinary address would.

We collect this kind of information only when it is necessary for an appointment or an enquiry, we discuss it only with people who have a lawful reason to discuss it, and we note in our clinical record that exchange with each involved party. We do not collect health information through the public website in a structured way. Serious emergencies should always go to local emergency services by dialing 911 or visiting urgent care; the contact form is not a crisis channel and is not monitored around the clock.

How we use the information

Everything we learn is used for one of five jobs. We use it to answer your enquiry, which means matching you with the right clinician, checking your insurance, reserving an appointment time, and sending a confirmation. We use it to provide care, which means keeping a clinical record, preparing an assessment, running a therapy session, writing a report you request, and coordinating with school or medical partners you authorise. We use it to operate the practice, which covers billing, scheduling, staff training, audits, licensing obligations, and compliance with insurers and government bodies.

We use it to keep the website safe, so that we can block automated attacks, notice repeated bad logins, and keep forms from being flooded by machines. We also use it to improve what we offer, by tracking broad patterns such as which service page draws the most attention and whether families return after a first visit. We do not blend your browsing trail with your clinical record unless you have signed a specific consent telling us we may. When we analyse the website, we prefer summaries and groups over individual details.

Legal bases for processing

Different laws allow us to handle your information for different reasons. Where we rely on consent, we ask for it clearly, we make refusal as easy as agreement, and you may withdraw that consent at any time with effect for future activity. Where we rely on a contract, it is the agreement you make with us when you book or begin care, plus any office agreement and fee schedule you sign. Where we rely on a legitimate interest, the interest is the safe running of this small practice and the protection of our clients and staff, and we always balance that interest against your right to privacy first.

Where we rely on a legal obligation, we follow the letter of licensing, tax, insurance, and public health rules even when it conflicts with a wish you expressed. For health information specifically, care often proceeds on your request or implied request, and we tell you which basis applies at the moment you ask. If you live somewhere that asks for extra consent before any health detail may be stored or shared, we obtain that extra consent before we proceed with care.

When we share information

We share personal information only with people who need it, and only up to the amount they need. That circle may include the clinician who treats you, the supervisor who reviews that clinician training cases, a scheduling coordinator who keeps the calendar, a biller who submits an insurance claim with your name on it, and a general or child privacy officer who handles a request from you. Before we open that circle further, we ask your written permission and we record that permission date in your file.

We will also share information when the law compels us: to a court order with proper jurisdiction, to a licensing board that investigates a complaint, to a guardian who holds lawful authority, to a legal guardian or next of kin when you are not able to act for yourself, or to public health officials in an outbreak or to protect someone from a serious and immediate threat. In those rare moments we share only what the law needs and we keep a note of what left the studio and why. Again and always, we never sell personal information.

Vendors and processors

To make the practice run we lean on a small set of outside helpers: a web host that stores the public website, a scheduling and note application that holds appointment records, a telephone and messaging provider, an email service, an analytics tool that counts visitors, and sometimes a professional accountant or lawyer who needs a copy of a document. Each of these helpers acts as our processor and works for us, not for their own marketing list.

Every processor we use enters a written agreement stating that it will touch your information only for the task we assign, will protect it with reasonable safeguards, will never sell it, will tell us promptly about a breach that involves it, and will delete or return the data when our work together ends. We review our vendor list each year and retire any tool that cannot meet this bar. Because our practice is based in Utah and our clients mostly live in the United States, most data stays inside the country.

Cookies and measurement tools

Like nearly every modern website, this one uses small text files known as cookies, together with similar browser storage, to remember that your visit happened and to help the site stay pleasant to use. A strictly necessary cookie keeps the layout steady as you scroll or toggles a menu. A small analytics cookie helps us count page views and see which device you use, and it carries no name and no message you typed. We do not use cookies to follow you across unrelated websites in order to advertise at you.

You may disable or delete cookies in your browser at any time without losing the ability to read this policy or contact us, though a couple of optional conveniences may stop working. Because some of our visitors are children reaching the site through a parent, we keep our analytics limited, do not build long term profiles of specific children, and offer webmasters and visitors the common ability to refuse non essential trackers through browser settings before any data is stored on the device.

Marketing and direct communications

We are a local clinical practice, not an advertising agency, and we keep direct messages gentle and rare. If you ask to hear about new groups or appointment openings, we will send you those reminders by email or text only with your agreement, and every message will carry a simple way to stop that channel. Stopping marketing messages never affects your care. There is no penalty, and we would rather lose a newsletter reader than lose a trusting client.

Marketing photos, session notes, or testimonials that show a real client always need that family written permission before they leave the practice. Until that permission exists, no identifying detail about anyone under care is used in any public material. Service announcements that are truly about your safety, like a closure or a change of address mid course, still reach you regardless of any marketing choice you made, because these are part of caring for you rather than part of promotion.

Security of your data

We treat your data like we treat a child standing near the sand table: with a steady hand and predictable rules. Access to clinical records is limited to staff who need it, protected behind individual logins and strong passwords, and wherever we can we enable an extra security step at sign in. Practice devices are kept updated and encrypted at rest, and files are transmitted to partners over an encrypted channel. Our physical studio is locked, and paper notes, if any exist, live in a locked cabinet with a clear rule about who holds the key.

No safeguard is perfect, and we do not promise that your data can never be lost or taken. What we do promise is diligence: staff training on privacy, reviews of who opens what file, quick reaction to any sign of trouble, and a choice to send reports and appointment reminders only to the channels you approve. You play a part too, and we thank you for it. Choosing a strong password, keeping your phone locked, and telling us about a message that looks wrong are small habits that multiply our own care many times over.

Retention of records

We do not keep your data forever. The rule we follow is to keep only as long as the law and good practice demand and no longer, then to destroy or anonymise the material in a careful way. Appointment and billing records are usually held for the number of years your state and insurer rules require, which often runs from several years after the last service. Simple enquiry messages that never turn into care are reviewed and cleared sooner, often within a matter of months, so that we are not storing facts we no longer need.

Records for minors begin their count when the child reaches the age of majority under the law of the place where care happened, which we arrange so that a young person gains control of their own history at the right time. At the end of any period we either shred paper, delete digital files beyond recovery, or, where the law allows, remove the names so the remaining numbers can never be traced back to a person. If a client passes away, a personal representative with lawful authority may request the records under our state rules, always working with the privacy office first.

Privacy for children

Much of our practice serves children, so we spend deliberate thought on how their facts are treated. A child under thirteen generally needs a parent or guardian to make privacy choices for them, and we follow the standards in the United States Children Online Privacy Protection law. We do not knowingly ask a young child to give us their own name, address, or phone through the public website, and the contact form is meant for the adults who hold responsibility for that child.

If we learn, by accident, that a young child has sent us personal information on their own, we delete that message promptly and tell the responsible adult. For a teenager, we still encourage the parent and the young person to decide records together, and as the young person nears majority we begin talking about the shift to control. In care itself, a child record exists so a clinician can do their job well, and any request to see or remove part of that record is weighed by the clinician and the privacy office with the child wellbeing at the front of the mind.

Your rights and how to act

Depending on where you live, you hold one or more of these rights: to see the information we hold about you, to receive a copy of it, to ask that an error be corrected, to ask that we delete certain records, to limit or object to some processing, to withdraw consent you gave earlier, and to ask that your data be sent to you or to another service in a readable form. When you make any of these requests we will confirm who you are first, because handing records to the wrong person would itself be a breach of trust.

We answer most requests within one month, and we tell you in writing if a particular request cannot be granted and which law stands in the way. Clinical records sometimes require a clinician review before release, which is a safety step rather than a refusal. If you believe we have not honoured this policy or the law, you may file a complaint with us at the address below and, in the region that covers you, with your local data protection authority or the relevant licensing body. None of these actions will ever change the quality of your care.

Access, correction and portability

You have the engine of these rights in one tool: the privacy request. Write to us at guide@godfreypsych.mom, call +16624401762, or post a letter to the studio address and ask for access, a change, a deletion, or an export. For a request about a minor, the legal parent or guardian should make it. We may ask for identification and a little detail so we can find the right file, and we will never ask for more than we need to match you to your record.

When you ask for a portable copy, we prepare a clear, structured file free of charge for your first copy, and we aim to do so within the period the law allows. When you ask for a change to a clinical note, we do not rewrite history to flatter anyone; instead we add a short correction note that preserves the original while giving your version a lawful place on the record, which is how clinical records handle disputes about the past. True deletion happens for records we are allowed to erase, and everything else we either keep behind the lawful minimum or anonymise so your name no longer travels with it.

Regional and cross border notes

Most of the people who visit this site live in the United States, and most of the processing we do happens in the United States. If you visit from another country, your information may be transferred to and processed in the United States where our studio and our vendors sit. The law of the place where you receive your care also governs your relationship with us, in particular the records and complaint routes open to you.

Where cross border rules apply and require a safeguard, we rely on one of the approved mechanisms, on your clear consent given after reading this notice, or on the practical necessity of performing care you asked for. Transferring data abroad never changes the promises in this document: we still protect it, we still hold only what we need, and we still answer to you first. If you would like to know exactly who stores your data and in which region, ask us and we will tell you plainly.

Response to a data incident

If we ever learn that your information was exposed, lost or taken when it should not have been, we do not hide it. Our first move is always to contain the problem: stop the leak, change passwords, lock accounts, and understand how it happened. Our second move is to assess the risk the incident creates for real people, because a stray technical log rarely carries the same weight as a lost clinical note.

Where the risk is real, we notify affected individuals, our licensing body, and any data protection authority that requires it, all within the time the law allows and with honest detail about what was affected and what we are doing about it. We also review the event afterwards to spot the weakness and repair it so the same mistake does not come back. A good apology, to us, is a changed process plus a clear letter, not a shrug.

Third party links

Occasionally this website points to a useful outside resource such as an insurer portal, a school form, a professional board, or a public health page. When you leave our site for one of those links, you leave our privacy promise behind. We do not control what that site collects, how it stores it, or what it does with your activity once it is on their pages, and this policy stops applying the moment the new tab opens.

Before you hand personal details to any outside page, we encourage you to read its own privacy statement. We pick outside links because we believe they are genuinely useful, but usefulness is not the same as custody, and the outside owner carries the duty for their corner of the web. If a linked page ever seems misleading or unsafe, tell us and we will remove or correct the link.

Automated decisions and profiling

We do not use automated systems to make important decisions about your care, because psychological work should always involve a thinking, responsible clinician. No robot refuses your appointment, sets your diagnosis, stops your treatment, or sets a price against a hidden score. Where a computer helps us sort messages or suggest a service category, a person always makes the final call before anything happens to you.

In the same spirit, we do not build detailed profiles of visitors to serve them adverts or to judge their credit standing. The only broad grouping we use is internal and harmless, such as which regions send us the most enquiries, and that grouping never names you. If that ever changes, we will come back and say so in a plainly worded update to this policy before we begin.

Changes to this policy

The web changes, the law changes, and so does our small practice, which means this policy may need a new edition from time to time. When it changes, we post the new version on this page and move the effective date to the top so you can see at a glance that something is current. Material changes that touch the heart of your privacy, such as a new kind of sharing or a new mass of collection, come with a clear note near the date rather than being hidden deep in the text.

For changes that affect a person already in care, we make a reasonable effort to tell them directly and to answer any question that comes back. If a change would depend on your fresh consent, we ask for that fresh consent rather than rolling old agreement forward. Reading this page occasionally is a small habit that keeps you in charge of how your story is handled, and we are happy to explain any clause by phone or email whenever you ask.

Contact information

Your privacy questions, requests and complaints all reach the same friendly door. Write to us by email at guide@godfreypsych.mom, call us at +16624401762 during office hours, or send a letter to Godfrey Advanced Psychological Services LLC, 2979 Vista Cir, Bountiful - 84010-7814, United States (US). Please put the word privacy in the subject line if you write, so the right person opens your note first.

We take every request seriously and we answer with care and without judgment. If you leave us a message we will come back to you within one business day under normal office hours, usually sooner. Thank you for trusting your story, your child, and your family to the tray room, and for giving us the chance to earn that trust every single day.