Privacy Policy

This Website Privacy Policy (“Privacy Policy”) describes how Harmony Mindful Breakthrough Specialists, LLC (“Harmony,” “we,” “our,” or “us”) collects, uses, and protects information when you access or use www.harmonymbs.com, including any subdomains and web pages that are owned and operated by Harmony, collectively, the “Website.”

This Privacy Policy applies only to information collected through the publicly accessible portions of the Website.

It does not apply to information collected, stored, or processed through our secure patient portal, telehealth platform, or electronic health record (“EHR”) system, which are governed by separate Notices of Privacy Practices (“NPPs”), applicable healthcare privacy laws, and contractual agreements with service providers, as required by law.

Harmony Mindful Breakthrough Specialists (“Harmony”) is a California-based psychiatric mental health and integrative care practice that provides services to adults age 18 and older who are physically located in the State of California at the time services are rendered.

We are committed to protecting privacy and implementing safeguards designed to support compliance with applicable federal and California privacy and healthcare laws.

We protect information in accordance with applicable legal requirements, which may include, as relevant to our operations:

• The Health Insurance Portability and Accountability Act of 1996 and the Health Information Technology for Economic and Clinical Health Act, HIPAA/HITECH
• The California Consumer Privacy Act, as amended by the California Privacy Rights Act, CCPA/CPRA, to the extent applicable
• The California Confidentiality of Medical Information Act, CMIA
• Other applicable California privacy and healthcare laws, and commercially reasonable administrative, technical, and physical safeguards

We design our public Website to limit the collection of personal information and to discourage the submission of Protected Health Information (“PHI”) through publicly accessible website features. The Website is not intended for the submission of clinical information, medical history, or urgent health-related communications.

Non-PHI only.

We collect limited technical, device, and usage information through the publicly accessible portions of the Website to help us understand how visitors use the site and improve performance.

Automatically Collected Technical Data

• Browser type
• Device type, such as mobile or desktop
• Approximate geographic region derived from IP address, such as county or metropolitan area, not precise street address
• Pages viewed
• Referring source, such as Google, Facebook Ad, or Direct

This data:

• is not used by Harmony MBS to identify individual visitors
• may be processed in aggregated or de-identified form to the extent practicable and consistent with operational needs

We do not intentionally collect through the public Website:

• Medical conditions
• Intake information
• Appointment details
• Sensitive personal identifiers such as Social Security numbers or government-issued identification numbers
• Any content you may enter inside the EHR portal or telehealth platform

Users are instructed not to submit medical or clinical information through public Website forms or general email links.

All truly sensitive activity, including intake, scheduling, screening questions, messaging, and payments, occurs only inside the secure portal.

Clinical information and Protected Health Information (“PHI”) are collected and maintained solely within secure systems designed to comply with applicable healthcare privacy laws. However, basic contact information voluntarily submitted through public Website forms, such as name, email address, or phone number, may be collected for administrative purposes.

The Website is provided for general informational and educational purposes only. You should not interpret any content on the Website as medical advice, psychiatric advice, diagnosis, treatment recommendation, or individualized clinical guidance.

Nothing on this Website is intended to substitute for professional medical advice, diagnosis, or treatment from a qualified healthcare provider. You should always seek the advice of your physician or other qualified healthcare provider regarding any medical or mental health condition.

Use of the Website does not:

• create a patient-provider relationship
• evaluate symptoms
• offer individualized medical interpretation
• direct specific medication or treatment actions

A patient-provider relationship is established only after completion of required intake documentation, confirmation of appointment by Harmony, and mutual agreement with your practitioner to enter into a clinical relationship through secure systems.

The Website is not monitored for emergency communications. If you are experiencing a medical or mental health emergency, call 911 or go to the nearest emergency room. If you are experiencing a crisis and need to speak to someone right away, call or text 988 to access trained counselors 24 hours a day, seven days a week.

Harmony MBS uses a fully HIPAA-compliant EHR and telehealth platform for:

• Creating a patient account
• Completing screenings
• Intake and assessments
• Scheduling and rescheduling
• Messaging your provider
• Treatment plans and charting
• Payments and card storage

All of these systems:

• operate independently of WordPress
• are encrypted end-to-end
• execute under a Business Associate Agreement, BAA
• store data in compliant environments
• do not transmit PHI to our website, hosting, plugins, or analytics

Where links or embedded elements appear, they function as secure redirects or frames and are designed to avoid storage of PHI on Website infrastructure.

These tools are configured, where reasonably feasible, to support privacy-protective operation.

Harmony MBS does not collect or intentionally use analytics tools to identify individual users.

• disables Google Signals
• strips URL parameters that could reveal health-related content
• prevents PHI from being captured in page titles or events
• tracks only anonymous aggregated behavior

You may still opt out using standard Google tools.

Harmony MBS honors Global Privacy Control (GPC) signals where required and technically feasible under applicable California law.

Facebook Pixel

Harmony MBS uses the Facebook Pixel only on general, non-health pages, including:

• Home page
• About page
• Blog index, not individual posts
• General wellness article category index
• Contact page, only if no form appears

We do not use pixels on:

• condition pages
• symptom-related content
• intake or scheduling areas
• anything tied to diagnosis or health information

This approach aligns with current HHS/OCR guidance on tracking technologies for healthcare websites.

Harmony MBS honors browser-based Global Privacy Control (GPC) signals where technically feasible, in accordance with California law.

We provide a Do Not Sell or Share My Personal Information link in the footer that allows visitors to:

• opt out of marketing audiences
• opt out of general web tracking
• request deletion of general website data, non-PHI

PHI is never used for advertising or tracking and is protected exclusively within the EHR.

6A. California Privacy Rights

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA), subject to applicable legal limitations.

You have the right to request:

Right to Know

You may request disclosure of:

• Categories of personal information collected
• Categories of sources from which personal information is collected
• Business or commercial purposes for collecting personal information
• Categories of third parties to whom personal information is disclosed
• Specific pieces of personal information collected about you

Right to Delete

You may request deletion of personal information we have collected from you, subject to legal retention obligations.

Right to Correct

You may request correction of inaccurate personal information.

Right to Limit Use of Sensitive Personal Information

Harmony MBS does not collect sensitive personal information through its public website.

Right to Opt-Out of Sale or Sharing

Harmony MBS does not sell personal information.

Harmony MBS does not share personal information for cross-context behavioral advertising in a manner requiring opt-out under CPRA.

Right to Non-Discrimination

We will not discriminate against you for exercising your privacy rights.

To exercise your rights, contact us at privacy@harmonymbs.net. Identity verification may be required prior to processing requests.

Harmony provides clinical services exclusively to adults age 18 and older. The Website is not directed to, or intended for use by, individuals under the age of 18.

We do not knowingly collect personal information through the publicly accessible portions of the Website from individuals under 18 years of age.

If we become aware that personal information has been submitted through the Website by an individual under 18, we will take reasonable steps to delete such information in accordance with applicable law.

If you are a parent or legal guardian and believe that a minor has provided information through the Website, please contact us using the contact information provided below so that we may investigate and address the matter appropriately.

Harmony is licensed to provide clinical services only to individuals who are physically located in the State of California at the time services are rendered.

The Website is intended for use by individuals located within the United States and is not directed to, or intended to solicit, individuals outside the United States.

Accessing the Website from jurisdictions outside the United States is done at the visitor’s own initiative.

Harmony does not offer clinical services to individuals located outside California and does not intentionally market to residents of the European Union or other foreign jurisdictions.

If you access the Website from outside the United States, you acknowledge that your information may be processed in the United States, where privacy laws may differ from those in your jurisdiction.

Individuals located in the European Union or other international jurisdictions should not submit personal information or inquiries through the Website.

We protect site integrity using:

• SSL / HTTPS throughout
• HIPAA-compliant hosting environments, such as HIPAAVault and ScalaHosting
• Daily encrypted backups
• Firewalls and malware prevention tools
• Security measures may include access controls, monitoring, and security updates
• No system can guarantee absolute security
• 2-factor authentication for administrators
• Role-based user permissions
• Prohibition of storing PHI anywhere in WordPress

Any vendor processing data on our behalf must:

• operate under a BAA if they ever encounter PHI, most do not
• meet strict privacy and security standards
• where required by law or contract

Examples:

• Hosting provider
• Analytics tools
• EHR/telehealth provider
• HIPAA-secure email marketing, for non-PHI newsletters only

10A. Data Retention

Harmony MBS retains non-identifiable website analytics data only for as long as reasonably necessary to fulfill legitimate operational purposes, including:

• Website performance monitoring
• Security monitoring
• Fraud prevention
• Compliance with legal obligations

We do not retain personal information collected through the public website because no personal information is collected through the public website.

Any data collected through separate HIPAA-regulated systems is governed exclusively by our HIPAA Notice of Privacy Practices.

We use anonymized analytics to understand:

• how many people visit the site
• which pages are most helpful
• how visitors interact with general content
• which ads generate traffic
• whether users reach the non-PHI “Next Step” pages

We never track:

• identities
• PHI
• portal activity
• individual-level behavior

All tracking occurs at an aggregated, anonymized level.

11A. No Collection of Protected Health Information Through Website

Harmony MBS does not request, collect, store, transmit, or process Protected Health Information (PHI) through its public website.

All PHI collection occurs exclusively through secure, HIPAA-compliant platforms governed by:

• Business Associate Agreements
• HIPAA Privacy Rule
• HIPAA Security Rule
• California Confidentiality of Medical Information Act, CMIA

The public website is intentionally segregated from all clinical systems.

This website is not intended for emergency use.

If you are in crisis or having thoughts of harming yourself or others, call 988 or go to the nearest emergency room.

12A. Limitation of Liability

To the fullest extent permitted under California law, Harmony Mindful Breakthrough Specialists shall not be liable for any indirect, incidental, consequential, special, or punitive damages arising out of or relating to:

• Use of the website
• Inability to access the website
• Reliance on website content
• Technical errors or interruptions

Nothing in this section limits liability where prohibited by law.

12B. Changes to This Privacy Policy

Harmony MBS reserves the right to update or modify this Privacy Policy at any time. Changes become effective immediately upon posting on the website.

Continued use of the website constitutes acceptance of the updated policy.

The Effective Date at the top reflects the most recent revision.

If you have privacy-related questions, you may contact us at:

Harmony Mindful Breakthrough Specialists
9100 WILSHIRE BLVD E TWR STE 333 #452
BEVERLY HILLS CA 90212-3405

• Email: privacy@harmonymbs.net
• Phone: (310) 694-9293

California residents have the right to request information regarding disclosure of personal information to third parties for direct marketing purposes.

Harmony MBS does not disclose personal information to third parties for their direct marketing purposes.

Requests may be submitted to: privacy@harmonymbs.net

This Privacy Policy shall be governed by and interpreted in accordance with the laws of the State of California.

Any disputes arising under this Privacy Policy shall be resolved exclusively in the state or federal courts located in California.

Opt-out complete; your visits to this website will not be recorded by the Web Analytics tool. Note that if you clear your cookies, delete the opt-out cookie, or if you change computers or Web browsers, you will need to perform the opt-out procedure again.

You may choose to prevent this website from aggregating and analyzing the actions you take here. Doing so will protect your privacy, but will also prevent the owner from learning from your actions and creating a better experience for you and other users.

This opt out feature requires JavaScript.

The tracking opt-out feature requires cookies to be enabled.