Effective Date: October 24, 2025

At Ashton Mental Health, we are committed to protecting the privacy and confidentiality of our website visitors and users.

This policy applies to data collected through the Ashton Mental Health website, www.ashtonmentalhealth.com, and any services that link to this policy.

This includes information that cannot be used to directly identify you, such as your IP address, browser type, pages viewed, and other usage data, collected via cookies and tracking technologies.

This is information you voluntarily provide through the public website (e.g., the "Contact Us" form), including your name, email address, and phone number.

For clinical purposes (scheduling, secure messaging, billing), we utilize a third-party Electronic Health Record (EHR) and Patient Portal system, SimplePractice, LLC.

• Data Collected via SimplePractice: Any information, including Protected Health Information (PHI), entered directly into the secure client portal or exchanged via SimplePractice's platform (e.g., intake forms, session notes, billing details) is collected and secured by SimplePractice on our behalf, in compliance with HIPAA.
• HIPAA and Business Associate: SimplePractice operates as our Business Associate. Our relationship is governed by a Business Associate Agreement (BAA), which contractually requires SimplePractice to protect your PHI.
• Notice of Privacy Practices (NPP): Your rights and our legal duties regarding PHI collected through the portal are fully detailed in our separate Notice of Privacy Practices (NPP), which is provided to you upon becoming a client. This website privacy policy does not govern the handling of PHI within the SimplePractice portal.

We use the collected information to maintain the Website, respond to your inquiries, for analytics, and for security (to prevent fraud).

We do not sell or rent your Personal Information. We may share information with necessary service providers or if legally required.

We implement reasonable technical and physical safeguards appropriate to the nature of the information we store, but acknowledge that no system is 100% secure.

(Not intended for users under 18, without parental supervision/assistance.)

www.SimplePractice.com

www.mindfultherapygroup.com

(Right to Access, Correct, Delete, etc., depending on jurisdiction.)

(We will notify users of changes.)

If you have any questions about this Privacy Policy, please contact us:

Ashton Mental Health

• Email: ashton@colorado-therapy.com
• Phone: 702-301-4243
• Mailing Address: 1500 N Grant St STE C, Denver, CO 80203

2. Terms of Use

Website: www.ashtonmentalhealth.com

Effective Date: October 24, 2025

By accessing and using the Ashton Mental Health website, www.ashtonmentalhealth.com, you agree to be bound by these Terms of Use ("Terms").

• NOT A SUBSTITUTE FOR PROFESSIONAL CARE: The information provided on this Website is for informational and educational purposes only. It is not a substitute for professional medical or mental health advice, diagnosis, treatment, or therapy.
• EMERGENCY WARNING: If you are experiencing a medical or mental health emergency, do not rely on this Website. Immediately call 911 or the National Suicide & Crisis Lifeline at 988.

You are granted a limited license to use the Website for personal, non-commercial use. You must not use the Website for malicious activities (e.g., uploading viruses) or in a way that damages the site. All content is protected by intellectual property laws.

• Portal Provider: The client portal, which allows for secure scheduling, messaging, and billing, is provided and hosted by SimplePractice, LLC.
• Security: Ashton Mental Health does not store your portal login credentials. SimplePractice is a Business Associate of Ashton Mental Health, legally required to maintain the privacy and security of your PHI under HIPAA standards.
• Account Responsibility: You are solely responsible for maintaining the confidentiality of your SimplePractice account password.

To the fullest extent permitted by law, Ashton Mental Health will not be liable for any indirect or consequential damages resulting from your use of, or inability to use, the Website.

(Your agreement to cover legal costs resulting from your breach of these Terms.)

These Terms shall be governed and construed in accordance with the laws of the State of Colorado, USA.

(We reserve the right to modify these Terms.)

Effective Date: October 24, 2025

This statement is supplemental to the Privacy Policy and applies specifically to Protected Health Information (PHI) exchanged via our secure client portal, hosted by SimplePractice, LLC.

• Ashton Mental Health is a Covered Entity under HIPAA.
• We utilize SimplePractice, LLC as our Electronic Health Record (EHR) and Patient Portal provider. SimplePractice is our Business Associate, and we maintain a mandatory Business Associate Agreement (BAA) with them to ensure PHI is protected.

• Platform Security: SimplePractice employs technical, administrative, and physical safeguards, including end-to-end encryption, to protect your PHI against unauthorized access.
• Separation of Systems: The public website, www.ashtonmentalhealth.com, is separate from the secure SimplePractice portal.

Communication initiated through general, non-secure sections of the Website (e.g., the public "Contact Us" form or public email addresses) is not guaranteed to be HIPAA-compliant. Please avoid sending sensitive Protected Health Information (PHI) through these channels.

The next step is to draft the Notice of Privacy Practices (NPP), which is legally mandatory for all clients under HIPAA. Would you like me to draft that document now?