Website Privacy Policy

Effective Date: June 24, 2026, Updated August 17, 2026

Notice Regarding Scope

This Policy governs the Website only. It is not the Notice of Privacy Practices required under the Health Insurance Portability and Accountability Act of 1996 ("HIPAA").

Trellis Therapy of Loudoun, PLLC maintains two separate privacy documents, each governing a distinct category of information:

(a) This Website Privacy Policy governs information collected through trellisloudoun.com (the "Website"), including technical data generated when a visitor loads a page and information a visitor voluntarily submits through the Website's contact form. It applies to all visitors, whether or not a professional relationship exists or subsequently arises.

(b) The Notice of Privacy Practices, titled Your Privacy and Your Rights, governs protected health information ("PHI") as that term is defined at 45 C.F.R. § 160.103, and is issued pursuant to 45 C.F.R. § 164.520. It confers rights that this Policy does not, including the rights of access, amendment, accounting of disclosures, and restriction. It is available at [link] and upon request.

In the event of any conflict or inconsistency between this Policy and the Notice of Privacy Practices with respect to protected health information, the Notice of Privacy Practices controls. Nothing in this Policy limits, modifies, waives, or may be construed to limit, modify, or waive any right conferred by HIPAA or by applicable state law.

Important Notice to Visitors

Do not transmit protected health information through this Website.

The Website's contact form and ordinary electronic mail are not secure channels and are not covered by a business associate agreement within the meaning of 45 C.F.R. § 164.502(e). Visitors should limit initial communications to their name, preferred method of contact, and a general statement of interest in services. Clinical history, symptoms, diagnoses, medications, and similar information will be collected through secure channels following the establishment of a professional relationship.

1. The Practice

Trellis Therapy of Loudoun, PLLC (d/b/a Trellis Therapy of Loudoun) (the "Practice," "we," "us," or "our") is a professional limited liability company organized under the laws of the Commonwealth of Virginia, operating a solo outpatient psychotherapy practice.

20915 Ashburn Road, Suite 215, Ashburn, VA 20147-5678

(571) 746-5366 · michelle@trellisloudoun.com

Michelle Brueser, LCSW, is the individual responsible for information collected through the Website and is the designated contact for inquiries arising under this Policy.

2. Scope and Application

This Policy applies to information collected through the Website. It does not apply to:

•   protected health information, which is governed by the Notice of Privacy Practices;

•   information collected through the Practice's electronic health record system, telehealth platform, or payment processor, each of which operates under a business associate agreement and is described in the Notice of Privacy Practices;

•   information collected by third parties whose websites are accessible through links appearing on the Website; or

•   information collected offline, including by telephone or in person.

By accessing or using the Website, a visitor acknowledges the practices described in this Policy. Visitors who do not agree with these practices should discontinue use of the Website.

3. Information Collected Automatically

The Website is hosted on the Squarespace platform. As is standard for hosted websites, the following categories of technical information are recorded automatically when a page is requested:

(a) Internet Protocol (IP) address, which indicates approximate geographic region and does not identify a street address;

(b) browser type and version, operating system, and device category;

(c) pages requested, sequence of requests, and duration of each session;

(d) referring URL or search query, where transmitted by the visitor's browser; and

(e) date and time of each request.

This information is processed by Squarespace to generate aggregate traffic and engagement reports. The Practice does not use this information to identify individual visitors and does not attempt to do so. It is not combined with any clinical record and is not used in connection with any determination regarding a person's care.

4. Cookies and Similar Technologies

A cookie is a small data file placed in a visitor's browser by a website. The Website sets cookies in two categories:

(a) Strictly necessary cookies. These are required for the Website to function and to maintain security, including protection of form submissions against cross-site request forgery. The Website cannot operate without them.

(b) Analytics cookies. These enable the Squarespace platform to distinguish new visitors from returning visitors so that the aggregate reporting described in Section 3 is accurate.

The Practice has not deployed, and does not deploy, any of the following on the Website: Google Analytics or comparable third-party analytics services; the Meta (Facebook) Pixel or any other advertising or conversion pixel; retargeting or behavioral advertising tags; session-recording, heat-mapping, or replay technologies; or third-party chat, scheduling, or lead-capture widgets. No technology deployed on the Website is designed to track a visitor's activity across other websites or over time.

Visitors may block, restrict, or delete cookies through their browser settings. Blocking strictly necessary cookies may impair or prevent operation of portions of the Website.

5. Information Voluntarily Provided

(a) Contact form. The Website's contact form is operated by Google. Information a visitor submits through the form is transmitted to and stored by Google before it is received by the Practice. The form requests the visitor's name and preferred method of contact. Visitors are directed not to submit clinical information through the form. See Important Notice to Visitors, above.

(b) Electronic mail, telephone, and voicemail. Where a visitor initiates contact by email, telephone, or voicemail, the Practice receives and retains the content of that communication. Ordinary electronic mail is transmitted without encryption and may be intercepted in transit or accessed by any person with access to either the sending or receiving mailbox. Visitors should consider these limitations before transmitting sensitive information.

(c) Change in character of information. Where a professional relationship is subsequently established, an initial inquiry becomes part of the clinical record and is thereafter protected as PHI under HIPAA and governed by the Notice of Privacy Practices rather than by this Policy.

6. Purposes of Processing

Information described in Sections 3 through 5 is processed solely for the following purposes:

(a) responding to inquiries and communications;

(b) scheduling and confirming consultations and appointments;

(c) evaluating Website performance and content utility in aggregate;

(d) maintaining the security, integrity, and proper functioning of the Website; and

(e) complying with applicable legal, regulatory, and professional obligations.

The Practice does not process Website information for any purpose beyond those enumerated in this Section.

7. Practices Not Engaged In

The Practice affirmatively represents that it does not:

(a) sell, rent, lease, license, or trade information collected through the Website, whether for monetary or other valuable consideration;

(b) share information collected through the Website with advertising networks, data brokers, or for purposes of targeted advertising;

(c) engage in profiling in furtherance of decisions producing legal or similarly significant effects;

(d) use Website information in connection with any clinical, diagnostic, or treatment determination.

8. Disclosure to Service Providers and Other Recipients

The Practice discloses Website information only to the service providers identified below, and only to the extent necessary for those providers to perform their functions:

• Squarespace, Inc.

  • Website hosting; platform analytics described in Section 3

  • Google LLC

    • Operation of the contact form; receipt and storage of submissions; transmission and storage of communications

Each such provider is bound by its own terms of service and privacy commitments. These are general commercial service providers and are not business associates within the meaning of HIPAA. Squarespace does not execute business associate agreements. This limitation is the operative reason for the restriction stated in Important Notice to Visitors, above.

9. Retention

Website analytics data is retained by Squarespace in accordance with that platform's retention practices and is maintained by the Practice only in aggregate, non-identifying form.

Contact form submissions and related correspondence are retained only for so long as reasonably necessary to respond to the inquiry and to document the disposition of a request for services. Where no professional relationship is established, a visitor may request deletion pursuant to Section 10.

Where a professional relationship is established, the resulting record is retained in accordance with the record retention requirements of the applicable state or states, as described in the Notice of Privacy Practices and the client intake documentation. Those requirements are mandatory and are not subject to deletion at request.

10. Visitor Choices and Request

A visitor may:

(a) browse the Website without submitting any information, in which case no identifying information is collected;

(b) block, restrict, or delete cookies through browser settings, subject to Section 4;

(c) request deletion of a Website inquiry, by written request to michelle@trellisloudoun.com, provided that no professional relationship has been established, in which case Section 9 governs; or

(d) request a description of Website information the Practice holds concerning the visitor, by written request to the address or email above.

The Practice will respond to a request made under subsection (c) or (d) within a reasonable period and in any event within forty-five (45) days of receipt.

11. State Consumer Privacy Laws

Certain states, including Virginia, have enacted comprehensive consumer data protection statutes conferring rights of access, correction, deletion, portability, and opt-out. Such statutes generally apply only to entities meeting specified volume or revenue thresholds. The Virginia Consumer Data Protection Act, Va. Code § 59.1-575 et seq., applies to persons controlling or processing the personal data of at least 100,000 Virginia consumers, or of at least 25,000 Virginia consumers where more than fifty percent of gross revenue is derived from the sale of personal data. The Practice does not meet these thresholds and is not, at present, subject to that statute or to the analogous statutes of other states.

Notwithstanding the foregoing, the Practice will consider and, where reasonably practicable, honor any request that would be available to a consumer under such a statute, without regard to whether the statute applies to the Practice by its own terms. Requests should be directed as provided in Section 13.

12. Additional Provisions

(a) Children. The Website is directed to adults. The Practice does not knowingly collect information online from any individual under the age of thirteen (13), and minors should not use the contact form. The Practice provides clinical services to clients aged twelve (12) and older; such services are initiated through the Practice's intake process under the consent requirements of applicable state law, and not through the Website.

(b) Third-party links. The Website contains links to external resources, including crisis services and professional organizations. Such resources are operated by independent third parties under their own privacy policies. The Practice does not control and is not responsible for the content or privacy practices of any linked site.

(c) Security. The Website employs transport-layer encryption, and the Practice maintains reasonable administrative and technical safeguards over the accounts through which Website information is accessed. No method of transmission over the internet or of electronic storage is completely secure, and the Practice does not warrant the security of information transmitted through the Website. This limitation is the basis for the restriction stated in Important Notice to Visitors, above.

(d) Do Not Track and opt-out preference signals. No uniform standard governs the interpretation of "Do Not Track" browser signals or global opt-out preference signals. Because the Practice neither sells personal information nor engages in targeted advertising, such signals have no operative effect on the Website.

(e) Governing law. This Policy is governed by and construed in accordance with the laws of the Commonwealth of Virginia, without regard to its conflict of laws principles. This provision does not limit any right arising under federal law or under the law of a state in which a client is located at the time services are rendered.

(f) No professional relationship. Neither this Policy, nor a visitor's use of the Website, nor the submission of a contact form creates a therapist-client relationship. Such a relationship is established only as described in the Practice's Terms of Service and Informed Consent for Therapy Services.

13. Amendments

The Practice may amend this Policy from time to time, including upon any material change to the technologies deployed on the Website. Amendments take effect upon posting. The effective date and last-updated date appearing at the head of this Policy will be revised accordingly, and notice of any material amendment will be displayed prominently on this page for not less than thirty (30) days following posting.

14. Contacts and Complaints

Inquiries, requests, and complaints concerning this Policy should be directed to:

Trellis Therapy of Loudoun, PLLC

Attn: Michelle Brueser, LCSW

20915 Ashburn Road, Suite 215

Ashburn, VA 20147-5678

(571) 746-5366 · michelle@trellisloudoun.com

Complaints concerning protected health information are governed by the Notice of Privacy Practices, which sets forth the procedure for submitting a complaint to the Practice and for filing a complaint with the Secretary of the U.S. Department of Health and Human Services, Office for Civil Rights. No individual will be retaliated against for filing a complaint.

This Website Privacy Policy should be read together with the Practice's Terms of Service, Legal Disclaimer, and Notice of Privacy Practices.