Privacy Policy

1. Introduction & Scope

Roots Counseling & Wellness PLLC ("we," "us," or "our") operates the website at https://www.rootscounselingwellness.com/ (the "Website"). We are a telehealth-only mental health practice licensed in and serving clients throughout Washington State.

This Privacy Policy explains what information is collected through our Website, how it is used and protected, and your rights regarding that information. This policy applies only to information collected through this Website — it does not apply to information collected through our electronic health record (EHR) system, which is governed by our separate HIPAA Notice of Privacy Practices.

The Website itself does not independently store or retain user-submitted data. When you submit information through a contact or inquiry form, that data is transmitted directly into HIPAA-compliant systems operated by or on behalf of the practice (see Section 2 for details).

Definition of "Client": Throughout this policy, the term "client" refers to an individual who has established a provider-client relationship with Roots Counseling & Wellness by: (1) completing all required digital intake documentation in SimplePractice, (2) receiving written confirmation of acceptance by the practice, and (3) completing at least one billable clinical session with a licensed clinician of the practice. Individuals who have only submitted a website inquiry, contact form, or consultation request are not considered clients and are not entitled to the clinical record rights described in this policy.

By using our Website, you agree to the collection and use of information as described in this policy. If you do not agree with these practices, please do not use our Website.

​

2. Information We Collect

​

2.1 Information You Provide

When you interact with our Website, you may voluntarily provide the following information through contact and inquiry forms:

Appointment inquiry information: Your name, contact information, insurance provider, and general reason for seeking services.

How form data is handled: Contact and inquiry form submissions are transmitted directly into HIPAA-compliant systems at the point of submission — specifically, SimplePractice (our EHR platform, operating under a Business Associate Agreement) and/or the practice’s internal HIPAA-compliant database infrastructure (also operating under appropriate HIPAA safeguards and BAA agreements). The Website itself does not independently store form submissions. The specific system(s) receiving a submission may vary based on inquiry type and current infrastructure configuration.

Note: We do not intentionally collect clinical or health information through this Website. If you include health details in a contact form message, that information is used solely to direct you to appropriate services and is not stored as part of a clinical record.

 

2.2 Information Collected Automatically

When you visit our Website, we may automatically collect:

Device and browser information: Browser type, operating system, screen resolution, and device type.

Usage data: Pages visited, time spent on pages, referring website, and general navigation patterns.

Location data: General geographic location based on IP address (city/state level only — we do not collect precise location data).

 

3. How We Use Your Information

We use information collected through our Website for the following purposes:

Responding to inquiries: To reply to your contact form submissions and appointment requests.

Directing you to services: To connect you with the appropriate clinician or our secure client portal (SimplePractice) for intake.

Website improvement: To understand how visitors use our site and improve content, navigation, and user experience.

Communications: To send information you have requested, such as practice announcements (you may opt out at any time).

Legal compliance: To comply with applicable laws, regulations, or legal processes.

We do not use your information for targeted advertising, and we do not build behavioral profiles based on your Website activity.

 

4. How We Share Your Information

We do not sell your personal information. We have never sold personal information and have no plans to do so.

We may share your information only in the following limited circumstances:

HIPAA-compliant systems: Form submissions are transmitted directly into SimplePractice (operating under a BAA) and/or the practice’s internal HIPAA-compliant database infrastructure (also operating under appropriate BAA agreements). These systems process all submitted data within HIPAA-compliant frameworks.

Service providers: We use trusted third-party services to operate our Website, including website hosting (Wix), email delivery (Google Workspace), and analytics platforms. These providers process data on our behalf and are contractually required to safeguard your information.

Legal requirements: We may disclose information if required by law, court order, or government regulation, or if we believe disclosure is necessary to protect our rights, your safety, or the safety of others.

 

5. Clinical Records & EHR

Our Website is an informational and marketing platform. It does not store clinical records, therapy notes, treatment plans, diagnoses, or any other protected health information (PHI). All data submitted through Website forms flows directly into HIPAA-compliant systems at the point of submission.

Clinical records for established clients are maintained in SimplePractice and/or the practice’s internal HIPAA-compliant database, in accordance with applicable BAA and HIPAA requirements. When you become a client, you will receive our HIPAA Notice of Privacy Practices as part of the onboarding process.

HIPAA applies to clinical services provided through our HIPAA-compliant systems — not to this Website. For questions about how your clinical information is used and protected, please refer to the HIPAA Notice of Privacy Practices provided during intake or contact us at morgan@rootscounselingwellness.com.

 

6. Cookies & Tracking

Our Website uses a minimal set of cookies and tracking technologies:

6.1 Essential Cookies

These are required for the Website to function properly, including session management and security features. They cannot be disabled.

6.2 Analytics

We use privacy-focused analytics to understand how visitors interact with our Website. This system collects anonymous page view and session data without tracking individual users across sessions or websites. We do not use Google Analytics, Meta Pixel, or third-party advertising trackers.

6.3 How to Manage Cookies

You can control cookies through your browser settings. Most browsers allow you to block or delete cookies. Please note that disabling essential cookies may impact Website functionality.

 

7. Data Retention

The Website itself does not independently store user-submitted data. Form submissions are transmitted directly into HIPAA-compliant systems and are governed by the retention policies of those systems.

Operational data retention is as follows:

Operational email communications (Google Workspace): Operational emails, including intake inquiry responses, are automatically purged after 30 days in accordance with the practice’s HIPAA-aligned data minimization policy.

Non-client inquiries: We do not retain records or documentation for individuals who do not establish a provider-client relationship. Operational emails are purged within 30 days.

Established client records: Once a provider-client relationship is established, records are retained in HIPAA-compliant systems in accordance with Washington State law (WAC 246-341) and HIPAA requirements.

Analytics data: Anonymized usage data is retained for up to 12 months to evaluate long-term Website trends. This data does not identify individual users.

 

8. Telehealth Services Notice

Roots Counseling & Wellness PLLC is a telehealth-only practice. All therapy services are delivered remotely via secure, HIPAA-compliant video platforms.

Because services are delivered through technology:

• Telehealth platforms are separate from this Website and maintain their own HIPAA-compliant security measures

• Encryption and other safeguards are used to protect telehealth sessions

• Clients receive detailed information about telehealth platforms and privacy practices prior to their first session

• Clinicians are licensed in Washington State and provide services only to individuals physically located in Washington State at the time of service

 

8.1 SMS Text Messaging

Roots Counseling & Wellness PLLC uses SMS text messaging to communicate with prospective and established clients for appointment reminders, scheduling confirmations, schedule changes, intake follow-ups, and general communication. Message frequency varies based on appointment activity.

Your mobile information will not be sold or shared with third parties for promotional or marketing purposes. Mobile phone numbers and SMS content are used solely for care-related communications you have consented to receive.

Message and data rates may apply depending on your mobile carrier plan. Carrier support is not guaranteed in all areas.

Crisis resources: SMS is not a substitute for emergency care. If you are in crisis, call or text 988 (Suicide & Crisis Lifeline) or dial 911 immediately.

 

9. Washington State Privacy Rights

9.1 My Health My Data Act (MHMDA)

Under Washington’s My Health My Data Act (RCW 19.373), Washington residents have specific rights regarding consumer health data.

While this Website is not designed to independently collect or store consumer health data, certain information submitted through contact or inquiry forms (such as information related to seeking mental health services) may fall within the Act’s broad definition of consumer health data.

All such information is transmitted directly into HIPAA-compliant systems and is not retained by the Website itself. Once received, this information is handled in accordance with applicable HIPAA requirements and the practice’s internal privacy and data minimization policies.

We do not sell consumer health data and do not use such information for targeted advertising.

To the extent consumer health data is collected:

• It is used solely for the purpose of responding to inquiries and connecting individuals to appropriate services

• It is not used to build behavioral profiles or for advertising purposes

• It is maintained only within HIPAA-compliant systems or secure communication platforms

Washington residents have the right to:

• Confirm whether we are processing consumer health data about them

• Request access to such data

• Request deletion of such data

• Withdraw consent for the collection or sharing of such data, where applicable

To exercise any of these rights, please contact us at morgan@rootscounselingwellness.com. We will respond in accordance with applicable law.

 

9.2 Washington Consumer Protection

Under Washington State consumer protection law, you have the right to:

• Know what personal information we collect

• Request deletion of your personal information

• Not be discriminated against for exercising your rights

To exercise these rights, contact us at morgan@rootscounselingwellness.com. We will respond within 30 days.

 

10. Your Privacy Rights

The Roots Counseling & Wellness Website does not independently store personal information. Data submitted via forms is transmitted directly into HIPAA-compliant systems and is not retained by the Website itself.

If you are an established client and wish to access, correct, or request deletion of your clinical records, please contact morgan@rootscounselingwellness.com. Requests are handled in accordance with HIPAA and Washington State law (WAC 246-341).

Washington residents may also exercise rights under the My Health My Data Act (RCW 19.373) by contacting us. We will respond within 30 days.

 

11. Data Security

The Website does not store personal data submitted through forms. All submissions are transmitted directly into HIPAA-compliant systems.

We implement SSL/TLS encryption for all data transmitted between your browser and the Website.

While we use industry-standard safeguards, no method of internet transmission is 100% secure. We cannot guarantee absolute security but remain committed to protecting your information.

 

12. Data Breach Notification

Roots Counseling & Wellness complies with Washington State data breach notification law (RCW 19.255.010). In the event of a breach affecting personal information, affected individuals will be notified within 30 days of discovery.

If more than 500 Washington residents are impacted, we will also notify the Washington State Attorney General as required.

 

13. Children’s Privacy

This Website is not directed to children under 13. We do not knowingly collect personal information from children under 13.

If such information is discovered, it will be deleted promptly. If you believe a child has submitted information, contact morgan@rootscounselingwellness.com.

Note: Roots Counseling & Wellness does not provide therapy services to individuals under 18 years old.

 

14. Third-Party Links

Our Website may contain links to third-party services, including:

• Client portal (SimplePractice)

• Mental health resources and crisis hotlines

• Professional association pages

These sites have their own privacy policies, and we are not responsible for their practices. We encourage you to review them.

 

15. Changes to This Policy

We may update this Privacy Policy periodically to reflect changes in practices, technology, or legal requirements.

• The "Last Updated" date will be revised

• Material changes will be communicated through the Website

Continued use of the Website constitutes acceptance of updates.

 

16. Contact Us

If you have questions about this Privacy Policy or your privacy rights, please contact:

Privacy inquiries: morgan@rootscounselingwellness.com
General contact: morgan@rootscounselingwellness.com
Phone: (970)-658-9704
Mailing address: 218 Main St #420, Kirkland, WA 98033
Website: https://www.rootscounselingwellness.com/

We aim to respond to all inquiries within 30 days.

Roots Counseling & Wellness PLLC is a Professional Limited Liability Company registered in the State of Washington.