Website Privacy Policy

Leela Mental Health, Family Therapy Corporation, doing business as Leela Mental Health

 If you book an appointment or complete intake documents through our client portal (Simple Practice), that platform’s privacy practices apply. Simple Practice operates under a HIPAA Business Associate Agreement. Data entered there is clinical information governed by our HIPAA NPP, not this policy.

This Website uses Google Analytics 4 to understand how visitors use the site. Google Analytics 4 collects anonymized usage data — page views, session duration, device type, and approximate location derived from IP address. It does not collect your name or contact information.

Our Google Analytics 4 property is configured as follows:

• Google Signals is disabled. We do not link visitor sessions to Google account profiles or enable cross-device advertising audiences.
• Data retention is set to 2 months. Raw event and user data is automatically deleted after 2 months.
• IP anonymization is enabled. Full IP addresses are not stored.
• Data sharing with Google is restricted. Google does not use data collected through this Website to improve its own products or serve advertising.
• Google Analytics 4 is integrated with our cookie consent system. Visitors who decline analytics cookies are not tracked. GA4 receives and respects the consent signal from our cookie banner before collecting any data.

We do not use advertising pixels of any kind — including Meta Pixel, Pinterest Pixel, TikTok Pixel, or Google Ads remarketing tags — on this Website. We do not use behavioral data collected here to target advertising to you on other platforms.

We use Google Workspace (Gmail) under a HIPAA Business Associate Agreement for email communication. Standard email is not end-to-end encrypted. We do not send sensitive clinical content by email without your prior written consent. For secure clinical communication, please use the Simple Practice client portal.

6.1 Contact and Inquiry Data (Name, email address, phone number — submitted through contact forms or direct email)

Retained for a maximum of 24 months from the date of submission, or until a clinical relationship is established, whichever occurs first.

• If a clinical relationship is established: your contact information becomes part of your clinical record and is governed by Section 6.3 below.
• If no clinical relationship is established: contact records are securely deleted after 24 months. Deletion applies across all systems where that information is stored, including our website database, email platform (Google Workspace), and administrative records.

The 24-month period reflects the time reasonably necessary to respond to inquiries, complete intake consultations, and determine whether a clinical relationship will be established — consistent with the purpose for which this information was collected.

6.2 Automatically Collected Technical Data (IP address, session duration, referring URL, browser type, device type, operating system — collected automatically as described in Section 1)

This data is processed across three separate systems, each with its own retention schedule:

Note on Complianz consent records: When you interact with our cookie consent banner, a record of your choice is created. This record is retained for 3 years so that we can demonstrate, if audited by the California Privacy Protection Agency, that consent was properly obtained. This is a legal documentation requirement, not a marketing or analytics function.

Note on Google Analytics: GA4 is configured with restricted data processing and IP anonymization. We do not enable Google Signals. Data is not shared with Google for advertising purposes.

6.3 Clinical Records (Protected Health Information — governed by HIPAA and California law, not this Website Privacy Policy)

Clinical records — including intake documents, session notes, treatment plans, progress notes, and billing records — are maintained in SimplePractice, our HIPAA-compliant electronic health record platform.

Adult clients: Minimum 7 years from the date therapy is terminated.

Minor clients: Minimum 7 years from the date the client turns 18 — meaning records are retained at least until age 25 if therapy concluded before the client’s 18th birthday. Where therapy continued into adulthood, the 7-year period runs from the date of last service.

Authority: California Business and Professions Code §4980.49 (LMFT) and §4999.75 (LPCC).

Records may be retained beyond these minimum periods where required by law — including pending litigation, a regulatory investigation, or a mandatory reporting obligation.

Your right to deletion under California law (Section 9) does not override clinically mandated retention. We cannot delete records we are legally required to keep. For questions about your clinical records, refer to our HIPAA Notice of Privacy Practices or contact our Privacy Officer.

6.4 Secure Deletion

When information reaches the end of its applicable retention period, we use reasonable technical measures to render it unrecoverable — including deletion from active databases and removal from backup systems within our standard backup rotation cycle.

This Website is secured using SSL/TLS encryption. We implement reasonable technical and organizational safeguards to protect information from unauthorized access, disclosure, or loss. No internet transmission is 100% secure; you transmit data to us at your own risk and we recommend using a secure, private network.

In the event of a breach of your personal information (as defined by California Civil Code §1798.82), we will notify affected individuals without unreasonable delay as required by California law. For breaches involving your clinical health information (PHI), separate notification obligations under HIPAA apply — see our Notice of Privacy Practices.

This Website is not directed to children under 13, and we do not knowingly collect personal information from children under 13 through the Website. If you believe a child under 13 has submitted information through this Website, please contact us immediately at information@leelamentalhealth.com so we may delete it.

Minors who have the legal right to consent to their own mental health care under California Health & Safety Code §124260 may contact us directly. Please refer to the AB 1184 Confidential Communications section in our HIPAA Notice of Privacy Practices for information about how we protect the privacy of minors and individuals on another person’s insurance policy.

Categories of Personal Information Collected (Past 12 Months)

We have not sold or shared personal information with any third party for commercial purposes in the past 12 months, and we do not intend to do so.

To exercise any California privacy right, contact us by email or postal mail (see Section 12). We will verify your identity before processing your request and will respond within 45 days, with one possible extension of up to an additional 45 days where reasonably necessary. We will not charge a fee for a first request in any 12-month period. For website privacy requests (non-clinical), we verify identity by confirming the email address and/or phone number associated with the original inquiry. We will not require additional documentation unless the request involves sensitive information or the identity cannot be confirmed by the information provided.

To file a complaint with the California Privacy Protection Agency: cppa.ca.gov

For privacy-related questions, requests, or complaints about this Website Privacy Policy: