Legal

Privacy Policy

Last updated: June 24, 2026  ·  Kristy Long, LMFT 163942

This Privacy Policy describes how Kristy Long, LMFT ("I," "me," or "my practice") collects, uses, and protects information gathered through this website (kristylonglmft.com). This policy applies to website visitors and prospective clients. It does not replace or supersede the Notice of Privacy Practices provided to active therapy clients, which governs the handling of Protected Health Information (PHI) under HIPAA.

Information I Collect

This website may collect the following types of information:

• Contact form submissions — name, email address, and any message content you voluntarily provide.
• Intake form submissions — personal, clinical, and insurance information submitted through the new client intake form.
• Usage data — standard server logs including IP address, browser type, pages visited, and referring URLs. This data is used for site security and performance only.

How I Use Your Information

Information submitted through this website is used solely to:

• Respond to your inquiry or consultation request.
• Process new client intake information prior to a first appointment.
• Maintain the security and functionality of this website.

I do not sell, rent, or share your personal information with third parties for marketing purposes.

HIPAA Notice

As a licensed mental health provider, I am required to comply with the Health Insurance Portability and Accountability Act (HIPAA). Any Protected Health Information (PHI) shared through this website — including intake form submissions — is handled in accordance with HIPAA regulations. Active therapy clients receive a separate Notice of Privacy Practices at the start of treatment.

Please note: email and web contact forms are not fully HIPAA-secure channels. Avoid sharing sensitive clinical details in contact form messages. Use the intake form only when you have been directed to do so as part of the onboarding process.

California Privacy Rights (CCPA)

California residents have the right to request information about personal data collected, request deletion of personal data, and opt out of the sale of personal data (I do not sell personal data). To exercise these rights, contact me directly using the information below.

Cookies & Tracking

This website may use essential cookies required for basic functionality. I do not use third-party advertising cookies or behavioral tracking. If analytics are used, they are configured to anonymize IP addresses and not share data with advertising networks.

Data Retention

Contact form messages are retained only as long as necessary to respond to your inquiry. Intake form data for clients who do not begin treatment is deleted within 90 days. Clinical records for active and former clients are retained in accordance with California BBS requirements (7 years for adults; until age 25 for minors).

Third-Party Services

This website is hosted on GoDaddy infrastructure. Telehealth sessions are conducted via Zoom for Healthcare or a HIPAA-compliant platform. These services have their own privacy policies and, where applicable, Business Associate Agreements (BAAs) are in place.

Contact

If you have questions about this Privacy Policy or wish to exercise your privacy rights, please contact me through the contact page.

Kristy Long, LMFT 163942  ·  Licensed in California  ·  Telehealth only