This Privacy Policy describes how I handle information collected through this website. It applies only to twolanternstherapy.com and does not cover the clinical practice itself. For information about how I handle protected health information in the course of treatment, please see my Notice of Privacy Practices, which is provided at intake and available on request.

Two Lanterns Therapy, LLC is a solo private practice that I own and operate as a Licensed Independent Clinical Social Worker (LICSW) in the Commonwealth of Massachusetts. I provide individual, adult and family therapy. I am personally responsible for all decisions about how this website collects and handles visitor information.

If you have questions about this policy or about your information, you can reach me at hello@twolanternstherapy.com.

What this website collects

Information you choose to share with me. When you fill out the contact form, I receive what you type into it; typically your name, email address, and the message you write. The contact form is not intended for clinical or sensitive personal information, and I ask visitors not to include those details. If you want to begin therapy, please use the New Client Inquiry process instead, which goes through my HIPAA-compliant practice management system.

Information collected automatically when you visit. Like most websites, this one logs basic technical information: your IP address, your browser type, the pages you view, and the date and time of your visit. This is standard server-level data and is not connected to your name unless you’ve separately submitted a form. I use this only to keep the site running and to notice problems, not to build profiles of visitors.

Cookies. A small number of cookies are set when you use the site, primarily to keep the site functioning correctly. I do not use advertising cookies or behavioral tracking cookies. You can disable cookies in your browser settings if you prefer; some site features may not work as expected if you do.

I do not use Google Analytics, Facebook Pixel, or other behavioral analytics tools that build profiles of website visitors.

What I don’t collect through this website

This website is not a clinical tool, and it should not be used to share clinical information. I do not collect, and I ask visitors not to submit through the public-facing contact form:

• Diagnostic information or symptoms
• Medication lists
• Insurance details
• Information about other people’s health
• Anything else you would consider sensitive

If you need to share that kind of information as part of becoming a client, the secure client portal and the New Client Inquiry process are the appropriate channels. Both are HIPAA-compliant.

How I use what you share

When you contact me through the website, I use what you write to respond to you. That’s the only purpose. I don’t add you to mailing lists, I don’t share your message with third parties for marketing, and I don’t sell or trade contact information under any circumstances.

If your message indicates a clinical concern that I can’t appropriately respond to over email, I may suggest you complete the New Client Inquiry or, in urgent situations, refer you to a crisis resource.

Service providers

A few outside companies help me run this website. I’ve named them here so you know who they are:

• WP Engine hosts the website and stores its files.
• Google Workspace handles practice email.
• SimplePractice handles new client inquiries, scheduling, and the secure client portal. SimplePractice has signed a Business Associate Agreement (BAA) with my practice as required by HIPAA.
• Cloudflare provides security and content delivery for the site.

These companies have access only to what they need to do their jobs, and they’re contractually bound to handle information appropriately. I have not signed BAAs with companies whose role doesn’t involve protected health information, because the website itself does not handle protected health information.

How I protect what you share

The website uses HTTPS encryption, meaning the connection between your browser and the site is secured. Email is generally not encrypted end-to-end, which is one of the reasons I ask visitors not to include sensitive information in the contact form. For anything sensitive, please use the secure client portal.

I follow reasonable administrative, technical, and physical safeguards to protect the information I hold. No system is perfect, but I take this seriously.

Your rights under Massachusetts law

If you live in Massachusetts, you have certain rights regarding your personal information under state law, including 201 CMR 17.00 (the Massachusetts data protection regulations). These include the right to know what personal information I have about you, to ask me to correct it if it’s wrong, and to ask me to delete it. To exercise any of these rights, email hello@twolanternstherapy.com.

If you’re a current or former client of the practice, your rights regarding your protected health information are described in my Notice of Privacy Practices, not here.

Data retention

Contact form submissions are kept for as long as I reasonably need them to respond to your inquiry and any follow-up. After that, they’re deleted. Server logs are retained briefly for technical and security purposes and are deleted on a rolling basis.

If you become a client, your clinical records are retained according to Massachusetts requirements for licensed mental health professionals — currently a minimum of seven years from the last date of service for adult clients, and seven years past the age of majority for minor clients. Those records are kept in my HIPAA-compliant practice management system, not on this website.

Children

This website is not directed at children under 13, and I don’t knowingly collect personal information from them through it. I do provide therapy to children and adolescents, but in those cases, intake and clinical communication happens through the secure client portal with the involvement of a parent or guardian, not through the public website.

Visitors from outside Massachusetts

I provide therapy only to clients located in states where I am licensed to practice. Currently that includes Massachusetts. I may not be able to take you on as a client even if we’d be a good fit clinically, due to interstate licensure requirements.

This website is operated from the United States. If you’re contacting me from outside the United States, your information will be transferred to and handled in the U.S.

Changes to this policy

I may update this policy from time to time. When I do, I’ll change the effective date at the top. Significant changes will be noted on the homepage briefly. Your continued use of the site after a change means you accept the updated policy.

Contact

For questions about this Privacy Policy or to exercise any of the rights described above, please use the contact form. I’ll respond within two business days.

For questions about clinical privacy and protected health information, please see my Notice of Privacy Practices, which is provided to all clients at intake and available on request.

---

Last updated: May 10, 2026