Notice of Privacy Practices & Website Privacy Policy

Effective Date: January 1, 2026  ·  Last Updated: July 3, 2026

This notice describes how medical information about you may be used and disclosed and how you can get access to this information. Please review it carefully.

Your Way Therapy ("we," "us," "our," or the "Practice") is a solo telehealth mental health practice operated by Jason Kelley, LCSW and licensed to provide services in Virginia, West Virginia, North Carolina, South Carolina, Illinois, Florida, and Texas. We are committed to protecting the privacy and confidentiality of your health information. We are required by law to maintain the privacy of Protected Health Information ("PHI"), to provide you with this Notice of our legal duties and privacy practices, and to follow the terms of the Notice currently in effect.

This document is divided into two parts:

• Part I — Notice of Privacy Practices (HIPAA): How we use and disclose your Protected Health Information, and your rights regarding that information.
• Part II — Website Privacy Policy: How we collect, use, and protect information through our website, online intake forms, and scheduling tools.

Part I — Notice of Privacy Practices (HIPAA)

1. Our Commitment to Your Privacy

Your Way Therapy understands that information about you and your health is personal and sensitive. We create a record of the care and services you receive so that we can provide quality care and comply with legal requirements. This Notice applies to all records of your care generated by the Practice, whether created by your provider or received from others.

The Health Insurance Portability and Accountability Act of 1996 ("HIPAA"), as amended by the HITECH Act and their implementing regulations (the "Privacy Rule" and "Security Rule"), governs how we may use and disclose your PHI. PHI is information that identifies you and relates to your past, present, or future physical or mental health condition, the provision of health care to you, or payment for that care.

2. How We May Use and Disclose Your Health Information Without Your Authorization

The following describes the ways we may use and disclose PHI. Not every use or disclosure will be listed, but all permitted uses and disclosures fall within one of the categories below.

2.1 For Treatment

We may use and disclose your PHI to provide, coordinate, and manage your mental health care and related services. For example, we may share information with another health care provider you are seeing, with your physician or psychiatrist for coordination of care, or with professionals we consult with about your care (consultation is conducted in a manner that protects your identity where possible).

2.2 For Payment

We may use and disclose your PHI to obtain payment for the services we provide. For example, we may share information with your health insurance plan to obtain prior authorization or to determine eligibility, submit claims, or to bill and collect payment. If you pay for a service out of pocket in full and ask us not to share that information with your health plan, we will honor that request as described in Section 4.

2.3 For Health Care Operations

We may use and disclose your PHI for our business operations — for example, quality assessment and improvement, reviewing the competence or qualifications of professionals, training, licensing, legal and auditing functions, and general administrative activities necessary to run the Practice.

2.4 Business Associates

We may share your PHI with third-party "Business Associates" that perform services on our behalf — such as our electronic health record/practice management system, telehealth video platform, online scheduling and intake provider, billing service, and email or document storage providers. We require each Business Associate, by written Business Associate Agreement, to appropriately safeguard your information consistent with HIPAA.

2.5 Appointment Reminders and Communications

We may contact you to provide appointment reminders, to discuss scheduling, or to share information about treatment alternatives or other health-related services. We will communicate with you using the contact methods and at the locations you authorize (see "Confidential Communications" under Your Rights).

3. Uses and Disclosures That May Be Made Without Your Authorization or Opportunity to Object

We may use or disclose your PHI without your authorization in the following circumstances, to the extent permitted or required by law:

• As Required by Law. When federal, state, or local law requires it.
• To Avert a Serious Threat to Health or Safety. When necessary to prevent or lessen a serious and imminent threat to the health or safety of you or others, including disclosure to law enforcement or the person reasonably able to prevent or lessen the threat. This includes situations involving a risk of suicide or harm to others.
• Abuse, Neglect, or Domestic Violence. To report suspected abuse, neglect, or domestic violence to authorities as required or permitted by law. As a mental health provider, your provider is a mandated reporter in each state in which we are licensed.
• Public Health Activities. To public health authorities for purposes such as preventing or controlling disease, injury, or disability.
• Health Oversight Activities. To a health oversight agency for activities authorized by law, such as audits, investigations, inspections, and licensure.
• Judicial and Administrative Proceedings. In response to a court or administrative order, subpoena, discovery request, or other lawful process, subject to applicable legal protections.
• Law Enforcement. For limited law enforcement purposes as permitted by law.
• Coroners, Medical Examiners, and Funeral Directors. As authorized by law.
• Workers' Compensation. As authorized by and to the extent necessary to comply with workers' compensation laws.
• Specialized Government Functions. For military, national security, or protective services as authorized by law.
• Decedents. To family members or others involved in a deceased individual's care, as permitted by law.
• Research. In limited circumstances, with appropriate privacy protections and oversight.

4. Uses and Disclosures Requiring Your Written Authorization

Other uses and disclosures of your PHI will be made only with your written authorization. In particular, the following always require your authorization:

• Psychotherapy Notes. Your provider may keep "psychotherapy notes" — notes documenting or analyzing the contents of a counseling session — separate from the rest of your record. With limited exceptions permitted by law, we will not use or disclose psychotherapy notes without your specific written authorization. These notes receive special protection under HIPAA and applicable state law.
• Marketing. Most uses and disclosures of PHI for marketing purposes.
• Sale of PHI. Any disclosure that constitutes a sale of PHI.
• Other Uses Not Described in This Notice.

You may revoke an authorization in writing at any time, except to the extent we have already acted in reliance on it. Revocation does not affect disclosures already made.

5. Your Rights Regarding Your Health Information

You have the following rights with respect to your PHI:

• Right to Inspect and Copy. You have the right to inspect and obtain a copy of your PHI in your designated record set, in the form and format you request if readily producible (including electronic copies). We may charge a reasonable, cost-based fee. In limited circumstances we may deny access, and you may have a right to have certain denials reviewed.
• Right to Request an Amendment. If you believe information in your record is incorrect or incomplete, you may request that we amend it. We may deny your request under certain circumstances and will provide a written explanation; you may submit a statement of disagreement.
• Right to an Accounting of Disclosures. You have the right to request a list of certain disclosures we have made of your PHI, other than disclosures for treatment, payment, health care operations, and certain other exceptions.
• Right to Request Restrictions. You have the right to request a restriction on how we use or disclose your PHI for treatment, payment, or health care operations. We are not required to agree to all requests, except that we must agree to your request to restrict disclosure to a health plan for payment or health care operations if you have paid for the service in full, out of pocket.
• Right to Request Confidential Communications. You have the right to request that we communicate with you about health matters in a certain way or at a certain location (for example, by a specific phone number, email, or mailing address). We will accommodate reasonable requests.
• Right to a Paper Copy of This Notice. You have the right to a paper copy of this Notice upon request, even if you have agreed to receive it electronically.
• Right to Be Notified of a Breach. You have the right to be notified if there is a breach of your unsecured PHI.

To exercise any of these rights, please submit your request in writing to our Privacy Officer using the contact information in Section 9.

6. Special Protections and State Law

Mental health and substance use information often receives heightened protection under state law. Because Your Way Therapy is licensed in Virginia, West Virginia, North Carolina, South Carolina, Illinois, Florida, and Texas, your information is protected by both HIPAA and the laws of the state in which you receive services. Where a state law provides you greater privacy protection than HIPAA, we will follow the more protective law. Examples of areas where state law may impose additional requirements include:

• Confidentiality of mental health, psychotherapy, and substance use disorder records;
• Disclosures involving minors and the rights of parents or guardians;
• Specific consent or authorization requirements for the release of records;
• Duties to warn or protect third parties from threatened harm.

If you have questions about the specific protections that apply in your state, please contact our Privacy Officer.

7. Telehealth-Specific Practices

Your Way Therapy provides services primarily through telehealth (live video and, where appropriate, telephone). To protect your information during telehealth:

• We use a HIPAA-compliant video conferencing platform and maintain a Business Associate Agreement with that vendor.
• Sessions are not recorded unless you provide separate written authorization.
• We take reasonable steps to conduct sessions in a private setting, and we encourage you to do the same.
• Electronic transmission of information over the internet carries inherent risks; while we use appropriate safeguards, no method of electronic transmission is completely secure.
• Standard text messages and unencrypted email are not fully secure. If you choose to communicate with us by these methods, you accept the associated risks. We will use secure methods for transmitting clinical information whenever practicable.

8. Our Duties

We are required by law to:

• Maintain the privacy and security of your PHI;
• Provide you with this Notice of our legal duties and privacy practices;
• Notify you following a breach of unsecured PHI;
• Abide by the terms of the Notice currently in effect.

We reserve the right to change this Notice and to make the revised Notice effective for PHI we already have as well as information we receive in the future. The current Notice will be posted on our website and available at your request. The effective date is noted at the top of this document.

9. Complaints and Contact Information

If you believe your privacy rights have been violated, you may file a complaint with us or with the U.S. Department of Health and Human Services. You will not be retaliated against for filing a complaint.

U.S. Department of Health and Human Services, Office for Civil Rights
200 Independence Avenue, S.W., Washington, D.C. 20201 · Phone: 1-877-696-6775
www.hhs.gov/ocr/privacy/hipaa/complaints/

Part II — Website Privacy Policy

This Website Privacy Policy explains how Your Way Therapy collects, uses, and protects information through our website https://www.ywtherapy.com(the "Site"), including our online intake forms and scheduling tools. This policy supplements, and does not replace, the Notice of Privacy Practices above. Where information you submit constitutes PHI, the HIPAA protections in Part I apply.

1. Information We Collect

Information you provide directly. When you contact us, complete an online intake or contact form, request or book an appointment, or communicate with us, we may collect information such as your name, email address, phone number, mailing address, date of birth, insurance information, and the reason you are seeking services. Intake forms may request health-related information necessary to provide care.

Information collected automatically. When you visit the Site, we and our service providers may automatically collect certain technical information, such as your IP address, browser type, device information, pages viewed, and the dates/times of access, through cookies and similar technologies.

2. How We Use Information

We use the information we collect to:

• Respond to your inquiries and provide requested services;
• Schedule and manage appointments;
• Complete intake and verify insurance;
• Operate, maintain, and improve the Site;
• Communicate with you about your care and our services;
• Comply with legal obligations and protect our rights.

3. Cookies and Analytics

Our Site uses Google Analytics (via Google Tag Manager) to understand how visitors use the Site and improve it. Google Analytics sets cookies and collects information such as pages viewed, time on site, and general location; this data is processed by Google. Google Analytics is used only on our public marketing site and is not used to collect protected health information. You can opt out using Google's browser add-on at tools.google.com/dlpage/gaoptout.

4. How We Share Information

We do not sell your personal information. We may share information with trusted service providers who perform functions on our behalf — such as website hosting, online scheduling/intake, telehealth, and electronic health records — subject to confidentiality obligations and, where PHI is involved, a Business Associate Agreement. We may also disclose information when required by law or to protect the safety of you or others, consistent with Part I of this document.

5. Data Security

We use reasonable administrative, technical, and physical safeguards designed to protect the information we collect. However, no website or method of electronic transmission or storage is completely secure, and we cannot guarantee absolute security.

6. Third-Party Links

Our Site may contain links to third-party websites. We are not responsible for the privacy practices or content of those sites. We encourage you to review the privacy policies of any third-party sites you visit.

7. Children's Privacy

Our Site is not directed to children under 16, and we do not knowingly collect personal information from children under 16 through the Site. When we provide services to minors, intake and consent are handled in accordance with HIPAA and applicable state law, which may require parental or guardian consent. If you believe a child has provided us information through the Site, please contact us so we can address it.

8. Your Choices

You may choose not to provide certain information, although this may limit our ability to provide services. You may opt out of non-essential communications at any time by contacting us. To exercise rights regarding your PHI, see "Your Rights" in Part I.

9. Changes to This Policy

We may update this Website Privacy Policy from time to time. Changes will be posted on this page with a revised "Last Updated" date.

10. Contact Us

If you have questions about this Website Privacy Policy or our privacy practices, please contact: