Legal
Privacy Policy
Last updated:
This Privacy Policy explains how this website handles the small amount of information you may share with us. The site is run by Healing Home Counseling, Licensed Clinical Social Work Corporation, the private therapy practice of Ashley Hanna-Morgan, LCSW, PMH-C. In this policy, “we,” “us,” and “our” mean the practice, and “the site” or “this website” means ashleyhannamorgan.com.
We have kept this policy short and plainly worded, because it describes a deliberately simple website. This is an informational site about the practice. There are no accounts to create, nothing to buy, and no place to post. The only information you can send us here is through the contact form, and even that is kept to a minimum.
Your clinical care is separate from this website, and so is the privacy that protects it. If you become a client, your health information is handled through a secure, HIPAA-compliant platform under a different set of protections, described in the section on health information below and in the practice’s separate Notice of Privacy Practices.
Information this website collects
When you use the contact form
The contact form is the only place on this site where you can send us information. When you submit it, you share:
- your first and last name;
- your email address;
- your phone number, if you choose to give it (optional);
- the reason you are getting in touch, chosen from a short fixed list;
- the state you are contacting us from (California, Nevada, or somewhere else);
- your preferred way to be contacted, if you tell us (optional);
- a free-text message; and
- a required acknowledgement that you understand the form is not monitored for emergencies and is not a secure way to send health information.
Your submission is delivered to us by email only. It is not saved to this website or its server, there is no database of form submissions, and the content of your message is not written to any log. We ask you to keep the message brief and to leave out detailed health information, for the reasons explained further down.
When you submit the form, we also send one automated acknowledgment to the email address you entered. It confirms that your website message was submitted and relates only to that submission. It is not a newsletter, it does not add you to any mailing list, and it is not consent to marketing email.
Information collected automatically
Like almost every website, this site runs on a web server (provided by our host) that keeps standard access logs. Those logs can include your IP address, your browser and device type, the pages you request, and the date and time. This is ordinary server housekeeping and security information; it is not combined with the contact form to build a profile of you.
Spam prevention on the contact form
To keep the contact form from being flooded by automated abuse, we use a few protections:
- a bot check from Cloudflare called Turnstile. To confirm a real person is submitting the form, a Turnstile verification token and your IP address are sent to Cloudflare;
- a hidden decoy field that people never see and automated scripts tend to fill in; and
- a rate limiter that briefly slows repeated submissions from the same source. It does this by scrambling your IP address with a secret value on our server. The result is temporary, the raw IP address is not stored, and it is not linked to your identity.
How we use this information
We use the details you send only to read your message, understand what you need, and reply. Your email address is used to respond to you and to send the one automated acknowledgment described above; it is set as the reply address on the message that reaches us, and it is not used for advertising or added to any marketing list. There is no newsletter attached to this form.
We do not sell your personal information, and we do not share it with anyone for their own advertising or marketing.
Cookies and similar technologies
This site uses one small, strictly necessary cookie of its own, named __Host-ahm_csrf. It protects the contact form against a common type of forgery, lasts about two hours, and is not used for tracking, analytics, or advertising.
The Cloudflare Turnstile bot check described above may set its own short-lived cookie or store a little data in your browser in order to run its security check.
We also use one small preference cookie, ahm_consent, to remember your analytics choice. If you accept analytics (see the Analytics section below), Google Analytics sets its own cookies; if you decline or do nothing, it sets none. There are no advertising cookies and no cross-site tracking. The fonts you see are served from our own site, so no information about you is sent to a font company (for example, Google) to display them.
For more detail on the cookies used here, see our Cookie Notice.
Analytics
With your consent, this site uses Google Analytics 4, a service from Google, to understand how the site is used so we can improve it (for example, which pages are read and how visitors arrive). Analytics is off by default: nothing is loaded from Google and no analytics information is collected unless you choose “Accept” on the cookie banner. If your browser sends a Global Privacy Control signal, we treat it as a decline and analytics stays off, with no banner shown.
When analytics is on, Google Analytics sets its own cookies (listed in the Cookie Notice) and processes limited information about your visit, such as the pages you view, your approximate location, and your device and browser type. It uses your IP address to estimate that approximate location but does not log or store your full IP address, and it never receives your name or the content of anything you send through the contact form. Google processes this information as our analytics provider; Google’s own privacy policy also applies.
We use analytics only to measure the site. We do not use it for advertising, and advertising and personalization are turned off, so this data is not used to target ads to you. You can change your mind at any time using the Cookie Preferences link in the site footer (or by clearing this site’s cookies in your browser).
Service providers and other companies
A few outside companies help us run the site and receive your inquiry. Each one only receives what it needs for its part.
- Bluehost hosts the website and our email. Its servers keep the standard access logs described above and carry your inquiry email while it is being delivered.
- Cloudflare provides the Turnstile bot check on the contact form. As noted above, it receives a verification token and your IP address to confirm you are a person.
- Google (Gmail) is the practice’s mailbox provider. Inquiries sent to our address are forwarded into a Gmail inbox, so Google processes those emails as our email provider.
- Google Analytics measures how the site is used, but only if you accept analytics on the cookie banner. If you decline, it is never loaded. See the Analytics section below.
- SimplePractice is a separate, HIPAA-compliant scheduling and telehealth platform that we link to from the site. If you choose to book or start care there, SimplePractice collects your information under its own terms and under a Business Associate Agreement with the practice. That is a different system from this website. Visit the SimplePractice booking page.
- YouTube may appear as a click-to-load video, served through youtube-nocookie.com. Nothing loads from YouTube, and no data is sent to it, until you choose to click play.
The site also links out to other websites, such as LinkedIn, Amazon, Barnes & Noble, and the support organizations listed on our Resources page. Once you follow a link away from this site, the site you land on is governed by its own privacy policy, not this one.
Health information is handled separately
This is important, so we state it plainly. The contact form is not a secure channel, and it is not the place for protected health information. The form asks you not to include detailed health information, and we mean it. A short note about why you are reaching out is all that is needed.
Clinical services, intake, and any health information are handled through SimplePractice, the HIPAA-compliant platform described above, and are covered by the practice’s separate Notice of Privacy Practices rather than by this website policy. Please do not use the website contact form to send anything you would consider private health information; use SimplePractice for anything clinical.
California has additional laws that protect medical information held by health-care providers, such as the Confidentiality of Medical Information Act. Those protections apply to your clinical relationship with the practice, which lives in the HIPAA-compliant platform, not to this informational website. For more on the boundary between website content and clinical care, see our Website & Clinical Disclaimer.
How long we keep your information
Because the contact form is email-only, there is no separate website database of submissions to keep or delete. Your inquiry exists as an email in the practice’s inbox. We keep it as long as reasonably needed to respond to you and, where relevant, to remember our conversation, after which it is handled under the practice’s ordinary email housekeeping.
You can ask us to delete an inquiry email from you at any time using the contact details below.
Your choices and your privacy rights
Using the contact form is always your choice. If you would rather not send information through it, you are welcome to reach us another way. To ask what information we hold about you, or to ask us to delete an inquiry, email hello@ashleyhannamorgan.com or use our contact form.
Some California residents have rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act, including the right to know what a business collects, to request deletion, and not to be treated differently for exercising those rights. Those laws apply only to businesses that meet certain size thresholds, for example annual gross revenue above roughly $26.6 million (a figure adjusted periodically for inflation), or buying, selling, or sharing the personal information of 100,000 or more California consumers or households in a year, or earning at least half of their revenue from selling or sharing personal information. A solo therapy practice of this size does not appear to meet any of those thresholds, so these laws most likely do not apply to this website. We describe your choices here regardless, and we will do our best to honor any reasonable request you make.
How we protect your information
The site is served over an encrypted connection (HTTPS/TLS), and the contact form is protected by the forgery-protection cookie and the Cloudflare Turnstile check described above. Even so, no method of sending or storing information over the internet is completely secure, and we cannot guarantee absolute security.
Ordinary email in particular is not fully secure. Please do not send sensitive health details through the contact form. For anything clinical, use SimplePractice, which is built for that purpose.
Children’s privacy
This website is intended for adults and is not directed to children under 13, and we do not knowingly collect personal information from children. If you believe a child has sent information to us through this site, please contact us and we will delete it.
Changes to this policy
We may update this Privacy Policy from time to time. When we make a meaningful change, we will revise the “Last updated” date at the top of this page. As noted above, if we ever add analytics or a cookie-consent banner, we will update this page and the Cookie Notice to describe it before it takes effect.
How to contact us
If you have any questions about this policy or about your information, reach us at hello@ashleyhannamorgan.com or through our contact form.
Healing Home Counseling, Licensed Clinical Social Work Corporation
Ashley Hanna-Morgan, LCSW, PMH-C
California and Nevada (telehealth)