502 MYO — Myofunctional Therapy
Book an evaluation

Last updated: 2026-08-18

Privacy.

This page explains how 502 MYO handles information collected at 502myo.com. The patient portal at 502myo.clientsecure.me is provided by SimplePractice under their own privacy practices and is not covered by this notice.

What we collect on this site

We collect only what is needed to respond to a non-medical inquiry: your name, email, phone (optional), the topic you select from a fixed dropdown, and your message. We do not collect health history, diagnoses, medications, or insurance information through this site.

How we use it

To respond to your message. To contact you about scheduling. We do not sell or rent your information. We do not use it for advertising.

Where it lives

Lead submissions are stored in our operational database. Our operational database is hosted by a BAA-eligible vendor and is segmented from any clinical data. Clinical data lives in SimplePractice.

Cookies & analytics

We use Cloudflare Web Analytics, a cookieless analytics tool that does not set any cookies, localStorage entries, or fingerprinting identifiers on your browser. We also self-host a first-party analytics endpoint at/api/track that records page views and call-to-action clicks (no IP address, no session identifier, no User-Agent beyond browser+OS classification, no page-query-string). We do not use Google Analytics, Meta Pixel, Plausible, or any advertising cookies.

Security

This site uses HTTPS, a strict Content Security Policy, and other security headers including HSTS, X-Content-Type-Options, X-Frame-Options, and a restrictive Permissions-Policy. Forms are rate-limited per IP (5 per hour for the contact form, 5 per 15 minutes for the admin door gate) and the password-hashing scheme is PBKDF2-SHA256 with 100,000 iterations and a constant-time compare. Sessions are stored as opaque random tokens in HTTP-only Secure cookies with a 24-hour absolute lifetime and 30-minute idle timeout. We do not represent these measures as HIPAA compliance; clinical data handling is governed by SimplePractice.

Subprocessors

When you submit a form on this site or use the booking or client portal, the data you provide is shared with the following subprocessors:

  • Cloudflare — hosting, edge network, D1 database, Web Analytics. (Privacy: cloudflare.com/privacypolicy)
  • Resend — email delivery for form notifications. (Privacy: resend.com/legal/privacy)
  • Stripe — payment processing for invoices (when payment flow is enabled). (Privacy: stripe.com/privacy)
  • SimplePractice — clinical data, intake forms, secure client portal, telehealth. PHI never leaves SimplePractice. (Privacy: simplepractice.com/privacy)
  • Jitsi Meet (self-hosted) — telehealth video. Sessions are not recorded. (No third-party data sharing.)

Data subject requests

To request access to, correction of, or deletion of personal information you have submitted through this website, email [email protected]. We will respond within 30 days. For clinical data, contact SimplePractice directly through their portal.

HIPAA & Protected Health Information (PHI)

502 MYO takes the privacy of health information seriously. Here is the boundary in plain language:

  • This public website (502myo.com) does not collect Protected Health Information (PHI). Do not include any medical details in messages submitted through this site.
  • Clinical data — diagnoses, treatment notes, intake forms, insurance, communications about care — lives in our SimplePractice patient portal under a Business Associate Agreement (BAA). HIPAA protections apply there.
  • The public site and the clinical system are separate — there is no cross-linking of your public inquiry with your clinical record unless you opt in by booking a visit.
  • If you contact us about a clinical question, we will direct you to the secure patient portal or to call (502) 901-8089. Do not transmit PHI via email or web forms.

This site is not intended to comply with HIPAA on its own; HIPAA compliance is provided through SimplePractice for any clinical data. We do not represent this public site as HIPAA-compliant.

Your choices

You may ask us to delete a past submission by emailing [email protected]. Please do not include medical details in that email.

Contact

Questions about this privacy notice: [email protected].

This privacy notice is informational and is not legal advice. 502 MYO may revise this notice; the “last updated” date will reflect the change.