Consumer Health Data Privacy Policy
Ingrid Johnston Therapy ingridjohnstontherapy.com
Last updated: July 24, 2026
This Consumer Health Data Privacy Policy is provided in accordance with the Washington My Health My Data Act (RCW 19.373). It applies to consumer health data collected through this website that is not Protected Health Information (PHI) governed by the Health Insurance Portability and Accountability Act (HIPAA). PHI collected in the course of providing therapy services is governed by HIPAA and our Notice of Privacy Practices, which is provided to all clients during the intake process.
What This Policy Covers
Ingrid Johnston Therapy is a HIPAA-covered entity. The majority of health-related information we handle is PHI collected during the course of providing therapy services, which is exempt from the My Health My Data Act.
This policy covers the limited consumer health data that may be collected through this website before a therapeutic relationship has been established, such as health-related information you voluntarily include in a contact form submission, scheduling request, or email inquiry. Once you become a client and complete the intake process, your health information is treated as PHI under HIPAA.
Categories of Consumer Health Data Collected
We may collect the following categories of consumer health data through this website:
Information about your mental or physical health status that you voluntarily provide when submitting a contact form, scheduling request, or email, such as a description of symptoms, concerns, or reasons for seeking therapy.
Sources of Consumer Health Data
Consumer health data is collected directly from you when you voluntarily submit it through the website's contact form, scheduling tool, or by sending an email to ingrid@ingridjohnstontherapy.com. We do not collect consumer health data from third-party sources through this website.
Purposes for Collecting Consumer Health Data
We collect consumer health data for the following purposes: to respond to your inquiry about therapy services, to assess whether our services may be a good fit for your needs, and to facilitate the scheduling and intake process if you choose to become a client.
Categories of Consumer Health Data Shared
The only category of consumer health data we share is the category described above: information about your mental or physical health status that you voluntarily include in a contact form submission, scheduling request, or email inquiry.
We share this category only to the extent necessary to operate the website and respond to your inquiry, and only with the service providers listed below. We do not share consumer health data for advertising or marketing purposes.
Categories of Third Parties and Specific Affiliates
We share consumer health data with the following categories of third parties:
Website hosting provider (Squarespace), which processes data submitted through forms hosted on this site
Scheduling software provider, if you use an online scheduling tool to request an appointment
Email service provider, if you contact us by email
These service providers process data on our behalf and are contractually required to handle your information in accordance with applicable privacy and security requirements.
Ingrid Johnston Therapy has no affiliates. We do not share consumer health data with any affiliate.
Sale of Consumer Health Data
Ingrid Johnston Therapy does not sell and has not sold consumer health data. We will not sell consumer health data without first obtaining your valid written authorization.
Data Security
We restrict access to consumer health data to those employees, processors, and contractors for whom access is necessary to further the purposes for which you provided consent, or to provide a product or service you have requested. We establish, implement, and maintain administrative, technical, and physical data security practices that satisfy a reasonable standard of care within our industry to protect the confidentiality, integrity, and accessibility of consumer health data, appropriate to the volume and nature of the data we handle.
Your Rights
Under the Washington My Health My Data Act, you have the right to:
Confirm and access. You may confirm whether we are collecting, sharing, or selling your consumer health data, and access the specific consumer health data we have collected about you. Your access request also entitles you to receive a list of all third parties and affiliates with whom we have shared or sold your consumer health data, together with an active email address or other online method you can use to contact each of those third parties. We will provide that list and those contact details as part of our response.
Withdraw consent. You may withdraw consent to our collection and sharing of your consumer health data. If you withdraw consent, we will stop collecting your consumer health data going forward. Withdrawal of consent does not affect the lawfulness of any processing that occurred before withdrawal.
Delete. You may request deletion of your consumer health data. On receiving a verified request, we will delete consumer health data we have collected about you from our records, and we will notify all processors, contractors, and other third parties that received your data so they can delete it as well.
Appeal. If we refuse to act on your request, you may appeal that decision by contacting us using the information below. We will respond to your appeal in writing within 45 days, including a written explanation of our reasons. If we deny your appeal, we will also provide you with a method for contacting the Washington State Attorney General's Office to submit a complaint. You can reach that office at atg.wa.gov.
We will not unlawfully discriminate against you for exercising any of these rights.
How to Exercise Your Rights
To exercise any of the rights described above, contact us at:
Email: ingrid@ingridjohnstontherapy.com Phone: (206) 658-7831
We will respond to your request without undue delay and in all cases within 45 days of receiving it. That period may be extended once by up to 45 additional days when reasonably necessary, and if we need the extension we will tell you within the initial 45 days along with the reason for it.
Information provided in response to your request is free of charge up to twice per year. If requests are manifestly unfounded, excessive, or repetitive, we may charge a reasonable fee to cover administrative costs or decline to act, and the burden of demonstrating that is on us.
We may need to verify your identity before fulfilling your request. We will do so by confirming information you have previously provided to us, such as your name and email address. You will not be required to create an account in order to exercise these rights.
New Categories or Purposes
We will not collect, use, or share categories of consumer health data, or use consumer health data for purposes, that are not disclosed in this policy without first disclosing the additional categories or purposes and obtaining your affirmative consent.
Contact
If you have questions about this Consumer Health Data Privacy Policy or wish to exercise your rights, contact:
Ingrid Johnston Therapy Ingrid Johnston, MS, LMFT, MDFT
Email: ingrid@ingridjohnstontherapy.com
Phone: (206) 658-7831