Website Privacy Policy

Effective Date: June 24, 2026, Updated August 26, 2026

Notice Regarding Scope

This Policy governs the Website only. It is not the Notice of Privacy Practices required under the Health Insurance Portability and Accountability Act of 1996 ("HIPAA").

Trellis Therapy of Loudoun, PLLC maintains two separate privacy documents, each governing a distinct category of information:

(a) This Website Privacy Policy governs information collected through trellisloudoun.com (the "Website"), including technical data generated when a visitor loads a page and information a visitor voluntarily submits through the Website's contact form. It applies to all visitors, whether or not a professional relationship exists or subsequently arises.

(b) The Notice of Privacy Practices, titled Your Privacy and Your Rights, governs protected health information ("PHI") as that term is defined at 45 C.F.R. § 160.103, and is issued pursuant to 45 C.F.R. § 164.520. It confers rights that this Policy does not, including the rights of access, amendment, accounting of disclosures, and restriction. It is available at [link] and upon request.

In the event of any conflict or inconsistency between this Policy and the Notice of Privacy Practices with respect to protected health information, the Notice of Privacy Practices controls. Nothing in this Policy limits, modifies, waives, or may be construed to limit, modify, or waive any right conferred by HIPAA or by applicable state law.

Important Notice to Visitors

Do not transmit protected health information through this Website.

The Website's contact form and ordinary electronic mail are not secure channels and are not covered by a business associate agreement within the meaning of 45 C.F.R. § 164.502(e). Visitors should limit initial communications to their name, preferred method of contact, and a general statement of interest in services. Clinical history, symptoms, diagnoses, medications, and similar information will be collected through secure channels following the establishment of a professional relationship.

1. The Practice

Trellis Therapy of Loudoun, PLLC (d/b/a Trellis Therapy of Loudoun) (the "Practice," "we," "us," or "our") is a professional limited liability company organized under the laws of the Commonwealth of Virginia, operating a solo outpatient psychotherapy practice.

20915 Ashburn Road, Suite 215, Ashburn, VA 20147

(571) 746-5366 · michelle@trellisloudoun.com

Michelle Brueser, LCSW, LICSW, LCSW-C, LCAS, is the individual responsible for information collected through the Website and is the designated contact for inquiries arising under this Policy.

2. Scope and Application

This Policy applies to information collected through the Website. It does not apply to:

•   protected health information, which is governed by the Notice of Privacy Practices;

•   information collected through the Practice's electronic health record system, telehealth platform, or payment processor, each of which operates under a business associate agreement and is described in the Notice of Privacy Practices;

•   information collected by third parties whose websites are accessible through links appearing on the Website; or

•   information collected offline, including by telephone or in person.

By accessing or using the Website, a visitor acknowledges the practices described in this Policy. Visitors who do not agree with these practices should discontinue use of the Website.

3. Information Collected Automatically

The Website is hosted on the Squarespace platform. As is standard for hosted websites, the following categories of technical information are recorded automatically when a page is requested:

(a) Internet Protocol (IP) address, which indicates approximate geographic region and does not identify a street address;

(b) browser type and version, operating system, and device category;

(c) pages requested, sequence of requests, and duration of each session;

(d) referring URL or search query, where transmitted by the visitor's browser; and

(e) date and time of each request.

This information is processed by Squarespace to generate aggregate traffic and engagement reports. The Practice does not use this information to identify individual visitors and does not attempt to do so. It is not combined with any clinical record and is not used in connection with any determination regarding a person's care.

4. Cookies and Similar Technologies

A cookie is a small data file placed in a visitor's browser by a website. The Website sets cookies in two categories:

(a) Strictly necessary cookies. These are required for the Website to function and to maintain security, including protection of form submissions against cross-site request forgery. The Website cannot operate without them.

(b) Analytics cookies. These enable the Squarespace platform to distinguish new visitors from returning visitors so that the aggregate reporting described in Section 3 is accurate.

The Practice has not deployed, and does not deploy, any of the following on the Website: Google Analytics or comparable third-party analytics services; the Meta (Facebook) Pixel or any other advertising or conversion pixel; retargeting or behavioral advertising tags; session-recording, heat-mapping, or replay technologies; or third-party chat, scheduling, or lead-capture widgets. No technology deployed on the Website is designed to track a visitor's activity across other websites or over time.

Visitors may block, restrict, or delete cookies through their browser settings. Blocking strictly necessary cookies may impair or prevent operation of portions of the Website.

5. Information Voluntarily Provided

(a) Contact form. The Website's contact form is operated by Google. Information a visitor submits through the form is transmitted to and stored by Google before it is received by the Practice. The form requests the visitor's name and preferred method of contact. Visitors are directed not to submit clinical information through the form. See Important Notice to Visitors, above.

(b) Electronic mail, telephone, and voicemail. Where a visitor initiates contact by email, telephone, or voicemail, the Practice receives and retains the content of that communication. Ordinary electronic mail is transmitted without encryption and may be intercepted in transit or accessed by any person with access to either the sending or receiving mailbox. Visitors should consider these limitations before transmitting sensitive information. Telephone calls and voicemail are handled through Spruce Health, a communication platform for healthcare practices operating under a Business Associate Agreement. Ordinary electronic mail is not, and should not be used to send protected health information.

(c) Change in character of information. Where a professional relationship is subsequently established, an initial inquiry becomes part of the clinical record and is thereafter protected as PHI under HIPAA and governed by the Notice of Privacy Practices rather than by this Policy.

6. Text Messaging (SMS) and Mobile Information

The Practice sends text messages only to individuals who have given prior express written consent on the Practice's Text Message (SMS) Communication Consent form. Consent to receive text messages is optional and is never a condition of receiving services or care.

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Mobile telephone numbers, text messaging originator opt-in data, and consent are excluded from every category of information sharing described elsewhere in this Policy, and that information will not be shared, sold, rented, or disclosed to any third party, except as required to deliver the messaging service or to comply with law.

The Practice's SMS service provider is Spruce Health, which operates under a Business Associate Agreement. Messages may originate from (571) 556-4352 or (571) 746-5366. Messages are limited to appointment reminders, scheduling updates, appointment changes or cancellations, care-related notifications, and administrative matters. Message frequency may vary. Message and data rates may apply according to the recipient's mobile carrier and plan. Carriers are not liable for delayed or undelivered messages.

A recipient may withdraw consent at any time by replying STOP to any message from the Practice, or by texting STOP to (571) 556-4352 or (571) 746-5366; a confirmation message will follow. Assistance is available by replying HELP to any message, by texting HELP to either number, or by contacting the Practice directly. Consent may also be withdrawn by telling the clinician or contacting the Practice, verbally or in writing.

Text messaging is not a secure or confidential channel. A text message travels across the recipient's mobile carrier network, which the Practice does not control and which is not encrypted. Text messaging must not be used for clinical content, crisis situations, or emergencies. In a crisis, call 911, or call or text 988.

Submitting a mobile telephone number through the Website's contact form does not enroll the sender in text messaging. Enrollment requires the signed Text Message (SMS) Communication Consent.

Spruce Health's SMS Terms of Service and SMS Privacy Policy are available at sprucehealth.com/terms-and-privacy-policy.

7. Purposes of Processing

Information described in Sections 3 through 5 is processed solely for the following purposes:

(a) responding to inquiries and communications;

(b) scheduling and confirming consultations and appointments;

(c) evaluating Website performance and content utility in aggregate;

(d) maintaining the security, integrity, and proper functioning of the Website; and

(e) complying with applicable legal, regulatory, and professional obligations.

8. Practices Not Engaged In

The Practice affirmatively represents that it does not:

(a) sell, rent, lease, license, or trade information collected through the Website, whether for monetary or other valuable consideration;

(b) share information collected through the Website with advertising networks, data brokers, or for purposes of targeted advertising;

(c) engage in profiling in furtherance of decisions producing legal or similarly significant effects;

(d) use Website information in connection with any clinical, diagnostic, or treatment determination.

The Practice does not process Website information for any purpose beyond those enumerated in this Section. The Practice does not use information collected through the Website to train, fine-tune, evaluate, or ground any artificial intelligence or machine learning model, and does not submit such information to any generative artificial intelligence service. The Practice's limited use of artificial intelligence in clinical documentation is unrelated to the Website, requires the client's separate written consent, and is described in the AI-Assisted Notetaking, Recording & Transcription Consent provided at intake.

9. Disclosure to Service Providers and Other Recipients

Information collected through the Website is disclosed only to Squarespace, which hosts the Website, and to Google, which operates the contact form, and in each case only for the functions described in this Policy. Squarespace is a general commercial service provider and is not a business associate within the meaning of HIPAA. Google provides the Practice’s email, calendar, file storage and contact form under a signed HIPAA business associate agreement and is a business associate with respect to those services.

The Practice separately engages vendors that handle protected health information under Business Associate Agreements: TherapyNotes (electronic health record), Zoom (telehealth video, and recording or transcription where the client has separately consented), Spruce Health (telephone, voicemail, and text messaging), and Ivy Pay (payment processing). Those vendors receive no information collected through the Website. Their handling of protected health information is governed by the Notice of Privacy Practices, published at trellisloudoun.com/notice-of-privacy-practices, and not by this Policy.

Each such provider is bound by its own terms of service and privacy commitments. Squarespace does not execute business associate agreements. This limitation is the operative reason for the restriction stated in Important Notice to Visitors, above.

10. Retention

Website analytics data is retained by Squarespace in accordance with that platform's retention practices and is maintained by the Practice only in aggregate, non-identifying form.

Contact form submissions and related correspondence are retained only for so long as reasonably necessary to respond to the inquiry and to document the disposition of a request for services. Where no professional relationship is established, a visitor may request deletion pursuant to Section 10.

Where a professional relationship is established, the initial inquiry becomes part of the clinical record and is retained on the Practice's clinical retention schedule: a minimum of ten (10) years following termination of services and, for a client who was a minor at the time of service, until the later of the client's thirtieth (30th) birthday or ten (10) years following termination of services, or longer where the law of the client's state requires. Those requirements are mandatory and are not subject to deletion at request.

11. Visitor Choices and Request

A visitor may:

(a) browse the Website without submitting any information, in which case no identifying information is collected;

(b) block, restrict, or delete cookies through browser settings, subject to Section 4;

(c) request deletion of a Website inquiry, by written request to michelle@trellisloudoun.com, provided that no professional relationship has been established, in which case Section 9 governs; or

(d) request a description of Website information the Practice holds concerning the visitor, by written request to the address or email above.

The Practice will respond to a request made under subsection (c) or (d) within a reasonable period and in any event within forty-five (45) days of receipt. The forty-five (45) day period stated in this section applies only to a request concerning information collected through the Website. A request for access to, amendment of, restriction of, or an accounting of protected health information is governed by the Notice of Privacy Practices, which provides a thirty (30) day response period measured from the Practice's receipt of a written, dated, and signed request, and which is made using the Practice's Authorization to Release / Exchange Information rather than through the Website.

12. State Consumer Privacy Laws

Certain states, including Virginia, have enacted comprehensive consumer data protection statutes conferring rights of access, correction, deletion, portability, and opt-out. Such statutes generally apply only to entities meeting specified volume or revenue thresholds. The Virginia Consumer Data Protection Act, Va. Code § 59.1-575 et seq., applies to persons controlling or processing the personal data of at least 100,000 Virginia consumers, or of at least 25,000 Virginia consumers where more than fifty percent of gross revenue is derived from the sale of personal data. The Practice does not meet these thresholds and is not, at present, subject to that statute or to the analogous statutes of other states.

Notwithstanding the foregoing, the Practice will consider and, where reasonably practicable, honor any request that would be available to a consumer under such a statute, without regard to whether the statute applies to the Practice by its own terms. Requests should be directed as provided in Section 13.

13. Additional Provisions

(a) Children. The Website is directed to adults. The Practice does not knowingly collect information from a child under thirteen (13) through the Website. The Practice provides services to clients aged twelve (12) and older, but the contact form should not be used by a minor: a parent, guardian, or authorized representative should make contact on the minor's behalf. Where the law of the state in which a minor is located permits that minor to consent to services independently, the minor should telephone the Practice at (571) 746-5366 rather than use the contact form.

(b) Third-party links. The Website contains links to external resources, including crisis services and professional organizations. Such resources are operated by independent third parties under their own privacy policies. The Practice does not control and is not responsible for the content or privacy practices of any linked site.

(c) Security. The Website employs transport-layer encryption, and the Practice maintains reasonable administrative and technical safeguards over the accounts through which Website information is accessed. No method of transmission over the internet or of electronic storage is completely secure, and the Practice does not warrant the security of information transmitted through the Website. This limitation is the basis for the restriction stated in Important Notice to Visitors, above.

(d) Do Not Track and opt-out preference signals. No uniform standard governs the interpretation of "Do Not Track" browser signals or global opt-out preference signals. Because the Practice neither sells personal information nor engages in targeted advertising, such signals have no operative effect on the Website.

(e) Governing law. This Policy is governed by and construed in accordance with the laws of the Commonwealth of Virginia, without regard to its conflict of laws principles. This provision does not limit any right arising under federal law or under the law of a state in which a client is located at the time services are rendered.

(f) No professional relationship. Neither this Policy, nor a visitor's use of the Website, nor the submission of a contact form creates a therapist-client relationship. Such a relationship is established only as described in the Practice's Terms of Service and Informed Consent for Therapy Services.

14. Amendments

The Practice may amend this Policy from time to time, including upon any material change to the technologies deployed on the Website. Amendments take effect upon posting. The effective date and last-updated date appearing at the head of this Policy will be revised accordingly, and notice of any material amendment will be displayed prominently on this page for not less than thirty (30) days following posting.

15. Contacts and Complaints

Inquiries, requests, and complaints concerning this Policy should be directed to:

Trellis Therapy of Loudoun, PLLC

Attn: Michelle Brueser, LCSW

20915 Ashburn Road, Suite 215

Ashburn, VA 20147-5678

(571) 746-5366 · michelle@trellisloudoun.com

Complaints concerning protected health information are governed by the Notice of Privacy Practices, which sets forth the procedure for submitting a complaint to the Practice and for filing a complaint with the Secretary of the U.S. Department of Health and Human Services, Office for Civil Rights. No individual will be retaliated against for filing a complaint.

This Website Privacy Policy should be read together with the Practice's Terms of Service, Legal Disclaimer, and Notice of Privacy Practices.