Privacy Policy

Graceland Psychiatric and Neuromodulation Center, PLLC, doing business as Graceland Psychiatry and Graceland Psychiatry and TMS Center ("Graceland Psychiatry," "we," "us," or "our"), respects your privacy. This Website Privacy Policy ("Policy") explains how we collect, use, disclose, and safeguard information when you visit our website at www.gracelandpsychiatry.com or any subdomain or web property that links to this Policy (collectively, the "Site").

This Policy applies to website visitors, prospective patients, current and former patients, caregivers, job applicants, business contacts, and the general public who interact with the Site. It does not apply to information collected offline, by telephone, in our clinics, through paper forms, or through services that are governed by a separate privacy notice.

We operate facilities in San Antonio and New Braunfels, Texas, and Columbia, Missouri, provide services to residents of Texas and Missouri, and comply with applicable federal law and the privacy laws of those states. By using the Site, you acknowledge that you have read and understood this Policy.

Graceland Psychiatry is a "covered entity" under the Health Insurance Portability and Accountability Act of 1996, as amended by the HITECH Act and implementing regulations (collectively, "HIPAA"). When you receive health care services from us, the information we create or receive about you in the course of treatment, payment, or health care operations is "Protected Health Information" (PHI) governed by HIPAA and our HIPAA Notice of Privacy Practices.

This Site is intended primarily for general information, education, and convenience features such as appointment requests, contact forms, and links to our patient portal and telehealth platform. We make commercially reasonable efforts not to use cookies, pixels, or third-party tracking technologies on web pages where PHI is reasonably likely to be present (such as authenticated patient portal pages, telehealth waiting rooms, or pages tied to a specific provider, condition, or appointment confirmation), consistent with current guidance from the U.S. Department of Health and Human Services Office for Civil Rights ("HHS OCR").

If you submit information through the Site that constitutes PHI (for example, by describing a health condition or treatment in a contact form), we will treat that information in accordance with HIPAA, Part 2 where it applies, and our HIPAA Notice of Privacy Practices once it is received by clinical or scheduling staff.

Where information collected through the Site is later combined with PHI in the course of treatment, payment, or health care operations (for example, when a contact-form submission is matched to a clinical record), we treat the combined record as PHI subject to HIPAA, Part 2 where it applies, and our HIPAA Notice of Privacy Practices.

3.1 Information You Provide Directly

We collect information that you voluntarily provide when you interact with the Site, including:

• Contact and appointment request information — such as your name, email address, telephone number, mailing address, date of birth, age, the location or service you are interested in (for example, psychiatric evaluation, medication management, child and adolescent psychiatry, psychotherapy, ADHD and neuropsychological testing, EEG-based testing, TMS therapy, Spravato, Dual Diagnosis IOP/PHP for substance use and mental health, or telehealth), insurance information that you choose to provide, and any free-text comments or descriptions of your reason for contacting us.
• Patient portal and telehealth information — if you click through to our patient portal or telehealth scheduling/visit platform, that platform may collect login credentials, identity verification information, scheduling information, payment information, and clinical information. Those platforms operate under their own terms and privacy notices and, where applicable, under a Business Associate Agreement with us.
• Communications — emails, voicemails, text messages, chat or messaging submissions, and any other communications you send to us through or in connection with the Site.
• Job applications and inquiries — if you apply for a position or send a referral or partnership inquiry, we collect the information contained in your application or message.

3.2 Information Collected Automatically

When you visit the Site, certain information is collected automatically by us and by third-party service providers using cookies, pixels, software development kits, server logs, session-analytics scripts, and similar technologies ("Tracking Technologies"). This information may include:

• Internet Protocol (IP) address and approximate location derived from it (such as city, state, country).
• Device and browser information, including device type, operating system, browser type and version, screen resolution, and language settings.
• Usage information, including the pages you view, the links you click, the date and time of your visit, the referring URL, search terms used to reach the Site, and the duration of your visit.
• Interaction information, such as mouse movements, clicks, scrolling, and page-layout events, collected by session-analytics tools to help us understand how visitors use the Site. We configure these tools to mask the content you type into form fields.
• Unique device or browser identifiers and advertising identifiers, where available.
• Approximate or precise geolocation derived from your IP address, your device, or — only with your permission — device location services. We do not use precise geolocation to identify you and we treat precise geolocation as sensitive personal data under applicable law.

3.3 Information from Third Parties

• Advertising and analytics partners (such as Google and Meta) may share aggregated or de-identified reporting information with us about how visitors found and interacted with our ads.
• Service providers that help us operate the Site (such as our website host, form provider, scheduling vendor, telehealth platform, and email/marketing platform) may provide information related to the services they perform.
• Healthcare partners and referral sources (such as referring physicians, health plans, employee assistance programs, and accountable care organizations), where applicable and permitted by law.
• Identity-verification and fraud-prevention services.
• Recruiting and human-resources vendors (for job applicants), and credentialing or licensure-verification services (for clinicians).

3.4 Information We Do Not Knowingly Collect

We do not knowingly collect Social Security numbers, full payment card numbers, full bank account numbers, driver's license images, or government-issued identification numbers through public Site forms. Please do not submit such information through public Site forms, email, or text. Use our patient portal or in-clinic processes for sensitive information.

We use information for the following business and operational purposes:

• To respond to inquiries, schedule appointments, and provide requested information about our services, locations, providers, and insurance participation.
• To operate, maintain, secure, and improve the Site, our patient portal links, and our telehealth scheduling experience.
• To carry out treatment, payment, and health care operations as permitted by HIPAA and, where applicable, Part 2, once a clinical relationship is established and to the extent the information is PHI.
• To send appointment-related, administrative, service, and (with appropriate consent) marketing communications by email, text, or telephone, in accordance with applicable law including the Telephone Consumer Protection Act (TCPA) and the CAN-SPAM Act.
• To measure and improve the performance of the Site and of our advertising, including conversion measurement, in a manner consistent with HHS OCR guidance regarding tracking technologies and PHI and the restrictions described in Section 5.
• To prevent, detect, and investigate fraud, abuse, security incidents, and other harmful or unlawful activity, and to protect the rights, property, and safety of our patients, staff, and the public.
• To comply with legal, regulatory, accreditation, licensing, and audit obligations, including those under HIPAA, 42 C.F.R. Part 2, the Texas Medical Records Privacy Act (Texas Health & Safety Code Chapter 181), the Texas Identity Theft Enforcement and Protection Act (Texas Bus. & Com. Code Chapter 521), Missouri Revised Statutes Chapter 407 (including the data breach notification provisions at § 407.1500), and other applicable law.
• For any other purpose disclosed at the time of collection or with your consent.

We and our third-party partners use Tracking Technologies on the public, unauthenticated portions of the Site. The categories below describe the technologies we currently use:

• Strictly necessary cookies — required for the Site to function (for example, to remember your cookie choices or to load pages securely).
• Performance and analytics technologies — help us understand how visitors use the Site so we can improve it. We use Google Analytics, managed through Google Tag Manager, and Contentsquare, a session-analytics service that records page interactions such as clicks, scrolling, and navigation. We configure Contentsquare to mask text entered into form fields.
• Functionality cookies — remember preferences such as location or language.
• Advertising and conversion-measurement technologies — used to measure and optimize the performance of our ads. We use Google Ads conversion tags and the Meta (Facebook/Instagram) Pixel and Conversions API. We may add or change providers from time to time and will update this Policy when we do.

We restrict the use of advertising and analytics Tracking Technologies on web pages where PHI is reasonably likely not to be present. We do not knowingly transmit PHI to advertising networks. We do not use Tracking Technologies to build remarketing or interest-based advertising audiences based on visits to pages about substance use disorder treatment or specific mental health conditions, and we do not place advertising pixels on our appointment-request or intake forms. We use commercially reasonable efforts to enable features such as IP truncation and anonymization, and to disable or limit data-sharing settings within these tools, where the option is available.

5.1 Your Choices

• Cookie banner. Where presented, you can use our cookie preference tool to accept or decline non-essential cookies.
• Browser controls. Most browsers allow you to refuse or delete cookies, block third-party cookies, or alert you when cookies are being set. Disabling cookies may affect the functionality of the Site.
• Industry opt-outs. You can learn about and opt out of many interest-based advertising practices through the Digital Advertising Alliance (optout.aboutads.info) and the Network Advertising Initiative (optout.networkadvertising.org).
• Google. You can opt out of Google Analytics by installing Google's opt-out browser add-on (tools.google.com/dlpage/gaoptout) and manage Google ad personalization at adssettings.google.com.
• Meta. You can adjust ad preferences in your Facebook or Instagram settings.
• Contentsquare. You can opt out of Contentsquare session analytics by declining non-essential cookies through our cookie banner (where presented), using your browser controls, or using the opt-out options described in Contentsquare's privacy policy.
• Mobile devices. You can reset or limit ad tracking using your device settings ("Limit Ad Tracking" on iOS or "Opt out of Ads Personalization" on Android).

5.2 Do Not Track and Global Privacy Control

Some browsers transmit "Do Not Track" (DNT) signals or Global Privacy Control (GPC) signals. There is no industry-wide standard for how websites must respond to DNT signals. We currently do not respond to DNT signals. Where required by applicable law, we honor recognized opt-out preference signals such as GPC for the categories of processing covered by that law.

We do not sell information collected through the Site for monetary consideration. We share information only as described below:

• Service providers and business associates. Vendors that perform services for us such as website hosting, form processing, scheduling, telehealth, secure messaging, email and SMS delivery, analytics, advertising measurement, payment processing, laboratory services, and IT support. Where these vendors handle PHI on our behalf, they are bound by HIPAA-compliant Business Associate Agreements and, where Part 2 records are involved, by the requirements of Part 2.
• Advertising and analytics partners. As described in Section 5, we use Tracking Technologies that may share information about your interactions on the public Site with our advertising and analytics partners for measurement and optimization purposes, subject to our restrictions regarding PHI and substance use disorder information.
• Affiliated entities. Our owned or affiliated practice locations and operating entities, for purposes consistent with this Policy.
• Legal, regulatory, and safety. Government, regulatory, accreditation, or law enforcement authorities; courts; and other parties when required or permitted by law, subpoena, court order, or other legal process; to enforce our terms; to protect our rights, property, or safety, or that of our patients, staff, or the public; or to respond to emergencies. Disclosures of Part 2 records are made only as Part 2 permits.
• Business transfers. In connection with a merger, acquisition, financing, reorganization, sale of assets, or similar transaction, subject to applicable confidentiality, HIPAA, and Part 2 requirements.
• With your consent. Any other sharing for which you have given us consent or direction.

We may share aggregated, anonymized, or de-identified information that cannot reasonably be used to identify any individual with third parties for any lawful purpose, including analytics, benchmarking, research, marketing measurement, and quality improvement. Information that has been de-identified in accordance with the HIPAA de-identification standards at 45 C.F.R. § 164.514(b) is no longer PHI for purposes of this Policy.

Links from the Site may take you to our patient portal, electronic health record (EHR), or telehealth platforms operated by third-party vendors that act as our business associates under HIPAA. Information you submit through those platforms is governed by HIPAA, Part 2 where it applies, our HIPAA Notice of Privacy Practices, and the vendor's privacy and security practices. Please review those notices when you log in. Telehealth services are subject to applicable state telemedicine and licensure requirements in the state where you are physically located at the time of the visit.

Access to patient portal and telehealth services by minors, and access to their records by parents or legal guardians, is governed by applicable federal and state law, including laws governing minor consent and confidentiality. Where Texas or Missouri law or Part 2 permits a minor to consent to their own care (for example, certain substance use disorder treatment), we follow those laws, which may limit a parent's or guardian's access to the minor's information without the minor's consent. Access to records of minor patients is otherwise governed by applicable Texas and Missouri law regarding consent for the treatment of minors and parental access to mental-health records.

Graceland Psychiatry provides child and adolescent psychiatric services and may treat minors in clinical settings under the supervision of their parent or legal guardian, or with the minor's own consent where Texas or Missouri law or Part 2 allows, consistent with applicable law regarding minor consent and parental access to records.

The Site itself, however, is intended for use by adults (18 years of age or older), typically a parent, guardian, or caregiver acting on behalf of a minor patient. We do not knowingly collect personal information directly from children under the age of 13 through the Site, and we do not direct the public-facing portions of the Site to children under 13, in accordance with the Children's Online Privacy Protection Act (COPPA). If we learn that we have inadvertently collected personal information from a child under 13 through the Site without verifiable parental consent, we will delete it. If you believe a child under 13 has provided us with personal information through the Site, please contact us using the information in Section 14.

9.1 Marketing and Communication Preferences

• You may opt out of marketing emails by following the unsubscribe instructions in any marketing email or by contacting us. We will continue to send transactional and treatment-related communications as permitted by law.
• You may decline non-essential cookies through our cookie banner or your browser settings.

9.2 Health Information Rights (HIPAA)

If you are a patient, you have rights under HIPAA with respect to your PHI, including the right to access, request amendment of, and receive an accounting of certain disclosures of your PHI, and to receive a paper copy of our HIPAA Notice of Privacy Practices upon request. Patients whose records are protected by Part 2 also have the rights described in Part 2, including rights regarding consent to disclosure. These rights and the procedures for exercising them are described in our HIPAA Notice of Privacy Practices.

9.3 Texas Residents

If you are a Texas resident, the following apply:

• Texas Medical Records Privacy Act (Texas HB 300; Tex. Health & Safety Code Ch. 181). We comply with this law, which extends HIPAA-like protections to PHI handled in Texas, requires employee training, and limits electronic disclosures and the sale of PHI without authorization.
• Texas Identity Theft Enforcement and Protection Act (Tex. Bus. & Com. Code Ch. 521). We maintain reasonable procedures to protect sensitive personal information and provide notification of any breach of system security as required by Texas law.
• Electronic Disclosure of Protected Health Information. As permitted by Texas law, we may electronically disclose Protected Health Information for treatment, payment, health care operations, and other purposes authorized or required by law. We obtain separate authorization when required by Texas Health & Safety Code § 181.154.
• Sensitive personal data. The TDPSA treats certain categories of personal data as "sensitive," including data revealing racial or ethnic origin, religious beliefs, mental or physical health diagnosis, sexual orientation, citizenship or immigration status, genetic or biometric data processed for the purpose of uniquely identifying an individual, precise geolocation data, and personal data of a known child. Because we are a psychiatric practice, information you provide about a mental or physical health condition will frequently qualify as sensitive personal data. We process sensitive personal data only as necessary to provide our services, to comply with law, and as permitted by HIPAA, and where the TDPSA requires consent for the processing of sensitive personal data of an adult, we will obtain that consent. PHI processed in connection with treatment, payment, and health care operations is governed by HIPAA, and the TDPSA does not apply to that information.
• How to submit a rights request. To exercise the rights described above, contact us using the information in Section 14. We will need to verify your identity using information that reasonably matches what we have on file, which may include your name, contact information, and details about your interactions with us. For requests involving PHI, we follow our HIPAA-based identity-verification procedures.
• Authorized agents. You may designate an authorized agent to submit a request on your behalf by providing the agent with a written, signed authorization. We may require the agent to verify their authority and may require you to verify your own identity directly with us before we act on the request.
• Right to appeal. If we deny your request in whole or in part, you have the right to appeal that decision by contacting us within a reasonable time after our response. We will respond to the appeal within the time required by applicable law (sixty (60) days under the TDPSA). If your appeal is denied, you may submit a complaint to the Office of the Texas Attorney General.

9.4 Missouri Residents

If you are a Missouri resident, the following apply:

• Missouri data breach notification (Mo. Rev. Stat. § 407.1500). We maintain reasonable security measures and will notify affected Missouri residents of a breach of security involving their personal information as required by Missouri law.
• Missouri mental health and substance use confidentiality. Certain mental health records are afforded heightened protection under Missouri law (including Mo. Rev. Stat. Ch. 630 and applicable provisions governing licensed mental health facilities and providers). We follow these requirements in addition to HIPAA and 42 C.F.R. Part 2.
• Telehealth. Telehealth services to Missouri residents are subject to Missouri telehealth statutes and the rules of the Missouri Board of Registration for the Healing Arts and other applicable boards.

9.5 Other State Rights

Even if you do not reside in Texas or Missouri, we strive to apply the protections described in this Policy to all visitors. Where other state laws (such as those of California, Colorado, Connecticut, Utah, Virginia, Oregon, Montana, or others) grant you specific rights, you may submit a request as described in Section 14 and we will respond as required by applicable law. Note that information regulated by HIPAA is generally exempt from these state consumer privacy laws.

We maintain administrative, technical, and physical safeguards designed to protect information collected through the Site, consistent with the HIPAA Security Rule (45 C.F.R. Part 164, Subpart C) and 42 C.F.R. Part 2 where they apply, and consistent with applicable Texas and Missouri requirements for personal information. Safeguards include access controls, encryption in transit (TLS) for the Site, encryption of PHI at rest where applicable, employee training, and ongoing risk analysis.

No method of transmission over the Internet and no method of electronic storage is 100% secure. We cannot guarantee absolute security. Please do not include sensitive personal or health information in unsecured email or in free-text contact forms. For sensitive matters, contact us by phone or use our patient portal. In the event of a reportable data breach, we will provide notification to affected individuals and regulatory authorities as required by applicable federal and state law.

We retain information collected through the Site for as long as reasonably necessary to fulfill the purposes described in this Policy, to provide our services, to comply with our legal, accounting, tax, and reporting obligations (including medical record retention requirements under Texas and Missouri law), to resolve disputes, and to enforce our agreements. Retention periods vary based on the type of information and the applicable legal or operational requirement. PHI is retained in accordance with our medical record retention schedule and applicable law.

The Site may contain links to third-party websites, applications, social media profiles, and services that we do not own or control (including, for example, our patient portal vendor, telehealth vendor, our Instagram, Facebook, and YouTube pages, and informational resources). The Site may also include embedded content, such as YouTube videos on our blog and podcast pages, which may set cookies or collect information about your interaction with that content under the provider's own privacy policy. This Policy does not apply to those third parties. We encourage you to review the privacy policies of any third-party site or service before providing information to it. Please do not share personal health information in public comments or posts on our social media pages.

The Site is operated from the United States and is intended for users located in the United States, and our clinical services are offered only to individuals physically located in states where we are licensed to provide care. By using the Site from outside the United States, you understand that your information will be transferred to, stored, and processed in the United States in accordance with U.S. law, which may differ from the laws of your country.

If you have questions about this Policy, want to exercise your privacy rights, or want to submit a complaint, please contact us:

Our clinic locations:

• 11212 State Hwy 151, Plaza 2, Suite 120, San Antonio, TX 78251
• 2411 NE Interstate 410 Loop, Suite 114, San Antonio, TX 78217
• 790 Generations Drive, Suite 210, New Braunfels, TX 78130
• 33 E. Broadway, Ste 155, Columbia, MO 65203

Email is not a secure form of communication and is not encrypted by default. Please do not include Social Security numbers, full account numbers, complete medical histories, or other sensitive personal or health information in any email to us. For sensitive matters, please contact us by telephone or use our patient portal, which is designed to handle PHI securely under HIPAA.

You may also file a complaint regarding our privacy practices with:

• HHS Office for Civil Rights — for HIPAA and Part 2 complaints, at https://www.hhs.gov/hipaa/filing-a-complaint or by mail. We will not retaliate against you for filing a complaint.
• Office of the Texas Attorney General — https://www.texasattorneygeneral.gov/
• Office of the Missouri Attorney General — https://ago.mo.gov/

We may update this Policy from time to time to reflect changes in our practices, technology, legal requirements, and other factors. When we make material changes, we will update the "Last Updated" date at the top of this Policy and, where required by law, provide additional notice (such as a banner on the Site or, for patients, an updated HIPAA Notice of Privacy Practices). Your continued use of the Site after the updated Policy is posted constitutes your acknowledgment of the updated Policy with respect to information collected through the Site.

This Policy is governed by the laws of the State of Texas and applicable U.S. federal law, without regard to conflict-of-law principles, except where the law of another state (such as Missouri) is mandatorily applicable to information about residents of that state. Nothing in this Policy is intended to limit any non-waivable right you may have under applicable law.