Privacy Policy

Last Updated: June 30, 2026

This Privacy Policy describes the privacy practices of Willamette Wellness Center (“WWC,” “we,” “us,” or “our”) for information we collect through our website www.wwcpdx.com (the “Website”) and our online intake, scheduling, and communication systems. It explains what we collect, how we use and share it, the choices and rights available to you, and how we protect your information. It also includes Oregon-specific and Washington-specific sections required by state law.

How this Policy fits with our HIPAA Notice

WWC is a HIPAA-covered health care provider. The clinical health information we maintain about our patients — your “protected health information” or “PHI” — is governed primarily by HIPAA (45 C.F.R. Parts 160 and 164) and by our separate HIPAA Notice of Privacy Practices (“HIPAA Notice” or “NPP”), together with applicable Oregon and Washington health-privacy laws. This Privacy Policy governs information collected through the Website and intake systems that is not otherwise governed by the HIPAA Notice (for example, website analytics, marketing data, and inquiries from people who are not yet patients). Where information is PHI, the HIPAA Notice controls. Where state consumer-privacy law applies (see the Oregon and Washington sections below), those rights apply in addition to HIPAA.

1. Information We Collect

We are the owner of the information collected on the Website and through our intake process. We collect information in the following ways:

Information you provide

• Contact details (name, email, phone, ZIP/city) submitted through our contact and new-client forms;
• Information you provide through our online intake forms and scheduling system;
• Information shared in phone conversations during intake;
• Insurance and billing information, when applicable; and
• Clinical information you provide once care begins (maintained in our EHR and treated as PHI under the HIPAA Notice).

Information collected automatically

• Website usage and device data through cookies and similar technologies (for example, IP address, browser type, pages viewed), subject to your cookie choices
• Analytics and, where you consent, marketing/advertising identifiers from third-party tools (see our Opt-Out / Cookie Policy for the current list)

Sensitive and consumer health data. Some information collected through the Website can reveal or be associated with your physical or mental health — for example, the fact that you contacted a behavioral health practice, the service pages you view, or details in a contact or intake form. We treat this as “sensitive data” under Oregon law and “consumer health data” under Washington law and handle it as described in Sections 7 and 8.

2. How We Use Your Information

• To respond to your inquiries about services and scheduling;
• To provide clinical services, including treatment planning and case management (as PHI under the HIPAA Notice);
• To process insurance claims and handle billing, when applicable;
• To communicate about appointments, including confirmations, reminders, and changes;
• To operate, secure, and improve our Website and systems; and
• To comply with our legal obligations, including mental-health record-keeping and mandatory reporting

We do not use sensitive data or consumer health data for targeted advertising, and we do not sell it.

3. How We Share Information

We never sell or rent your personal information or health information. We share information only as follows:

• To fulfill your request — for example, coordinating with another health care provider with your written authorization;
• When required or permitted by law — including mandatory reporting obligations for licensed mental-health professionals and valid legal process; and
• With service providers and business associates who provide services essential to our practice under written confidentiality and Business Associate Agreements.

Service providers / business associates

• SimpleIntake by Productive Therapist — intake management / CRM
• TherapyNotes — electronic health record
• Doug Fir Billing — insurance claims processing (when applicable)
• Google Workspace (under a BAA) — secure communication and productivity
• Luxsci — email encryption and secure messaging

These parties are contractually bound to safeguard your information and to use it only to provide services to WWC. Our Website also uses analytics and advertising vendors (for example, Google Analytics and Meta), which operate only as permitted by your cookie choices and are described in our Opt-Out / Cookie Policy.

4. HIPAA Compliance

As a behavioral health practice, WWC complies with HIPAA. This Privacy Policy works together with our HIPAA Notice of Privacy Practices, which describes in detail how we may use and disclose PHI for treatment, payment, and health care operations; the uses and disclosures that require your written authorization (including most uses of psychotherapy notes, marketing, and any sale of PHI); your rights to access, amend, restrict, and receive an accounting of disclosures and confidential communications; and how to file a complaint with WWC or with the U.S. Department of Health and Human Services, Office for Civil Rights. As required by 45 C.F.R. § 164.520, our HIPAA Notice is prominently posted and available on this Website. Your health information is protected by both HIPAA and applicable state law.

5. Substance Use Disorder Records — 42 C.F.R. Part 2

WWC provides outpatient behavioral health care that includes substance use disorder ("SUD") support, delivered in part by clinicians credentialed in addiction treatment (Master Addiction Counselor and Certified Alcohol and Drug Counselor). Though WWC clinicians offer therapy sessions that touch upon SUD issues, WWC is not an SUD assessment or treatment facility nor do any WWC clinicians prescribe or medically manage SUD patients. Therapy progress notes that reference a patient’s SUD issues or diagnosis, or provide referrals to SUD treatment, are handled in the same manner as required under Part 2 for patient privacy.

Records that relate to an SUD diagnosis, therapy, or a referral for SUD treatment are protected by 42 C.F.R. Part 2 (authorized by 42 U.S.C. § 290dd-2) in addition to HIPAA. Part 2 generally provides that:

• Information identifying a person as having or having had a substance use disorder, when created by a Part 2 program, may not be disclosed without the individual’s specific written consent, except in limited circumstances permitted by law (such as a bona fide medical emergency, certain audits and evaluations, or a court order meeting Part 2’s requirements).
• A person who receives Part 2-protected information generally may not redisclose it except as permitted, and disclosures must be accompanied by the required notice prohibiting redisclosure.
• Following the 2024 federal Part 2 Final Rule, WWC’s Part 2 patient-notice obligations are aligned with our HIPAA Notice of Privacy Practices, which contains the controlling detail.

6. Your Choices and Control Over Your Information

You may, at any time, by contacting us using the details in Section 11:

• Ask what data we hold about you;
• Ask us to correct inaccurate data;
• Request deletion of your data (subject to the retention note below);
• Raise a concern about how we use your data; and
• Opt out of non-essential communications (every marketing message includes an opt-out).

Retention note: As a licensed behavioral health practice, we are required by law to retain certain clinical records for minimum periods. We cannot delete essential health information during the required retention period, but we will honor deletion requests for information that is not subject to a legal retention obligation.

Residents of Oregon and Washington have additional, legally enforceable rights described in Sections 7 and 8.

7. Oregon Residents — Oregon Consumer Privacy Act (OCPA)

WWC values the privacy of its Oregon clients and website visitors. Your health information is protected by HIPAA, by 42 C.F.R. Part 2 (Section 5), and by Oregon health-privacy and confidentiality law — including your right to have protected health information safeguarded (ORS 192.553), the limits on disclosing treatment records and psychotherapy notes (ORS 192.558), necessary disclosure related to Oregon Health Plan participants (ORS 192.561) and the psychotherapist- and counselor-client privileges (ORS 40.230; ORS 40.262).

Oregon also has a general consumer-privacy statute, the Oregon Consumer Privacy Act (ORS 646A.570 to 646A.589). Its consumer-rights provisions apply only to businesses that meet the statute’s volume thresholds — generally processing the personal data of 100,000 or more Oregon consumers in a year, or 25,000 or more while deriving at least 25% of revenue from selling data (ORS 646A.572). WWC does not meet these thresholds and is not currently subject to the OCPA’s rights provisions.

Even so, as described in Section 6, Oregon residents may contact us to access, correct, or delete personal data (subject to the record-retention limits noted there), and we do not sell personal data. If WWC ever becomes subject to the OCPA, we will honor the rights it provides.

8. Washington Consumers — My Health My Data Act (MHMDA)

This Section is WWC’s Consumer Health Data Privacy Policy for purposes of Washington’s My Health My Data Act (chapter 19.373 RCW) and applies to “consumer health data” of Washington residents and of consumers whose data is collected in Washington that is not exempt PHI. A direct link to this Section is published on our Website homepage as required by RCW 19.373.020.

Categories of consumer health data we collect, and our purposes

• Identifiers and contact data that, in the context of our Website, indicate you sought or received behavioral health services (name, email, phone, and inquiry content). Purpose: to respond to inquiries, schedule care, and provide services you request.
• Website and device data that can be linked to health-seeking activity (pages viewed, IP address, approximate location, cookie identifiers). Purpose: to operate, secure, and improve the Website, subject to your cookie choices.

Sources of consumer health data

• Directly from you (forms, calls, intake); and
• Automatically from your device and browser via cookies and similar technologies.

Categories of consumer health data we share

• Contact and inquiry data, shared with the service providers/business associates listed in Section 3 to deliver the services you request; and
• Website/analytics data, shared with analytics and advertising vendors only where you have consented through our cookie banner.

Categories of third parties and affiliates with whom we share

• Health care operations vendors and business associates (intake, EHR, billing, secure communications);
• Website analytics and advertising providers (only with your consent); and
• Government agencies or others when required by law.

Your Washington rights (RCW 19.373.040)

• Right to confirm whether we collect, share, or sell your consumer health data, and to access it.
• Right to a list of the third parties and affiliates with whom we have shared or to whom we have sold your consumer health data.
• Right to withdraw consent to our collection and sharing of your consumer health data.
• Right to delete your consumer health data.

Consent, no sale, and geofencing

We collect and share consumer health data only as necessary to provide a product or service you have requested or with your consent (RCW 19.373.030). WWC does not sell consumer health data; consistent with RCW 19.373.070, we would not sell such data without first obtaining your separate, valid, written authorization, which is distinct from consent to collect or share. Consistent with RCW 19.373.080, WWC does not use a geofence around any health care facility to identify, track, collect data from, or send messages to consumers based on their health-seeking activity.

How to exercise your Washington rights

Submit a request using the contact details in Section 11. We will respond within the time MHMDA allows. Washington consumers may also enforce their rights under the Washington Consumer Protection Act (RCW 19.86) and may contact the Washington Attorney General at atg.wa.gov/file-complaint.

9. Website, Cookies & Communications

Cookies and tracking

Our Website uses cookies and similar technologies for functional, statistical, and (with your consent) marketing purposes. You control these through our cookie banner and our Opt-Out / Cookie Policy, which lists the specific technologies in use. Non-essential cookies are set only with your consent, and we honor recognized opt-out preference signals.

External links

Our Website may link to other sites. We are not responsible for the content or privacy practices of those sites and encourage you to read their privacy statements.

Surveys and feedback

We may occasionally request information through voluntary surveys or feedback forms to improve our services and client satisfaction.

Email communications

Unless you ask us not to, we may email you appointment confirmations and reminders, practice-policy updates, information about services, and notices of changes to this Policy. You may opt out of non-essential communications at any time.

10. Security

We take reasonable administrative, technical, and physical precautions to protect your information, including:

• Encryption: Sensitive information submitted through the Website and intake forms is encrypted in transit.
• Secure connections: Look for “https” and the lock icon in your browser when submitting information.
• Secure systems: Our intake and records systems use enterprise-grade security.
• Limited access: Only workforce members who need information to do their jobs may access it.
• Training and agreements: Staff receive privacy and security training, and vendors handling your information sign Business Associate Agreements.

No system can be guaranteed perfectly secure; we will notify affected individuals and authorities of a reportable breach as required by HIPAA, the Oregon and Washington breach-notification laws, and other applicable law.

11. Contact Us

If you believe we are not following this Privacy Policy, please contact us right away. You may also contact the Oregon or Washington Attorney General, or, for health-information concerns, the U.S. Department of Health and Human Services, Office for Civil Rights.

12. Changes to This Policy

We may update this Policy from time to time. We will post the updated version here with a new “Last Updated” date and, for material changes, provide additional notice as required by law.