HIPAA Notice of Privacy Practices

NOTICE OF PRIVACY PRACTICES

This is the default version emotilink providers may distribute if they do not upload their own. When you match with a provider, the version you receive will be filled in with that provider’s specific practice information (name, license, and other details shown in brackets below).

Your Information. Your Rights. Our Responsibilities.

Effective Date: July 18, 2026
Provider: [Your therapist’s name]
Provider License Number / State: [Your therapist’s license number and state of licensure]
Version: Default v1 (emotilink boilerplate; provider may upload customized version via Provider Settings)

This notice describes how medical and mental-health information about you may be used and disclosed and how you can get access to this information. Please review it carefully.

This Notice is required by the federal Health Insurance Portability and Accountability Act (“HIPAA“) and applies to the licensed mental health professional (“Provider,” “we,” “us,” or “our“) whose services you are engaging through the emotilink platform (the “Platform“), and to the privacy practices governing the information your Provider receives from you in the course of your treatment.

About this Notice. This is the default Notice of Privacy Practices provided to you on behalf of your Provider through the Platform. Your Provider may have adopted a customized Notice of Privacy Practices instead of this default. If so, your Provider’s customized Notice supersedes this one, and you can request a copy directly from your Provider.

YOUR RIGHTS

When it comes to your health information, you have certain rights. This section explains your rights and your Provider’s responsibilities to help you exercise them.

Get a copy of your record

  • You can request a paper or electronic copy of the medical record your Provider maintains for you, and other health information your Provider has about you.
  • Your Provider will provide a copy or summary, usually within 30 days of your request. A reasonable, cost-based fee may apply.
  • For psychotherapy notes (kept separately from your medical record and reflecting the Provider’s analysis during sessions), your Provider may decline to provide a copy.

Ask your Provider to correct your record

  • You can ask your Provider to correct health information you think is incorrect or incomplete.
  • Your Provider may say “no” to your request, but must tell you why in writing within 60 days.

Request confidential communications

  • You can ask your Provider to contact you in a specific way (phone, email, mail) or at a specific address.
  • Your Provider will say “yes” to reasonable requests.

Ask your Provider to limit what we use or share

  • You can ask your Provider not to use or share certain health information for treatment, payment, or operations purposes.
  • Your Provider is not required to agree, and may decline if the limitation would affect your care.
  • If you pay for a service out-of-pocket in full, you can require your Provider not to share that information with your health insurer (where applicable).

Get a list of who we’ve shared your information with

  • You can request an accounting of disclosures of your health information for the six (6) years prior to your request, including who received it and why.
  • One accounting per twelve-month period is free; additional accountings may be subject to a reasonable, cost-based fee.

Get a copy of this Notice

  • You can request a paper copy of this Notice at any time, even if you have already agreed to receive it electronically.

Choose someone to act for you

  • If you have given someone medical power of attorney, or if someone is your legal guardian, that person can exercise your rights and make choices about your health information.
  • Your Provider will verify the authority before acting on behalf of another person.

File a complaint if your rights are violated

  • You may file a complaint with your Provider by contacting your Provider directly.
  • You may also file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights, by sending a letter to 200 Independence Avenue, S.W., Washington, D.C. 20201, calling 1-877-696-6775, or filing online at www.hhs.gov/ocr/privacy/hipaa/complaints/.
  • Your Provider will not retaliate against you for filing a complaint.

YOUR CHOICES

For certain health information, you can tell your Provider your choices about what your Provider shares. If you have a clear preference, tell your Provider during your session.

You have the right and choice to tell us to:

  • Share information with your family, close friends, or others involved in your care
  • Share information in a disaster relief situation

If you are not able to express your preferences (for example, because you are unconscious), your Provider may share your information if your Provider believes it is in your best interest. Your Provider may also share information when necessary to lessen a serious and imminent threat to health or safety.

We will never use or share your information for these purposes without your written authorization:

  • Marketing purposes
  • Sale of your information
  • Most sharing of psychotherapy notes

Fundraising

Your Provider does not currently use your information for fundraising. If your Provider’s practice changes, you will be notified and given the opportunity to opt out.

REPRODUCTIVE HEALTH CARE (45 C.F.R. § 164.502(a)(5)(iii))

Effective December 23, 2024, your Provider may not use or disclose your protected health information for the purpose of conducting a criminal, civil, or administrative investigation into, or imposing criminal, civil, or administrative liability on, you (or any person assisting you) for the mere act of seeking, obtaining, providing, or facilitating reproductive health care that was lawful under the circumstances in which it was provided.

Before your Provider may disclose any of your information that potentially relates to reproductive health care in response to certain legal processes (subpoenas, court orders, health-oversight inquiries, etc.), your Provider will obtain a valid written attestation from the party requesting the disclosure that the request is not for a prohibited purpose.

SUBSTANCE USE DISORDER RECORDS

If, during the course of treatment, your Provider creates or receives records that relate to your diagnosis or treatment for a substance use disorder, those records may be subject to additional federal confidentiality protections under 42 C.F.R. Part 2. Where Part 2 applies, your Provider will not redisclose those records without your written authorization, except as expressly permitted by Part 2.

STATE-LAW PROTECTIONS

Some states impose additional protections on mental health and substance use records that go beyond HIPAA. Where state law provides greater protection, your Provider will comply with the stricter state-law requirement. Examples include:

  • New York Mental Hygiene Law § 33.13 (clinical record confidentiality)
  • California Confidentiality of Medical Information Act (Cal. Civ. Code § 56 et seq.) and California Lanterman-Petris-Short Act (Cal. Welf. & Inst. Code § 5328) (mental health record confidentiality)
  • Texas Health and Safety Code § 611 (mental health record confidentiality)
  • Florida statute § 491.0147 (counseling-record confidentiality)
  • And similar protections in other states

If your Provider is licensed in a state that provides greater protection, that protection applies in addition to HIPAA.

OUR USES AND DISCLOSURES

How your Provider typically uses or shares your health information

Treat you. Your Provider can use your health information and share it with other professionals who are treating you (with your authorization, where appropriate).

Run our practice. Your Provider can use and share your health information to operate the practice, improve your care, and contact you when necessary.

Bill for services. Your Provider can use and share your health information to bill and obtain payment, including from health plans or other entities you have designated.

How else your Provider can use or share your health information

Your Provider is allowed or required to share your information in other ways — generally in ways that contribute to the public good, such as public health and research. Your Provider must meet many conditions in the law before sharing for these purposes.

  • Public health and safety. Including reporting communicable diseases, reporting suspected abuse or neglect, and reducing a serious threat to anyone’s health or safety.
  • Health oversight activities. Including audits, inspections, and licensure reviews.
  • Research. Where authorized by law and subject to applicable safeguards.
  • Legal process. Including in response to a court order, subpoena, or law enforcement request (subject to the Reproductive Health Care protections above and applicable state law).
  • Workers’ compensation. As required for claims processing.
  • Specialized government functions. Such as military, national security, and presidential protective services.
  • Coroner, medical examiner, or funeral director (when an individual dies).
  • Organ and tissue donation requests.

OUR RESPONSIBILITIES

  • Your Provider is required by law to maintain the privacy and security of your protected health information.
  • Your Provider will notify you promptly if a breach occurs that may have compromised the privacy or security of your information, in accordance with the HIPAA Breach Notification Rule and applicable state law.
  • Your Provider must follow the duties and privacy practices described in this Notice and give you a copy of it.
  • Your Provider will not use or share your information other than as described here unless you tell your Provider in writing that we can. If you give us written permission and later change your mind, you can revoke that permission at any time by notifying your Provider in writing.

emotilink is a HIPAA business associate of your Provider, meaning emotilink provides the technology platform your Provider uses to schedule and conduct sessions and process payments, but emotilink is not itself a health care provider and does not deliver clinical care.

emotilink’s collection, use, storage, and disclosure of your information is governed by:

  • The emotilink Privacy Policy (available at www.emotilink.com/privacy-policy), which describes emotilink’s information practices in detail.
  • The Business Associate Agreement between emotilink and your Provider, which requires emotilink to safeguard your information and to use it only as permitted by HIPAA and the agreement.

If you have questions about emotilink’s handling of your information (as opposed to your Provider’s handling), contact emotilink at info@emotilink.com.

CHANGES TO THIS NOTICE

Your Provider may change the terms of this Notice. Changes will apply to all information your Provider has about you. Updated versions will be made available through the Platform and on your Provider’s website (where applicable). You can also request a paper copy of any updated version from your Provider.

CONTACT

Your Provider:

[Your therapist’s name]
License: [Your therapist’s license number]
State of Licensure: [Your therapist’s state of licensure]
[Your therapist’s practice address, telephone, or email, if they choose to include it]

emotilink (Platform — Business Associate of your Provider):

emotilink, LLC
222 W Merchandise Mart Plaza, Suite 1230
Chicago, IL 60654
info@emotilink.com
312-554-5812

U.S. Department of Health and Human Services, Office for Civil Rights:

200 Independence Avenue, S.W.
Washington, D.C. 20201
1-877-696-6775
www.hhs.gov/ocr/privacy/hipaa/complaints/