Privacy Policy
Last Updated: 9/13/2026
This Privacy Policy describes how Sage & Stone Holistic Counseling, LLC (“we” or “us”) collects, uses, and shares your personal information wIntroduction
This Privacy Policy describes how Sage & Stone Holistic Counseling, LLC (“Sage & Stone,” “we,” “us,” or “our”) collects, uses, shares, and protects your personal information when you visit our website, sageandstoneholisticcounseling.com, and any of our subdomains (the “Website”), when you communicate with us, and when you receive services from us.
Sage & Stone is an integrative health and holistic counseling practice located in Palm Beach Gardens, Florida. Because we are a healthcare provider, some of the information we collect is protected health information (“PHI”) under the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”). PHI receives the additional protections described in Section 3 of this policy and in our Notice of Privacy Practices, which is provided to every patient at the start of care and is available on request.
By using the Website or providing information to us, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with it, please do not use the Website.
1. Information We Collect
We collect three categories of information: Device Information collected automatically when you browse the Website, Provided Information that you give us directly, and Health Information that you share with us as a patient or prospective patient.
Device Information
When you visit the Website, we automatically collect limited information about your device, including your browser type, IP address, time zone, approximate location, the pages you view, the website or search terms that referred you to us, and how you interact with the Website. We collect Device Information using:
• Cookies — small data files placed on your device that often include an anonymous unique identifier. For more information about cookies, and how to disable them, visit www.allaboutcookies.org.
• Log files — records of actions on the Website, including IP address, browser type, internet service provider, referring and exit pages, and date/time stamps.
• Analytics tags — electronic files used to record how visitors use the Website in aggregate.
You can set your browser to refuse cookies, and the website above explains how to remove cookies from your browser. Some Website features may not function properly if cookies are disabled. We do not currently respond to “Do Not Track” browser signals.
Provided Information
We collect information you choose to give us when you:
• Contact us through our contact form, by email, or by telephone;
• Subscribe to receive updates when we publish new blog content, or provide your email address in exchange for a free resource;
• Request an appointment, consultation, or information about our services;
• Complete an intake, screening, or registration form for any of our services or programs;
• Complete a survey, provide feedback, or leave a review.
Provided Information may include your name, email address, mailing address, telephone number, date of birth, emergency contact, insurance or billing information (including payment card details, which are handled only by our secure payment processor and are never stored on the Website), and the content of any message you send us.
Health Information
If you become a patient or prospective patient, we collect information about your health history, symptoms, medications, laboratory results, treatment, and care. This information is collected through our secure electronic medical record and patient portal, during telehealth and in-person visits, and through clinical intake forms. Health Information is PHI and is governed by Section 3 below.
Important: Please do not send sensitive health information through the Website contact form, social media, or unencrypted email. To share health information with us securely, please use the patient portal or call our office.
When we refer to “Personal Information” in this Privacy Policy, we mean Device Information, Provided Information, and, where applicable, Health Information.
2. How We Use Your Information
We use Personal Information to:
• Respond to your inquiries and communicate with you about appointments, services, and your care;
• Schedule, deliver, document, and bill for healthcare and counseling services, including telehealth;
• Verify your identity and protect against fraud, security incidents, and unauthorized access;
• Send you blog updates, educational content, and practice announcements when you have opted in to receive them;
• Operate, maintain, and improve the Website, including understanding in aggregate how visitors use it;
• Comply with legal, regulatory, licensing, and professional obligations; and
• Establish, exercise, or defend legal claims.
We use Device Information only to keep the Website secure, to measure and improve its performance, and to understand how visitors find and use it. We do not use Device Information to build advertising profiles, and we do not use health information for marketing purposes without your written authorization.
3. Protected Health Information and HIPAA
Sage & Stone is a covered entity under HIPAA. We comply with the HIPAA Privacy Rule, Security Rule, and Breach Notification Rule, as well as applicable Florida law governing the confidentiality of medical, mental health, and counseling records.
Our Notice of Privacy Practices describes in detail how we may use and disclose your PHI for treatment, payment, and healthcare operations; the circumstances in which we are permitted or required by law to disclose PHI without your authorization; and your rights regarding your PHI, including the right to access and obtain a copy of your records, request corrections, request restrictions on certain uses and disclosures, request confidential communications, receive an accounting of disclosures, and file a complaint. Where this Privacy Policy and the Notice of Privacy Practices differ with respect to PHI, the Notice of Privacy Practices controls.
We do not sell PHI. We do not use or disclose PHI for marketing purposes, and we do not share PHI with third parties, except as permitted or required by HIPAA and other applicable law or with your written authorization, which you may revoke at any time.
Every vendor that creates, receives, maintains, or transmits PHI on our behalf, including our electronic medical record, telehealth, and email providers, is a HIPAA business associate and has signed a Business Associate Agreement obligating it to safeguard your information.
Telehealth visits are conducted through a secure, encrypted platform. Information collected during telehealth visits is protected in the same way as information collected in person.
4. How We Share Your Information
We do not sell, rent, or trade your Personal Information. We share Personal Information only with third parties that help us operate our practice and the Website, and only as permitted by applicable law. The categories of third parties with whom we may share elements of your Personal Information are:
• Electronic medical record, practice management, scheduling, and telehealth providers;
• Payment processors engaged by us to securely handle billing and payment card information;
• Email management and distribution providers for blog updates and practice communications;
• Website hosting, security, and analytics providers that allow us to operate, protect, and improve the Website;
• Laboratories, pharmacies, and other healthcare providers involved in your care, with your consent or as otherwise permitted by HIPAA;
• Professional advisers, including attorneys, accountants, and insurers, when necessary.
These providers are permitted to use your information only to perform services for us and are required to protect it. We may also disclose Personal Information when required to comply with applicable laws and regulations, to respond to a subpoena, court order, or other lawful request, to protect the rights, safety, or property of our patients, our staff, or others, or in connection with a merger, sale, or transfer of our practice, in which case your information would remain subject to this Privacy Policy and applicable law.
For Website analytics we use Google Analytics. You can read about how Google uses data at https://policies.google.com/privacy and opt out of Google Analytics at https://tools.google.com/dlpage/gaoptout.
5. Service Providers and Where Your Data Is Stored
We process and store your data using the following providers:
• Showit — Website hosting and contact forms
• OptiMantra — electronic medical record, patient portal, scheduling, telehealth, and billing (HIPAA business associate)
• Kit (formerly ConvertKit) — blog update emails and free-resource delivery
• Google Workspace — business email and secure document storage (HIPAA business associate)
Your information is stored on servers located in the United States. Please visit each provider’s website for information about the physical location of its servers and its own security practices.
6. Data Security
We use administrative, technical, and physical safeguards designed to protect your Personal Information against unauthorized access, alteration, disclosure, or destruction. These safeguards include:
• Secure Socket Layer (SSL) / Transport Layer Security (TLS) encryption for all information transmitted through the Website, our patient portal, and our telehealth platform, including transaction, payment, patient, and medical information;
• Encryption of PHI at rest within our electronic medical record;
• Role-based access controls, unique user credentials, and multi-factor authentication for systems containing PHI;
• HIPAA privacy and security training for all workforce members; and
• Written Business Associate Agreements with every vendor that handles PHI.
No method of transmission over the internet or method of electronic storage is completely secure, so we cannot guarantee absolute security. In the event of a breach of unsecured PHI or other personal information, we will notify affected individuals and regulators as required by the HIPAA Breach Notification Rule and the Florida Information Protection Act.
7. Data Retention
We retain Personal Information for as long as needed to fulfill the purposes described in this Privacy Policy, to comply with our legal, regulatory, and professional obligations, to resolve disputes, and to enforce our agreements. Medical, mental health, and counseling records are retained for at least the minimum period required by Florida law and applicable licensing board rules, after which they are securely destroyed. Email subscriber information is retained until you unsubscribe or ask us to delete it. Website analytics data is retained in aggregate form.
8. Email and Text Communications
If you subscribe to our blog, download a free resource in exchange for your email address, or otherwise opt in, you agree to receive email communications from us, which may include notifications of new blog posts, educational content, practice updates, and announcements. You may unsubscribe at any time by clicking the “unsubscribe” link at the bottom of any marketing email or by contacting us. Unsubscribing from marketing emails does not affect communications about your appointments, billing, or care.
If you provide your mobile telephone number and consent to receive text messages, we may send appointment reminders and practice communications by SMS. Message and data rates may apply. You may opt out at any time by replying STOP. Your mobile number and text-messaging consent will not be shared with third parties for marketing purposes.
9. Children’s Privacy
The Website is intended for adults. We do not knowingly collect Personal Information through the Website from children under the age of 13, and we do not offer services through the Website to anyone under 18 without the involvement of a parent or legal guardian. If you believe a child has provided us with Personal Information through the Website, please contact us and we will delete it.
10. Your Privacy Rights
Regardless of where you live, you may contact us to request access to the Personal Information we hold about you, ask that it be corrected or updated, ask that it be deleted (subject to our legal obligations to retain medical records), or withdraw consent to marketing communications. We will respond to verified requests within the time required by applicable law. We will not discriminate against you for exercising your privacy rights.
Patients have additional rights with respect to PHI under HIPAA, including the rights described in Section 3 and in our Notice of Privacy Practices.
If you are a resident of California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, or another state with a comprehensive consumer privacy law, you may have additional rights, including the right to know the categories of personal information we collect and the purposes for which we use it, the right to opt out of the sale or sharing of personal information (we do not sell or share personal information for targeted advertising), and the right to limit the use of sensitive personal information. To exercise these rights, contact us using the information in Section 14.
If you are located in the European Economic Area, the United Kingdom, or Switzerland, you have the right to access, correct, delete, restrict, or object to our processing of your Personal Information and to request that we transfer it to another organization. We process your information to perform services you have requested, to comply with legal obligations, and to pursue our legitimate business interests described above. Please note that your information will be transferred to and stored in the United States.
11. Third-Party Websites
This Privacy Policy applies only to the Website and to information we collect. We are not responsible for the data collection, privacy practices, or policies of any third-party website, application, or social media platform that we link to or that links to us, including our patient portal provider, laboratories, and pharmacies. We encourage you to read the privacy statements of any third-party site you visit.
12. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices or for operational, legal, or regulatory reasons. The date of the most recent revision is shown at the top of this page. Changes are effective when posted on the Website. Where required by law, we will notify you of material changes.
13. Complaints
If you have a concern about how we handle your Personal Information, please contact us first so that we can resolve it. If you believe your HIPAA privacy rights have been violated, you may also file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights, at www.hhs.gov/ocr/privacy/hipaa/complaints. You will not be penalized or retaliated against for filing a complaint.
Residents of the European Union and the United Kingdom have the right to lodge a complaint with their local data protection authority. California residents may contact the Complaint Assistance Unit of the Division of Consumer Services of the California Department of Consumer Affairs at 1625 North Market Blvd., Suite N 112, Sacramento, California 95834, or by telephone at (800) 952-5210.
14. Contact Us
For questions about this Privacy Policy, to exercise your privacy rights, or to request a copy of our Notice of Privacy Practices, please contact us:
• Sage & Stone Holistic Counseling, LLC
• Attn: Privacy Officer — Allyson Kayton, DNP, APRN, NNP-BC, RMHI, IHP2
• 2925 PGA Blvd., Suite 102, Studio 14, Palm Beach Gardens, FL 33412
• Phone: 954-408-3666
• Email: ally@sageandstoneholisticcounseling.com
This Privacy Policy describes how Sage & Stone Holistic Counseling, LLC (“Sage & Stone,” “we,” “us,” or “our”) collects, uses, shares, and protects your personal information when you visit our website, sageandstoneholisticcounseling.com, and any of our subdomains (the “Website”), when you communicate with us, and when you receive services from us.
Sage & Stone is an integrative health and holistic counseling practice located in Palm Beach Gardens, Florida. Because we are a healthcare provider, some of the information we collect is protected health information (“PHI”) under the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”). PHI receives the additional protections described in Section 3 of this policy and in our Notice of Privacy Practices, which is provided to every patient at the start of care and is available on request.
By using the Website or providing information to us, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with it, please do not use the Website.
1. Information We Collect
We collect three categories of information: Device Information collected automatically when you browse the Website, Provided Information that you give us directly, and Health Information that you share with us as a patient or prospective patient.
Device Information
When you visit the Website, we automatically collect limited information about your device, including your browser type, IP address, time zone, approximate location, the pages you view, the website or search terms that referred you to us, and how you interact with the Website. We collect Device Information using:
• Cookies — small data files placed on your device that often include an anonymous unique identifier. For more information about cookies, and how to disable them, visit www.allaboutcookies.org.
• Log files — records of actions on the Website, including IP address, browser type, internet service provider, referring and exit pages, and date/time stamps.
• Analytics tags — electronic files used to record how visitors use the Website in aggregate.
You can set your browser to refuse cookies, and the website above explains how to remove cookies from your browser. Some Website features may not function properly if cookies are disabled. We do not currently respond to “Do Not Track” browser signals.
Provided Information
We collect information you choose to give us when you:
• Contact us through our contact form, by email, or by telephone;
• Subscribe to receive updates when we publish new blog content, or provide your email address in exchange for a free resource;
• Request an appointment, consultation, or information about our services;
• Complete an intake, screening, or registration form for any of our services or programs;
• Complete a survey, provide feedback, or leave a review.
Provided Information may include your name, email address, mailing address, telephone number, date of birth, emergency contact, insurance or billing information (including payment card details, which are handled only by our secure payment processor and are never stored on the Website), and the content of any message you send us.
Health Information
If you become a patient or prospective patient, we collect information about your health history, symptoms, medications, laboratory results, treatment, and care. This information is collected through our secure electronic medical record and patient portal, during telehealth and in-person visits, and through clinical intake forms. Health Information is PHI and is governed by Section 3 below.
Important: Please do not send sensitive health information through the Website contact form, social media, or unencrypted email. To share health information with us securely, please use the patient portal or call our office.
When we refer to “Personal Information” in this Privacy Policy, we mean Device Information, Provided Information, and, where applicable, Health Information.
2. How We Use Your Information
We use Personal Information to:
• Respond to your inquiries and communicate with you about appointments, services, and your care;
• Schedule, deliver, document, and bill for healthcare and counseling services, including telehealth;
• Verify your identity and protect against fraud, security incidents, and unauthorized access;
• Send you blog updates, educational content, and practice announcements when you have opted in to receive them;
• Operate, maintain, and improve the Website, including understanding in aggregate how visitors use it;
• Comply with legal, regulatory, licensing, and professional obligations; and
• Establish, exercise, or defend legal claims.
We use Device Information only to keep the Website secure, to measure and improve its performance, and to understand how visitors find and use it. We do not use Device Information to build advertising profiles, and we do not use health information for marketing purposes without your written authorization.
3. Protected Health Information and HIPAA
Sage & Stone is a covered entity under HIPAA. We comply with the HIPAA Privacy Rule, Security Rule, and Breach Notification Rule, as well as applicable Florida law governing the confidentiality of medical, mental health, and counseling records.
Our Notice of Privacy Practices describes in detail how we may use and disclose your PHI for treatment, payment, and healthcare operations; the circumstances in which we are permitted or required by law to disclose PHI without your authorization; and your rights regarding your PHI, including the right to access and obtain a copy of your records, request corrections, request restrictions on certain uses and disclosures, request confidential communications, receive an accounting of disclosures, and file a complaint. Where this Privacy Policy and the Notice of Privacy Practices differ with respect to PHI, the Notice of Privacy Practices controls.
We do not sell PHI. We do not use or disclose PHI for marketing purposes, and we do not share PHI with third parties, except as permitted or required by HIPAA and other applicable law or with your written authorization, which you may revoke at any time.
Every vendor that creates, receives, maintains, or transmits PHI on our behalf, including our electronic medical record, telehealth, and email providers, is a HIPAA business associate and has signed a Business Associate Agreement obligating it to safeguard your information.
Telehealth visits are conducted through a secure, encrypted platform. Information collected during telehealth visits is protected in the same way as information collected in person.
4. How We Share Your Information
We do not sell, rent, or trade your Personal Information. We share Personal Information only with third parties that help us operate our practice and the Website, and only as permitted by applicable law. The categories of third parties with whom we may share elements of your Personal Information are:
• Electronic medical record, practice management, scheduling, and telehealth providers;
• Payment processors engaged by us to securely handle billing and payment card information;
• Email management and distribution providers for blog updates and practice communications;
• Website hosting, security, and analytics providers that allow us to operate, protect, and improve the Website;
• Laboratories, pharmacies, and other healthcare providers involved in your care, with your consent or as otherwise permitted by HIPAA;
• Professional advisers, including attorneys, accountants, and insurers, when necessary.
These providers are permitted to use your information only to perform services for us and are required to protect it. We may also disclose Personal Information when required to comply with applicable laws and regulations, to respond to a subpoena, court order, or other lawful request, to protect the rights, safety, or property of our patients, our staff, or others, or in connection with a merger, sale, or transfer of our practice, in which case your information would remain subject to this Privacy Policy and applicable law.
For Website analytics we use Google Analytics. You can read about how Google uses data at https://policies.google.com/privacy and opt out of Google Analytics at https://tools.google.com/dlpage/gaoptout.
5. Service Providers and Where Your Data Is Stored
We process and store your data using the following providers:
• Showit — Website hosting and contact forms
• OptiMantra — electronic medical record, patient portal, scheduling, telehealth, and billing (HIPAA business associate)
• Kit (formerly ConvertKit) — blog update emails and free-resource delivery
• Google Workspace — business email and secure document storage (HIPAA business associate)
Your information is stored on servers located in the United States. Please visit each provider’s website for information about the physical location of its servers and its own security practices.
6. Data Security
We use administrative, technical, and physical safeguards designed to protect your Personal Information against unauthorized access, alteration, disclosure, or destruction. These safeguards include:
• Secure Socket Layer (SSL) / Transport Layer Security (TLS) encryption for all information transmitted through the Website, our patient portal, and our telehealth platform, including transaction, payment, patient, and medical information;
• Encryption of PHI at rest within our electronic medical record;
• Role-based access controls, unique user credentials, and multi-factor authentication for systems containing PHI;
• HIPAA privacy and security training for all workforce members; and
• Written Business Associate Agreements with every vendor that handles PHI.
No method of transmission over the internet or method of electronic storage is completely secure, so we cannot guarantee absolute security. In the event of a breach of unsecured PHI or other personal information, we will notify affected individuals and regulators as required by the HIPAA Breach Notification Rule and the Florida Information Protection Act.
7. Data Retention
We retain Personal Information for as long as needed to fulfill the purposes described in this Privacy Policy, to comply with our legal, regulatory, and professional obligations, to resolve disputes, and to enforce our agreements. Medical, mental health, and counseling records are retained for at least the minimum period required by Florida law and applicable licensing board rules, after which they are securely destroyed. Email subscriber information is retained until you unsubscribe or ask us to delete it. Website analytics data is retained in aggregate form.
8. Email and Text Communications
If you subscribe to our blog, download a free resource in exchange for your email address, or otherwise opt in, you agree to receive email communications from us, which may include notifications of new blog posts, educational content, practice updates, and announcements. You may unsubscribe at any time by clicking the “unsubscribe” link at the bottom of any marketing email or by contacting us. Unsubscribing from marketing emails does not affect communications about your appointments, billing, or care.
If you provide your mobile telephone number and consent to receive text messages, we may send appointment reminders and practice communications by SMS. Message and data rates may apply. You may opt out at any time by replying STOP. Your mobile number and text-messaging consent will not be shared with third parties for marketing purposes.
9. Children’s Privacy
The Website is intended for adults. We do not knowingly collect Personal Information through the Website from children under the age of 13, and we do not offer services through the Website to anyone under 18 without the involvement of a parent or legal guardian. If you believe a child has provided us with Personal Information through the Website, please contact us and we will delete it.
10. Your Privacy Rights
Regardless of where you live, you may contact us to request access to the Personal Information we hold about you, ask that it be corrected or updated, ask that it be deleted (subject to our legal obligations to retain medical records), or withdraw consent to marketing communications. We will respond to verified requests within the time required by applicable law. We will not discriminate against you for exercising your privacy rights.
Patients have additional rights with respect to PHI under HIPAA, including the rights described in Section 3 and in our Notice of Privacy Practices.
If you are a resident of California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, or another state with a comprehensive consumer privacy law, you may have additional rights, including the right to know the categories of personal information we collect and the purposes for which we use it, the right to opt out of the sale or sharing of personal information (we do not sell or share personal information for targeted advertising), and the right to limit the use of sensitive personal information. To exercise these rights, contact us using the information in Section 14.
If you are located in the European Economic Area, the United Kingdom, or Switzerland, you have the right to access, correct, delete, restrict, or object to our processing of your Personal Information and to request that we transfer it to another organization. We process your information to perform services you have requested, to comply with legal obligations, and to pursue our legitimate business interests described above. Please note that your information will be transferred to and stored in the United States.
11. Third-Party Websites
This Privacy Policy applies only to the Website and to information we collect. We are not responsible for the data collection, privacy practices, or policies of any third-party website, application, or social media platform that we link to or that links to us, including our patient portal provider, laboratories, and pharmacies. We encourage you to read the privacy statements of any third-party site you visit.
12. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices or for operational, legal, or regulatory reasons. The date of the most recent revision is shown at the top of this page. Changes are effective when posted on the Website. Where required by law, we will notify you of material changes.
13. Complaints
If you have a concern about how we handle your Personal Information, please contact us first so that we can resolve it. If you believe your HIPAA privacy rights have been violated, you may also file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights, at www.hhs.gov/ocr/privacy/hipaa/complaints. You will not be penalized or retaliated against for filing a complaint.
Residents of the European Union and the United Kingdom have the right to lodge a complaint with their local data protection authority. California residents may contact the Complaint Assistance Unit of the Division of Consumer Services of the California Department of Consumer Affairs at 1625 North Market Blvd., Suite N 112, Sacramento, California 95834, or by telephone at (800) 952-5210.
14. Contact Us
For questions about this Privacy Policy, to exercise your privacy rights, or to request a copy of our Notice of Privacy Practices, please contact us:
• Sage & Stone Holistic Counseling, LLC
• Attn: Privacy Officer — Allyson Kayton, DNP, APRN, NNP-BC, RMHI, IHP2
• 2925 PGA Blvd., Suite 102, Studio 14, Palm Beach Gardens, FL 33412
• Phone: 954-408-3666
• Email: ally@sageandstoneholisticcounseling.com
Contact us
For more information about our privacy practices, if you have questions, or if you would like to exercise your data protection rights, please do not hesitate to contact us.
Email us: ally@sageandstoneholisticcounseling.com
Care, However You Need It
in person
2925 PGA Blvd, Ste 102 Studio 14,
Palm Beach Gardens, FL 33410
telehealth
Therapy, functional medicine, and wellness coaching.
