01 Introduction and Scope

Sprout Anew Mental Health Services LLC (“Sprout Anew,” “we,” “us,” or “our”) respects your privacy and is committed to protecting information entrusted to us. This Privacy Policy explains how we collect, use, disclose, safeguard, retain, and otherwise process information when you visit our website, use a public contact or appointment-request form, interact with online scheduling or insurance-verification tools, or follow links to our secure patient portal or telehealth platform.

This Policy applies to information collected through the public-facing website and related online services that link to it. It does not govern information collected solely within a separately operated patient portal, electronic health record, telehealth platform, payment system, or third-party service when that service provides its own privacy notice. Clinical records and protected health information are handled in accordance with applicable healthcare privacy laws and the Sprout Anew Notice of Privacy Practices.

02 Information We May Collect

2.1 Information You Provide Directly

Depending on the feature you use, we may collect:

• Contact information, such as name, telephone number, email address, mailing address, and preferred method of communication.
• Appointment-request information, such as requested service, preferred appointment format, general availability, age range, state of physical location, and brief reason for seeking care.
• Insurance-related information, such as insurer name, member identification details, policyholder information, and eligibility data, when submitted through an approved secure workflow.
• Account and identity-verification information used to establish or support access to a secure portal.
• Communications you submit, including callback requests, administrative questions, feedback, and other messages.
• Payment or billing information when processed through an approved payment provider. Sprout Anew may not directly store full payment-card details.
• Any other information you voluntarily provide.

2.2 Information Collected Automatically

When you use the website, certain technical information may be collected automatically, including:

• Internet Protocol address and approximate geographic region derived from it.
• Browser type, operating system, device type, and device identifiers.
• Pages viewed, links selected, referring and exit pages, date and time of access, and general interaction data.
• Cookie identifiers and similar technical data, subject to the choices described below.
• Security logs, error reports, and information used to detect fraud, misuse, or unauthorized access.

2.3 Sensitive and Health-Related Information

Information that becomes protected health information in connection with care may be governed by HIPAA and our Notice of Privacy Practices rather than solely by this Website Privacy Policy.

03 How We Use Information

We may use information for the following purposes:

• Responding to inquiries, callback requests, and appointment requests.
• Assessing basic service eligibility, including service area, clinician licensure, age range, and requested mode of care.
• Facilitating scheduling, registration, insurance verification, billing, portal access, and telehealth participation.
• Providing patient support and communicating administrative information.
• Operating, maintaining, securing, troubleshooting, and improving the website and digital services.
• Measuring website performance and understanding general use patterns, subject to legal and contractual restrictions.
• Preventing fraud, misuse, unauthorized access, and cybersecurity threats.
• Complying with legal, regulatory, licensing, accreditation, reporting, and recordkeeping obligations.
• Enforcing applicable terms, policies, consents, and agreements.
• Carrying out other purposes disclosed when information is collected or with your authorization.

04 Cookies, Analytics, and Similar Technologies

The website may use cookies and similar technologies to support basic functionality, remember preferences, maintain security, and understand website performance. Cookies are small files placed on a browser or device. Some cookies are necessary for the site to operate; others may support analytics or user preferences.

Because healthcare-related browsing activity can be sensitive, Sprout Anew intends to limit tracking technologies and configure vendors so that information is not impermissibly disclosed. We do not intend to use advertising pixels or cross-site behavioral advertising technologies on authenticated patient pages, appointment forms, portal pages, or other pages likely to reveal identifiable health interests unless a documented legal and compliance review authorizes such use.

You may be able to manage optional cookies through a cookie banner or browser settings. Blocking some cookies may affect website functionality. Browser-based “Do Not Track” signals are not interpreted uniformly; where legally required and technically supported, we will honor applicable opt-out preference signals.

05 How We May Share Information

We do not sell patient medical records. We may disclose information in the following limited circumstances:

• Healthcare operations and care coordination: to authorized clinicians, workforce members, and service personnel who need the information to perform their duties.
• Service providers and business associates: to vendors that provide hosting, portal, telehealth, scheduling, communications, billing, payment, cybersecurity, analytics, or other services. Where required, vendors that handle protected health information must enter into appropriate agreements and safeguard the information.
• Insurance and payment activities: to health plans, clearinghouses, billing vendors, and payment processors as needed for eligibility, claims, payment, and related activities.
• Legal and safety purposes: when required or permitted by law, court order, subpoena, licensing authority, public health obligation, law-enforcement request, or to address a serious threat to health or safety, consistent with applicable law.
• Business transactions: in connection with a merger, acquisition, financing, restructuring, sale of assets, or similar transaction, subject to appropriate confidentiality and legal protections.
• With authorization: when you request or authorize disclosure.
• De-identified or aggregated information: information that does not reasonably identify an individual may be used or disclosed for lawful operational, analytical, educational, or quality-improvement purposes.

06 Data Security and Safeguards

We use reasonable administrative, technical, and physical safeguards designed to protect information from unauthorized access, use, alteration, loss, or disclosure. These safeguards may include access controls, authentication, workforce training, encryption in transit, encryption at rest where appropriate, secure hosting, malware protection, audit logging, backups, vendor oversight, and incident-response procedures.

Sensitive transmissions should use approved encryption, such as Transport Layer Security (TLS), commonly indicated by “https” and a lock symbol in the browser. No website, electronic transmission, or storage system can be guaranteed to be completely secure. You are responsible for using a secure device and network, protecting your passwords, logging out of shared devices, and promptly reporting suspected unauthorized access.

07 Data Retention and Disposal

We retain information only for as long as reasonably necessary for the purposes described in this Policy, to provide services, maintain business and clinical records, resolve disputes, enforce agreements, and satisfy legal, regulatory, insurance, licensing, tax, and professional obligations. Retention periods vary depending on the type of information and applicable requirements.

When information is no longer required, we use reasonable methods to delete, destroy, anonymize, or otherwise render it inaccessible, subject to legal holds, backup cycles, and technical limitations.

08 Your Choices and Privacy Rights

Depending on the context and applicable law, you may have the right to:

• Request access to or a copy of certain information.
• Request correction of inaccurate or incomplete information.
• Request restrictions on certain uses or disclosures of protected health information, subject to applicable law.
• Request confidential communications through an alternative method or location.
• Withdraw an authorization, except to the extent action has already been taken in reliance on it.
• Opt out of nonessential communications or optional cookies.
• Request deletion of certain website information, subject to legal and operational exceptions.
• Obtain an electronic or paper copy of the Notice of Privacy Practices.
• File a privacy complaint without retaliation.

To exercise a right, contact the Privacy Officer using the information below. We may need to verify your identity and authority before processing a request. Some rights apply specifically to protected health information and are explained in the Notice of Privacy Practices.

09 Communications

We may communicate with you by telephone, voicemail, email, text message, portal message, or mail according to your preferences, consents, and applicable law. Standard email and text messaging may not be fully secure. Do not use ordinary email or text messages for emergencies or highly sensitive clinical information. You may update communication preferences by contacting us, although we may still send communications required for care, security, legal compliance, or account administration.

10 Third-Party Websites and Services

The website may link to third-party services, including patient portals, telehealth platforms, payment processors, maps, social-media pages, insurance resources, and educational sites. Sprout Anew does not control every third party’s privacy or security practices. Review the privacy policy and terms of each service before providing information. A link does not necessarily constitute endorsement.

11 Children and Minors

The public website is intended for general informational use and is not directed to children for independent use. Information concerning a minor should be submitted only by an authorized parent, legal guardian, or other person permitted by law, using an approved secure method. Privacy and access rights relating to adolescents may vary under federal and state law.

12 Telehealth and Physical Location

Telehealth services may be provided only when the patient is physically located in a jurisdiction where the treating clinician is authorized to practice and when telehealth is clinically appropriate. Telehealth platforms may collect identity, location, technical, and session-related information necessary to provide and secure care. Separate platform terms or privacy notices may also apply.

13 Security Incidents and Breach Notification

Sprout Anew maintains processes to identify, investigate, mitigate, document, and respond to suspected privacy or security incidents. When notification is required by applicable law, affected individuals and appropriate government authorities will be notified within the required timeframe and by an appropriate method.

14 Changes to This Privacy Policy

We may revise this Privacy Policy periodically to reflect changes in services, technology, legal requirements, or business practices. The updated version will display a revised “Last Revised” date. Material changes may also be communicated through the website, patient portal, email, or another appropriate method. Continued use of the website after an update means the current Policy applies to later website activity, to the extent permitted by law.

15 Privacy Questions and Complaints

You may ask questions, request assistance, or file a privacy complaint with Sprout Anew. You will not be retaliated against for making a good-faith complaint or exercising a privacy right.

16 External Complaint Options

Where applicable, you may also file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights. Current filing instructions are available on the HHS website. Additional state or local complaint options may also be available. Sprout Anew will not retaliate against you for filing a complaint with the practice or a government agency.

17 Relationship to the Notice of Privacy Practices

This Website Privacy Policy addresses online and general privacy practices. The HIPAA Notice of Privacy Practices describes how Sprout Anew may use and disclose protected health information, your rights regarding that information, and our legal duties. If this Policy conflicts with the Notice of Privacy Practices regarding protected health information, the Notice of Privacy Practices and applicable law control.