Notice of Privacy Practices

Last update date: 11 March 2026

The original effective date of this notice is July 2023. This notice was last updated in March 2026.

Your personal data identifies you and is collected when you use our mental health services. We may collect, use, and share your data as described in this notice. THIS NOTICE DESCRIBES HOW HEALTH INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED, AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

Information that you provide to us, and information related to the services we provide to you is private. Personal information that identifies you and relates to our services is called protected health information (PHI). We may collect, use, and share your PHI as allowed or required by law, including the HIPAA Privacy Rule.

We can change the terms of this notice and the changes will apply to the information we have about you. The new notice will be available on our website and when you ask for it. Please contact us to request a copy of this notice in another languages or format.

This notice applies to services we provide in the United States. If you have any questions about this notice, please contact our US Privacy Officer using the contact information listed at the bottom of this notice.

Our responsibilities

We are required by law to:

• Keep your PHI private and secure.
• Tell you promptly if a breach occurs that may involve the privacy and security of your PHI.
• Tell you what the law says about privacy.
• Make sure our business partners protect the privacy of data we share with them. They are not allowed to give your PHI to others without your written permission unless the law allows, or it is stated in this notice.
• Do what we say we will do in this notice and give you a copy if you ask.
• Not use or share your PHI other than described here unless you tell us we can in writing. If you tell us we can, you may change your mind at any time. Let us know in writing if you change your mind.

For more information see: https://www.hhs.gov/hipaa/for-individuals/index.html.

Your information

We may use your information as described in this notice. We may collect:

• Your name, age, email address, username, password, and other registration information;
• Health information you provide to us. This may include medical or health history, health status, and other health-related information; and
• Health information from our internal team members. Our team members include licensed therapists, behavioral health coaches, and support staff who provide you with services.

Your choice

You can tell us your choices about certain information we share:

• You have a right and a choice to tell us to share information with your family, friends, or others involved in your care.
• We will never use your PHI for marketing purposes (defined by HIPAA) or sell your information without your authorization.
• Use or sharing of psychotherapy notes (except for limited legal or training purposes allowed by law) requires your authorization.
• Psychotherapy Notes are the private, informal notes a therapist takes during a session that are not attached to your record. They are used by the therapist to document their own impressions, capture the feel of the conversation, or track their personal hypotheses about your care.

If you can’t tell us your preference, such as in an emergency, we may share your PHI if we believe it’s in your best interest. We can share your information to lessen a serious or likely threat to your or someone else’s health and safety.

Our uses and disclosures

When you use your service, you provide information to us. This includes entering information directly while using our services and sharing information with your support team. We typically use, collect, or share your PHI in the following ways:

• Treatment: We use your information to provide you with our services. Examples of ways we use your information for treatment purposes:

1. You may share your PHI with your licensed therapist, behavioral coach, or others involved in your care. We use this information to provide services to you.
2. We may use PHI to review the quality of care and services you receive.
3. We may collect and use data about you to support you and help you get local services.
4. We may collect and use your PHI to create, use, or share de-identified data as allowed by HIPAA and contract requirements.

• Health Care Operations: We use and share your information to run our organization and contact you when necessary. We may use, collect, or share your PHI for the following operations purposes:

1. We use PHI to develop better services for you.
2. We may share your information with contractors and agents who help run our program and provide you with services. We make sure these third parties sign contracts to protect your information and limit using your information to the minimum amount necessary.

• Payment: We can use and share your health information to bill and get payment from health plans or other entities.

1. Example: We give information about you to your health insurance plan so it will pay for your services.

• Other reasons we may use or share your information: We are allowed or required to share your PHI in other ways. Usually these are ways that contribute to the public good, such as public health and research. We must meet many conditions in the law before we can share your information for these purposes:
  ‍
  Helping with public health and safety issues. For example:

1. Reporting suspected abuse, neglect, or violence;
2. Preventing or reducing a serious threat to anyone’s health or safety;
3. Doing health research;
4. Responding to lawsuits and legal actions;
5. Complying with state and federal law if it requires sharing your information;
6. As required by military authorities;
7. Health oversight activities; and
8. Complying with special laws when they are stricter than this notice.

Special Provisions for Records Regarding Substance Use Disorder

Some of the health information we receive, specifically records regarding Substance Use Disorder (SUD) treatment from federally assisted programs, is protected by additional federal laws (42 CFR Part 2). These records are treated with a higher level of confidentiality than other medical information.

We will not use or disclose your SUD treatment records (or any testimony describing them) in any civil, criminal, administrative, or legislative proceedings against you, unless you have provided specific written consent or we are served with a specialized court order.

For patients receiving SUD treatment, you may provide a single, broad consent that allows us to use and disclose your records for treatment, payment, and healthcare operations. You have the right to revoke this consent at any time and the right to receive an accounting of disclosures for these purposes.

Once your SUD information is disclosed to an authorized recipient, it may be subject to redisclosure by that recipient and may no longer be protected by these specific federal privacy rules, though it may still be protected by HIPAA.

Breaches of SUD records will be notified in accordance with HIPAA Breach Notification standards.

Your rights

Federal law says you have certain rights when it comes to your health information. This section explains your rights and our responsibilities. Email privacy@kooth.com or call us toll-free at (844) 582-2111 to exercise any of these rights.

Get a copy of your health record.

• You can ask to see or get a copy of your health record and other health information we have about you.
• Some of your information is available directly to you through the service itself. Please contact us at (844) 582-2111 if you need help using these features.
• We will provide a copy or summary of your health records within 30 days. If we need more time, we will let you know.
• We may deny a part or all of your request in limited situations. An example of this would be if we received information from someone other than you.

Ask us to correct your health record.

• You can ask us to correct health information about you that you think is wrong or not complete. Your request must be in writing and include a reason for your request.
• We can only correct information that we create and maintain. If someone else gave us the information, we will let you know so you can ask them to correct it. We will also let you know if we no longer have the information or if we determine the information is accurate or complete.
• We may deny your request, but we will tell you why in writing within 60 days.

Request confidential communications.

• You can ask us to contact you in a specific way (for example, home or office phone) or to send email to a different address.
• We will consider all requests and must say “yes” if you tell us you would be in danger if we do not agree.

Ask us to limit what we use or share with others.

• You can ask us not to use or share certain health information for treatment or operations.
• We are not required to agree to your request, and we may say “no” if it would affect your care or the services we provide to you.
• If you pay for a service or health care item out-of-pocket in full, you can ask us not to share that information for the purpose of payment or our operations with your health insurer. We will say “yes” unless a law requires us to share that information.

Get a list of those with whom we’ve shared information.

• You can ask for a list (accounting) of the times we shared your PHI for up to six years before the date you ask. We will tell you who we shared it with and why.
• We will include all the times we shared your PHI except for those about treatment, health care operations, and certain other disclosures (for example, any you asked us to make). We may charge a reasonable, cost-based fee for this.

Get a copy of this privacy notice.

• You can ask for a paper copy of this notice at any time. We will provide you with a paper copy at the address you provide in your request.

Choose someone to act for you.

• If you have a medical power of attorney or legal guardian, that person can exercise your rights and make choices about your health information.
• We will make sure the person can legally act for you before we take any action.

It’s important we treat you fairly.

• You can file a complaint if you feel we have violated your rights by contacting the US Privacy Officer below.
• You can also file a complaint with the US Department of Health and Human Services, Office of Civil Rights at 200 Independence Ave. SW; Room 509F HHH Bldg., Washington, DC 20201; by calling 1-877-696-6775; or visiting www.hhs.gov/ocr/privacy/hipaa/complaints/.
• We will not retaliate against you for filing a complaint.

State Laws and Additional Protections

We provide services in multiple states. In some cases, the laws of the state where you receive care may provide you with greater rights or more protection for your health information than the federal rules described in this notice. This is often true for information related to:

• Mental Health: Some states require your specific written consent before sharing records in response to a subpoena.
• Minors: Some states allow minors to consent to their own care, giving them the primary right to control the privacy of those records.

1. In California, minors 12+ may consent to their own mental health treatment.
2. In Michigan, minors 14+ may consent to their own mental health treatment, subject to session limits.
3. In New Jersey, minors 16+ may consent to their own mental health treatment.

• Sensitive Conditions: Some states have stricter rules for sharing information about HIV/AIDS, other communicable diseases, or genetic testing.

When a state law gives you more protection than federal law, we will follow that state law. If you have questions about which laws apply to you, please contact our Privacy Officer.

Contact Information

For more information, to exercise your rights, or to report a problem please contact the US Privacy Officer at:

Kooth USA LLC

Rachel Thompson

US Privacy Officer

1 South Green St., Chicago, IL 60607

(844) 582-2111

privacy@kooth.com