MentalSpace App Privacy Policy

Effective date: July 24, 2026

This policy applies to the MentalSpace mobile application (com.chctherapy.portal) and the client portal at portal.mentalspaceehr.com, operated by Coping & Healing Counseling (“the practice,” “we”). It complements — and does not replace — the practice’s HIPAA Notice of Privacy Practices.

What the app is

MentalSpace is the client portal for Coping & Healing Counseling. It lets you securely view and manage appointments, join telehealth video sessions, message your care team, complete forms and assessments, and view billing — the same capabilities as the web portal, in an app.

Information we collect

  • Account information: your email address and password (stored as a secure hash), and security data needed to keep your session safe.
  • Health information: the clinical information involved in your care — appointments, secure messages with your care team, intake forms, assessments, documents you upload, and treatment-related records shown to you in the portal. This information is protected health information (PHI) under HIPAA.
  • Billing information: invoices, statements, and payment status. Card payments are processed by our payment processor; full card numbers are never stored on our servers.
  • Camera and microphone: used only during telehealth video sessions you join, and only after you grant permission. Sessions are not recorded by default; if a session is to be transcribed or recorded, you will be asked for consent first.
  • Device push token: if you enable notifications, a device token is stored so we can deliver them. Notification text never contains clinical details.

What we do NOT do

  • No advertising, and no sale of your data — ever.
  • No third-party analytics or tracking SDKs in the app.
  • No use of your data for marketing without your explicit authorization.
  • No sharing with third parties except the service providers that operate our HIPAA-compliant infrastructure (e.g., secure cloud hosting and video services) under business associate agreements, or as required by law.

How your information is protected

All data is encrypted in transit (TLS) and at rest. Our infrastructure runs in HIPAA-eligible cloud services located in the United States. Access to your records is limited to your care team and authorized practice staff, and access is audited.

Data retention and account deletion

You can request deletion of your account at any time from Profile → Security → Delete Account in the app or portal. Your portal account is deactivated immediately: you are signed out everywhere, app notifications stop, and portal access ends.

Clinical records are different from your portal account. As a licensed healthcare practice we are legally required to retain clinical records for the period set by state and federal law, even after your portal account is deleted. When that retention period ends, records are disposed of securely.

Your rights

Under HIPAA you have rights regarding your health information, including the right to access, amend, and receive an accounting of disclosures. See our Notice of Privacy Practices or contact us to exercise these rights.

Children

The portal is used in connection with care provided by the practice, including care for minors under parent/guardian involvement consistent with law. We do not knowingly collect information from children outside a treatment relationship.

Changes

We will post any changes to this policy at this URL and update the effective date.

Contact