This Notice explains how your protected health information (PHI) and mental health or developmental disability records may be used or disclosed, as well as how you can access your information. Please review this Notice carefully.
Our commitment to your privacy
Clara is dedicated to protecting your privacy as required by the Health Insurance Portability and Accountability Act (HIPAA), a federal law, and the Illinois Mental Health and Developmental Disabilities Confidentiality Act (MHDDCA, 740 ILCS 110/), which applies specifically to mental health records. The MHDDCA often provides stricter protections and more narrowly controls disclosures than HIPAA. Clara complies with both laws, and where the MHDDCA is more protective, its standards apply. Clara does not sell your data under any circumstances.
How your information may be used or disclosed
- Treatment: Clara may share information to coordinate your care with clinicians and supervisors.
- Payment: your information may be used to bill your insurance or collect fees for services provided.
- Health care operations: Clara may use limited data for quality reviews, staff training, or audits.
- As required by law: this includes disclosures for mandatory reporting of abuse or neglect, responding to court orders, and meeting public health requirements.
- With your written consent or authorization: any other uses or disclosures, such as coordinating with a third party, require your explicit written permission.
Website, forms, assistant, and online data
Clara's website is a public information and intake surface. If you use the contact form, event interest form, waitlist, booking links, or website assistant, Clara may receive the information you choose to provide, such as your name, contact details, preferred service or event, and a short message. Please avoid sending unnecessary sensitive details through public forms or chat.
- Forms and waitlists: contact form, event interest, and waitlist submissions are used for human review, follow-up, continuity, abuse prevention, and retained-record backup where required.
- Website assistant: chat/assistant interactions may be logged in minimized form for safety review, troubleshooting, abuse prevention, and service improvement. Clara limits retention and stores redacted previews or hashed identifiers where possible.
- Technical logs: server logs may include IP address, user-agent, timestamps, requested pages, referrers, and security events. These logs help operate and protect the site.
- Analytics and social integrations: Clara may use website analytics, Search Console, Google Business Profile, LinkedIn, Meta, Instagram, or similar integrations to understand public-site performance and publish or measure Clara-owned content. Clara does not sell your data.
- LLM processing: Clara uses LLM tools for limited website/admin features such as content prompts, writing assistance, summaries, public assistant responses, and operational review. Public form or assistant details may be processed by those tools only as needed for the feature, review, safety, or support workflow.
- Processors and subprocessors: Clara may rely on practical service providers, processors, and subprocessors such as hosting, database, email, analytics, backup, LLM, and social-platform vendors. They are used to run Clara's website and operations, not to sell personal data.
- Backups and exports: retained website records may be included in encrypted backup exports and audit records. Backup, legal, security, and healthcare retention requirements can limit immediate deletion.
Website and intake information is not the same as a full clinical record unless it becomes part of Clara's care, billing, legal, or retained operational records. Clara still handles therapy-adjacent submissions carefully because they can include sensitive details.
MHDDCA-specific protections
Your mental health records and communications are confidential. Disclosure without your consent is extremely limited and may only occur in circumstances such as imminent harm or mandatory reporting.
When consent is required, it must identify:
- the person or agency receiving the information
- the purpose of the disclosure
- the nature of the information to be disclosed
- your right to inspect or copy the information before disclosure
- any consequences of refusing consent, if applicable
- an expiration date, if applicable
- your right to revoke consent in writing at any time
Consent must be signed. Information disclosed under consent cannot be further disclosed without a new, specific consent. Personal notes and psychological test data receive additional protections.
Your rights
- Request restrictions on certain uses and disclosures
- Request confidential communications through alternative means or locations
- Inspect or obtain copies of your records, subject to applicable rules, reasonable fees, and limited exceptions
- Request amendments to incorrect or incomplete records
- Receive an accounting of disclosures
- Request a paper copy of this notice
- File a complaint with Clara or with the Secretary of the U.S. Department of Health and Human Services, without fear of retaliation
Clara's duties
- Maintain the privacy and security of your health information
- Follow the terms of this notice
- Notify you if a breach affects your protected health information
- Make reasonable efforts to accommodate privacy-related requests
Contact information
If you have questions or wish to make a complaint, please contact Clara's Privacy Officer:
Acknowledgment
By signing Clara's Consent for Services, clients acknowledge that they have received and reviewed this Notice. Clara may update this Notice from time to time; new versions will be made available.