Privacy Policy

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

Resonant Lotus Counseling (the “Practice”) is committed to protecting your privacy. The Practice is required by federal law to maintain the privacy of Protected Health Information (“PHI”), which is information that identifies or could be used to identify you. The Practice is required to provide you with this Notice of Privacy Practices (this “Notice”), which explains the Practice's legal duties and privacy practices and your rights regarding PHI that we collect and maintain.

YOUR RIGHTS
Your rights regarding PHI are explained below. To exercise these rights, please submit a written request to the Practice at the address noted below.

To inspect and copy PHI.
• You can ask for an electronic or paper copy of PHI. The Practice may charge you a reasonable fee.
• The Practice may deny your request if it believes the disclosure will endanger your life or another person's life. You may have a right to have this decision reviewed.

To amend PHI.
• You can ask to correct PHI you believe is incorrect or incomplete. The Practice may require you to make your request in writing and provide a reason for the request.
• The Practice may deny your request. The Practice will send a written explanation for the denial and allow you to submit a written statement of disagreement.

To request confidential communications.
• You can ask the Practice to contact you in a specific way. The Practice will say “yes” to all reasonable requests.

To limit what is used or shared.
• You can ask the Practice not to use or share PHI for treatment, payment, or business operations. The Practice is not required to agree if it would affect your care.
• If you pay for a service or health care item out-of-pocket in full, you can ask the Practice not to share PHI with your health insurer.
• You can ask for the Practice not to share your PHI with family members or friends by stating the specific restriction requested and to whom you want the restriction to apply.

To obtain a list of those with whom your PHI has been shared.
• You can ask for a list, called an accounting, of the times your health information has been shared. You can receive one accounting every 12 months at no charge, but you may be charged a reasonable fee if you ask for one more frequently.

To receive a copy of this Notice.
• You can ask for a paper copy of this Notice, even if you agreed to receive the Notice electronically.

To choose someone to act for you.
• If you have given someone medical power of attorney or if someone is your legal guardian, that person can exercise your rights.

To file a complaint if you feel your rights are violated.
• You can file a complaint by contacting the Practice.

• You can file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights by sending a letter to 200 Independence Avenue, S.W., Washington, D.C. 20201, calling 1-877-696-6775, or visiting www.hhs.gov/ocr/privacy/hipaa/complaints/.
• The Practice will not retaliate against you for filing a complaint.

To opt out of receiving fundraising communications.
• The Practice may contact you for fundraising efforts, but you can ask not to be contacted again.

To file a complaint or exercise your rights, contact the practice using the information below:

Resonant Lotus Counseling LLC
Amber Lundell, LPC

amber@resonantlotus.com

OUR USES AND DISCLOSURES
1. Routine Uses and Disclosures of PHI
The Practice is permitted under federal law to use and disclose PHI, without your written authorization, for certain routine uses and disclosures, such as those made for treatment, payment, and the operation of our business. The Practice typically uses or shares your health information in the following ways:

To treat you.
• The Practice can use and share PHI with other professionals who are treating you.
• Example: Your primary care doctor asks about your mental health treatment.

To run the health care operations.
• The Practice can use and share PHI to run the business, improve your care, and contact you.
• Example: The Practice uses PHI to send you appointment reminders if you choose.

To bill for your services.
• The Practice can use and share PHI to bill and get payment from health plans or other entities.
• Example: The Practice gives PHI to your health insurance plan so it will pay for your services.

2. Uses and Disclosures of PHI That May Be Made Without Your Authorization or Opportunity to Object
The Practice may use or disclose PHI without your authorization or an opportunity for you to object, including:

To help with public health and safety issues
• Public health: To prevent the spread of disease, assist in product recalls, and report adverse reactions to medication.
• Required by the Secretary of Health and Human Services: We may be required to disclose your PHI to the Secretary of Health and Human Services to investigate or determine our compliance with the requirements of the final rule on Standards for Privacy of Individually Identifiable Health Information.
• Health oversight: For audits, investigations, and inspections by government agencies that oversee the health care system, government benefit programs, other government regulatory programs, and civil rights laws.
• Serious threat to health or safety: To prevent a serious and imminent threat.
• Abuse or Neglect: To report abuse, neglect, or domestic violence.

To comply with law, law enforcement, or other government requests
• Required by law: If required by federal, state or local law.
• Judicial and administrative proceedings: To respond to a court order, subpoena, or discovery request.
• Law enforcement: For law locate and identify you or disclose information about a victim of a crime.
• Specialized Government Functions: For military or national security concerns, including intelligence, protective services for heads of state, or your security clearance.
• National security and intelligence activities: For intelligence, counterintelligence, protection of the President, other authorized persons or foreign heads of state, for purpose of determining your own security clearance and other national security activities authorized by law.
• Workers' Compensation: To comply with workers' compensation laws or support claims.

To comply with other requests
• Coroners and Funeral Directors: To perform their legally authorized duties.
• Organ Donation: For organ donation or transplantation.
• Research: For research that has been approved by an institutional review board.
• Inmates: The Practice created or received your PHI in the course of providing care.
• Business Associates: To organizations that perform functions, activities or services on our behalf.

3. Uses and Disclosures of PHI That May Be Made With Your Authorization or Opportunity to Object
Unless you object, the Practice may disclose PHI:

• To your family, friends, or others if PHI directly relates to that person's involvement in your care.
• If it is in your best interest because you are unable to state your preference.

4. Uses and Disclosures of PHI Based Upon Your Written Authorization
The Practice must obtain your written authorization to use and/or disclose PHI for the following purposes:

• Marketing,

• Sale of PHI, or

• Psychotherapy notes.

5. Use and Disclosure of Substance Use Disorder Records Subject to 42 CFR Part 2:
(A) If applicable, your substance use disorder (“SUD”) records are protected by federal law under 42 C.F.R. Part 2 (“Part 2”). This law provides extra confidentiality protections and requires a separate patient consent for the use and disclosure of SUD counseling notes. Each disclosure made with patient consent must include a copy of the consent or a clear explanation of the scope of the consent. It must also be accompanied by a written notice containing the language in 42 CFR Part 2.32(a). Disclosure of these records requires your explicit written consent, except in limited circumstances such as:

• Medical Emergencies: to the extent necessary to treat you,

• Reporting Crimes on Program Premises,

• Child Abuse Reporting: In connection with incidents of suspected child abuse or neglect to appropriate state or local authorities, and
• Fundraising: We will provide you with an opportunity to decline to receive any fundraising communications prior to making such communications.

You may revoke this consent at any time.

(B) Prohibitions on Use and Disclosure of Part 2 Records:
SUD records received from programs subject to Part 2, or testimony relaying the content of such records, shall not be used or disclosed in civil, criminal, administrative, or legislative proceedings against you unless based on your written consent, or a court order after notice and an opportunity to be heard is provided to you or the holder of the record, as provided in Part 2. A court order authorizing use or disclosure must be accompanied by a subpoena or other legal requirement compelling disclosure before the requested SUD record is used or disclosed. If SUD records are disclosed to us or our business associates pursuant to your
written consent for treatment, payment, and healthcare operations, we or our business associates may further use and disclose such health information without your written consent to the extent that the HIPAA regulations permit such uses and disclosures, consistent with the other provisions in this Notice regarding PHI.

You may revoke your authorization, at any time, by contacting the Practice in writing, using the information above. The Practice will not use or share PHI other than as described in Notice unless you give your permission in writing.

OUR RESPONSIBILITIES
• The Practice is required by law to maintain the privacy and security of PHI.
• The Practice is required to abide by the terms of this Notice currently in effect. Where more stringent state or federal law governs PHI, the Practice will abide by the more stringent law.
• The Practice reserves the right to amend Notice. All changes are applicable to PHI collected and maintained by the Practice. Should the Practice make changes, you may obtain a revised Notice by requesting a copy from the Practice, using the information above, or by viewing a copy on the website resonantlotus.com.
• The Practice will inform you if PHI is compromised in a breach.

This Notice is effective on 2/20/2026.

Cookie Policy

Purpose and Relationship to Other Policies

Purpose
This Cookie Policy (“Policy”) explains how cookies and similar tracking technologies are used on the website operated by Resonant Lotus Counseling LLC (the “Site”) and the choices you have regarding such technologies.

Relationship to Privacy Policy
This Policy should be read together with the Website Privacy Policy and Terms and Conditions. While the Privacy Policy covers general data-handling practices, this Policy specifically addresses technologies that store or access information on your device.

Scope
This Policy applies solely to the public website located at resonantlotus.com and its sub-pages. It does not govern the Practice’s secure Telehealth, Portal, or EHR systems, which are governed by HIPAA and the Practice’s Notice of Privacy Practices (NPP).

What Are Cookies?

Definition
Cookies are small text files placed on your computer or mobile device when you visit a website. They allow the website to recognize your device, store certain information, and improve performance and functionality.

Types of Related Technologies
For simplicity, this Policy uses “cookies” to include similar technologies such as web beacons, pixels, tags, SDKs, and local storage objects. These tools may perform similar functions, including analytics, authentication, and session management.

Categories of Cookies Used on the Site

The Practice uses or may use the following categories of cookies:

Strictly Necessary Cookies

These cookies are essential for the operation of the Site and enable basic functions such as page navigation, secure logins (if applicable), and form submissions. The Site cannot function properly without these cookies.

Examples: session cookies that remember your progress when completing forms, or cookies maintaining server load balance.
Legal basis: the Practice’s legitimate interest in providing a secure and functioning website.
Duration: typically deleted when you close your browser.

Functional (Preference) Cookies

These cookies remember user choices (for example, preferred language or accessibility settings) to provide a customized browsing experience.

These cookies are optional; disabling them may limit personalization features.
Stored for up to 12 months unless cleared sooner.

Performance and Analytics Cookies

These cookies collect information about how visitors use the Site — for example, which pages are most frequently visited and where users encounter errors. The data are aggregated and anonymous.

The Practice may use privacy-enhanced analytics (for example, Google Analytics 4 configured with IP anonymization and data retention limits).
Legal basis: legitimate interest in understanding and improving Site performance.
Duration: 14–26 months (subject to vendor retention settings).

Security Cookies

Used to authenticate users, prevent fraudulent use of logins, and protect against cross-site request forgery or other attacks.

Duration: varies; may persist up to one year.

No Advertising or Social-Media Cookies

The Practice does not use cookies for targeted advertising, retargeting, or behavioral profiling. The Site also does notuse embedded social-media tracking pixels or plug-ins.

Cookies We Do Not Use

No Marketing or Behavioral Cookies
The Practice does not employ cookies to track individuals across websites or deliver targeted advertising.

No PHI Tracking
Cookies are never used to store or transmit Protected Health Information (PHI). Clinical communications and Telehealth sessions occur only within HIPAA-compliant systems that do not share cookie data with public analytics services.

No Third-Party Data Brokerage
The Practice does not sell, rent, or share cookie data with advertisers or data brokers.

Third-Party Service Providers and Analytics

Hosting and Security Vendors
Our hosting provider may use server-level cookies or logs to maintain performance, load balancing, and intrusion detection.

Analytics Vendors
If analytics tools (such as Google Analytics or equivalent privacy-enhanced alternatives) are deployed, the following apply:

IP addresses are truncated and anonymized.
“Ad personalization” and “data sharing for advertising” features are disabled.
Analytics cookies track only aggregated, non-identifiable data.
The Practice has disabled user-ID tracking and demographic reporting.

Consent to Analytics
Where required by law or best practice, the Site will display a cookie banner allowing users to consent or opt out of non-essential analytics cookies. Strictly necessary cookies will operate regardless of consent because they are required for Site functionality.

External Links
External links or embedded content (e.g., maps or scheduling tools) may use their own cookies, governed by their respective privacy policies. The Practice has no control over third-party cookies used on external sites.

Cookie Duration and Storage

Session Cookies
These expire automatically when you close your browser.

Persistent Cookies
These remain on your device until manually deleted or until their programmed expiration date, usually not exceeding 26 months.

Local Storage and Cache
Some browsers store data locally to improve load times. You may clear your browser cache at any time to remove locally stored content associated with the Site.

Managing Cookies and Consent

Browser Settings
Most browsers allow you to block or delete cookies through privacy settings. Doing so will not affect access to core content but may impact site responsiveness or personalization.

Consent Withdrawal
If you have previously consented to non-essential cookies (e.g., analytics) and wish to withdraw consent, you can delete existing cookies and adjust browser settings to reject future ones.

Opt-Out Mechanisms
You can use browser-based “Do Not Track” (DNT) settings, though the Site currently does not interpret DNT signals due to lack of a global technical standard.

Device and Platform Controls
Mobile devices may offer app- or browser-level privacy controls. If you access the Site from a mobile browser, adjust preferences directly within device settings.

Data Sharing and International Transfers

Data Sharing
Cookie data are shared only with vendors providing hosting, analytics, or website security services under strict contractual confidentiality obligations.

International Transfers
If analytics or hosting providers transfer cookie data outside the United States, such transfers occur under recognized safeguards (e.g., Standard Contractual Clauses) ensuring equivalent protection.

Vendor Accountability
The Practice monitors vendor privacy practices and ensures that no cookie data collected through the Site are combined with PHI or other sensitive records.

Security and Confidentiality

Integrity Measures
Cookies used on this Site are digitally signed or otherwise structured to prevent tampering.

Encryption
The Site operates under HTTPS with Transport Layer Security (TLS) encryption to protect cookies during transmission.

Limited Access
Only authorized personnel and contracted IT vendors have administrative access to cookie or analytics configurations.

Breach Notification
If cookie-related data were ever compromised and met the legal definition of a reportable event under the New York SHIELD Act or other applicable law, the Practice would notify affected individuals in accordance with statutory requirements.

Children’s Data and Cookies

No Child-Directed Cookies
The Site is not directed toward children under 13 years of age. Cookies are not designed to identify or track children.

Parental Requests
If a parent or guardian believes cookies have collected information from a child, contact the Privacy Officer. The Practice will delete such information promptly in compliance with the Children’s Online Privacy Protection Act (COPPA).

Changes to This Cookie Policy

Version Control
This Policy may be updated periodically to reflect legal, technical, or operational changes.

Notice of Changes
Material revisions will be indicated by updating the “Effective Date” above.

Archive and Recordkeeping
Previous versions of this Policy may be retained for compliance documentation.

Governing Law

This Cookie Policy, and any dispute arising from it, is governed by the laws of the State of Texas, without regard to conflict-of-laws principles. Any action relating to this Policy shall be brought exclusively in the state or federal courts located in Burnet county, Texas.

Contact Information

For questions, concerns, or requests regarding cookies or this Policy, please contact:

Amber Lundell, LPC

Resonant Lotus Counseling LLC

amber@resonantlotus.com

Acknowledgment

By continuing to use the Site after the “Effective Date” of this Policy, you acknowledge that you have read and understood this Cookie Policy, and consent (where applicable) to the use of cookies in accordance with the choices and controls described herein.

Privacy Policy

Cookie Policy

This website uses cookies.