Privacy Policy

This policy explains what sfpsychiatry.org collects, where that information goes, and who can see it. It covers this website only.

It does not cover the clinical record I keep for patients of the practice. That record is governed by federal and California health-privacy law and by my Notice of Privacy Practices, which is a separate document you receive when you become a patient. Sending a message through this website does not make you a patient. If you go on to be seen here, what you sent may become part of your record, and that record is governed by the Notice rather than by this policy.

This website is not a crisis service and it is not monitored. Do not use it to report an emergency.

If you are in danger or thinking about harming yourself, call or text 988 to reach the Suicide and Crisis Lifeline, call 911, or go to your nearest emergency department.

The form asks for your name, your email address, and a short message. It also has an optional field for a phone number, if you would rather I called. That is everything. I do not ask for a date of birth, an insurance number, a diagnosis, or a medication list, and you should not put any of them in the form.

Please share only what you are comfortable putting in an online message. A sentence about what you are looking for is enough to start a conversation. Anything clinical is better said on the phone, and you are welcome to skip the form entirely and call (415) 857-3575.

When you submit the form, your message travels from your browser directly to a request handler that Halcy, my website vendor, operates on my behalf on Amazon Web Services. It is then emailed to me.

Your name, email address and phone number are also written to an inquiry log, so that I can keep track of who has written in and whether I have replied. That log is a spreadsheet in Halcy's Google Workspace rather than a file held at my office.

What you write in the message box is not copied there. It goes only to my inbox. The log records that you got in touch and how to reach you, never what you said.

Two things are worth stating plainly. The company that hosts this website never receives your message at all – the form deliberately bypasses it, so the pages you read and the message you send travel different paths. And Halcy is not copied on the email, but your message does pass through their handler, and your contact details are stored in the inquiry log described above – so they can see that you wrote to me and how to reach you.

Halcy operates that handler and that log under a written agreement with me governing how patient information may be used, and holds business associate agreements – the contract federal health-privacy law requires of a vendor handling health information – with Amazon Web Services and with Google, covering the handler and the inquiry log respectively. Those agreements cover the path up to the point your message is delivered to my inbox. They do not cover the inbox itself, which is described under Security below.

I use what you send to reply to you and to arrange an initial phone call.

I do not sell your information. I do not rent or trade it. I do not use it to build advertising profiles, and I do not hand it to data brokers.

I use PostHog to understand how visitors move through this site – which pages are read, which are ignored, where people arrive from. It is configured to collect as little as possible about you personally:

• No cookies are used for analytics. An anonymous identifier is stored in your browser's local storage instead.
• Session recording is switched off. Your visit is not replayed.
• Values you type into forms are excluded from analytics events.
• Page addresses are stripped of anything after the question mark before the event leaves your browser, so a page address can never carry information you typed.

Analytics tells me that a page was read. It does not tell me who read it, and it is not connected to anything you send through the form.

I do not share what you send except in these situations:

• With the vendors described above – the ones who carry your message to me and hold the inquiry log – who are bound by agreement to handle it only for that purpose.
• Where the law requires it, including the narrow circumstances in which a clinician is obliged to act on a risk of serious harm.

There is no other sharing. In particular, nothing you send is used for marketing by me or by anyone else.

Your message is encrypted in transit from your browser to the handler and from the handler to my inbox.

Ordinary email is not a confidential medium, and I would rather say so than imply otherwise. Once your message reaches my inbox it is subject to whatever protections my email provider offers, and messages I send back to you are subject to whatever protections yours offers. This is the reason the form asks for so little, and the reason a phone call is the better place for anything clinical.

If we do not go on to work together, I keep your message only as long as I need it to respond, and delete it afterwards. Your name and contact details stay in the inquiry log described above until I clear them from it, which is separate from deleting the email and is something I have to do deliberately.

If you become a patient, what you sent may become part of your clinical record, which is retained for the period California law requires of a physician.

You can ask me what I hold about you, ask me to correct it, or ask me to delete it, by writing to the address at the bottom of this page. If you are a patient of the practice, requests about your clinical record are handled under my Notice of Privacy Practices rather than under this policy.

California residents have rights under state privacy law, including the right to know what is collected and to request deletion. Exercising them will never affect the care you receive.

You can also avoid the form entirely and call.

The Notice of Privacy Practices is the separate document governing how I use and disclose protected health information as your physician. It is the one that matters once you are a patient. This policy is only about the website. Where the two overlap, the Notice governs.

This website is not directed at children and the form is not intended for use by anyone under 18. If a minor has sent information through it, ask me to delete it and I will.

This site links to other organizations, including professional directories and crisis resources. Once you follow a link you are on their website and their privacy policy applies, not mine.

If this policy changes, the revised version is published here with a new effective date at the top. Continued use of the site after that date means the revised policy applies.

Questions about this policy can go to San Francisco Concierge Psychiatry, 450 Sutter St, Ste 1822, San Francisco, CA 94108, or by phone at (415) 857-3575.