Client Privacy Statement

This Privacy Statement is to inform you what personal data I collect from you, how I use it, how I store it, and your rights regarding that data. Please read this carefully before your session begins.

What data do I collect and why?

• •Name and age — This basic information helps me understand your background and tailor our sessions to you.
• •Email address and phone number — I use these to contact you regarding your sessions, send your personalized audio recording, and follow up on your progress. I will primarily use the method you first contacted me on. If I cannot reach you, I may try an alternative method.
• •Next of kin or medical professional's details — In the rare event that I am concerned you may be at risk, I may need to contact your next of kin or a medical professional. I will notify you if and when I intend to do this.
• •Session notes — I keep brief notes of our session(s) to support the continuity and quality of your care. Notes are stored securely in your client file within Zanda Health, a HIPAA-conscious practice management platform. All records are password protected and accessible only to me.

Will I share your data?

It is very unlikely that I will share your data. I will never sell it or use it for unethical purposes. There are limited circumstances in which I may be required to share information:

• •If my session notes are subpoenaed by a court of law.
• •If I believe you, or someone you have told me about, is at risk of harm — I may be required to pass this information on to the appropriate party.
• •I may discuss aspects of your case during professional supervision. In these discussions, only your first name is used. Your full identity remains completely confidential.

How do I store your data?

All client records are stored digitally and securely. Your personal information, session notes, and related documents are kept within Zanda Health, a password-protected, HIPAA-conscious practice management system. Only I, Lori Kris Malek, have access to your records.

Your contact details may also be stored in my secure, password-protected business phone under your first name and last initial only. No client data is stored on unsecured personal devices or shared platforms.

How long will I store your data?

I will retain your personal details and session notes for a minimum of 7 years following the conclusion of our work together, in accordance with standard professional practice requirements.

After this period, I will securely delete all digital records containing your personal information and remove your contact details from my business phone.

Your Rights

Under applicable privacy law, including the California Consumer Privacy Act (CCPA) and California Confidentiality of Medical Information Act (CMIA), you have the right to:

• •Request access to the personal data I hold about you.
• •Request correction of any inaccurate information.
• •Request deletion of your data, subject to any legal retention requirements.
• •Withdraw your consent at any time by contacting me at lori@healinginnersteps.com.

Questions or Concerns?

If you have any questions about how your data is handled, please contact me directly at lori@healinginnersteps.com. I am committed to handling your personal information with the highest standards of care, confidentiality, and respect.