Right Mindset, PLLC

1. Who We Are

Right Mindset, PLLC is a virtual psychotherapy practice based in Huntersville, North Carolina, providing online mental health services to women in the states of North Carolina and Texas. Our services focus on supporting women navigating anxiety and stress, relationships and boundaries, and life transitions and identity. We use evidence-based therapeutic approaches including Cognitive Behavioral Therapy (CBT), client-centered therapy, and strength-based practices.

Practice Name: Right Mindset, PLLC Practitioner: Karen Herbert, LCSW License Information: NC LCSW C012208 | TX LCSW 51480 Address: Huntersville, NC 28078 (Virtual Practice) Phone: (704) 327-2127 Email: karenherbert@rightmindsetpllc.com Website: https://www.rightmindsetpllc.com/ Hours of Operation: Monday through Friday, 4:30 PM to 8:30 PM; Saturday, 8:00 AM to 12:00 PM; Sunday, Closed Jurisdictions: State of North Carolina and State of Texas, United States Regulatory Bodies: North Carolina Social Work Certification and Licensure Board; Texas Behavioral Health Executive Council

2. Information We Collect

We may collect the following categories of personal information depending on how you interact with us:

Personal Identifying Information: Your full name, date of birth, mailing address, email address, phone number, and location.

Health and Clinical Information: Mental health history, diagnoses, treatment plans, therapy session notes, intake forms, assessment results, medical history relevant to treatment, and any other Protected Health Information (PHI) as defined under HIPAA.

Appointment and Scheduling Information: Dates, times, and details related to your appointments, consultations, and session history.

Payment and Billing Information: Credit or debit card information, health savings account card information, insurance details, billing address, payment history, and invoices.

Insurance Information: Insurance provider name, policy number, group number, and related claims information, if applicable. We are in network with Blue Cross Blue Shield of TX, Aetna, United Healthcare, Oxford Health Plans, Oscar, and Optum (including Optum Emotional Wellbeing Solution Premium EAP and Optum Live and Work Well EAP).

Communication Records: Emails, phone call logs, voicemail messages, text messages, contact form submissions from our website, and any other correspondence between you and our practice.

Website Usage Data: Internet Protocol (IP) address, browser type, device type, operating system, pages visited on our website, time spent on pages, referring website addresses, and other analytics data collected through cookies and similar technologies.

Emergency Contact Information: Name, phone number, and relationship of your designated emergency contact.

Referral Information: Details about who referred you to our practice, if applicable.

3. How We Collect Your Information

We collect your information through website forms, direct communication, intake and consent forms, our secure HIPAA-compliant telehealth platform, the secure client portal, cookies and analytics tools, third-party sources with your consent or as permitted by law, and secure payment processing systems. We accept all major credit cards and health savings account cards.

4. Why We Collect Your Information

We collect personal information to provide therapy services, manage appointments including free initial 15-minute consultations, communicate with you, process payments and insurance claims, provide superbills for out-of-network reimbursement when applicable, meet legal and regulatory requirements, support safety and emergency purposes, improve service quality, and maintain and improve our website.

5. How We Use Your Information

We use health and personal information to provide psychotherapy services, develop and adjust treatment plans, and coordinate care when appropriate and authorized. We use contact and scheduling information to manage appointments and reminders. Payment and insurance information is used to process transactions, submit insurance claims, provide superbills, and manage your account. Analytics data is used in aggregate to improve the site. Information may also be used to comply with legal and regulatory requirements, respond to court orders or subpoenas, or fulfill mandatory reporting obligations.

6. Who We Share Your Information With

We take your privacy seriously and do not sell your personal information to anyone. We may share information only as necessary and as permitted or required by law with our HIPAA-compliant EMR system, secure payment processors, HIPAA-compliant telehealth platform provider, website hosting and analytics providers, scheduling and communication tools, UserWay Accessibility Widget, healthcare providers with your written consent, insurance companies for claims, legal and regulatory authorities, and business associates who are required to protect your information in accordance with HIPAA. We do not share your information with any third party for marketing or advertising purposes.

7. How Long We Retain Your Information

Clinical and Health Records: In compliance with North Carolina and Texas state laws and HIPAA regulations, we retain your clinical records for a minimum of seven (7) years after the date of your last treatment session. For minor clients, records are retained for at least seven (7) years after the client reaches the age of eighteen (18). In some cases, records may be retained for up to ten (10) years depending on clinical and legal considerations.

Billing and Financial Records: Payment and billing records are retained for a minimum of seven (7) years to comply with tax and financial regulations.

Communication Records: Emails, messages, and other correspondence are retained for the duration of the therapeutic relationship and for a reasonable period afterward, consistent with our records retention practices.

Website Data: Analytics and cookie data is retained in accordance with the retention settings of our analytics and tracking tools. Most analytics data is retained in anonymized or aggregated form.

Deletion and Destruction: When your information is no longer required to be retained, it will be securely destroyed. Electronic records are permanently deleted using secure data destruction methods. Paper records, if any, are shredded using cross-cut shredders.

8. How We Protect Your Information

We take the security of your personal information seriously and implement administrative, technical, and physical safeguards. These include encryption in transit and at rest, access controls, secure HIPAA-compliant storage, encrypted telehealth sessions, staff privacy training, secure communication, regular security reviews, and data breach procedures.

9. Your Rights as a Client

Under HIPAA and applicable state laws, you have the right to access and request amendments to your health records, request restrictions, request confidential communications, request an accounting of certain disclosures, receive a copy of this policy, revoke authorization, and file a complaint without retaliation. To exercise these rights, please contact us using the information provided in Section 19.

You may file a complaint with HHS at https://www.hhs.gov/hipaa/filing-a-complaint/ or by calling 1-800-368-1019.

10. Cookies and Tracking Technologies

Our website uses cookies and similar tracking technologies to enhance your browsing experience and help us understand how visitors use our site. Essential cookies support website functions. Analytics cookies collect anonymized data about pages visited, time spent on the site, and general geographic location. Functional cookies remember choices such as accessibility preferences.

Most web browsers allow you to control cookies through their settings. We do not use cookies or tracking technologies to collect personal health information, and website analytics data is not linked to clinical or health records. Our website respects Do Not Track (DNT) signals sent by your browser. When a DNT signal is detected, we limit tracking to essential cookies only.

11. Website Accessibility (UserWay)

Right Mindset, PLLC is committed to ensuring that our website is accessible to all visitors, including individuals with disabilities. To support this commitment, we use the Accessibility by UserWay widget on our website.

The UserWay Accessibility Widget offers features such as screen reader compatibility and optimization, keyboard navigation support, adjustable text size and spacing, high contrast and color adjustment modes, pause animations, highlight links and headings, readable font options, cursor enhancements, alternative text for images, ARIA attribute enhancements, page structure and heading navigation, and focus indicator improvements.

The UserWay widget does not collect personal identifying information or personal health information from visitors who use the widget. UserWay may collect anonymized, aggregated usage data related to widget interactions to improve its services. For more information, visit https://www.userway.org/privacy.

If you experience accessibility issues, contact us at karenherbert@rightmindsetpllc.com or (704) 327-2127 and we will work to resolve the issue promptly.

12. Notice of Privacy Practices (HIPAA)

This section serves as our Notice of Privacy Practices as required by HIPAA. It describes how your Protected Health Information (PHI) may be used and disclosed, and how you can access this information.

PHI includes individually identifiable health information we create, receive, maintain, or transmit in connection with healthcare services. We may use and disclose PHI for treatment, payment, healthcare operations, as required by law, to avert a serious threat to health or safety, mandatory reporting, and judicial or administrative proceedings. Psychotherapy notes receive additional protections.

We are required by law to maintain the privacy and security of your PHI, provide this Notice, follow its terms, and notify you if a breach of unsecured PHI occurs. Changes to this Notice apply to PHI we already hold and new information collected after the change. Complaints may be filed with our practice or the Secretary of HHS without penalty.

13. Telehealth and Virtual Sessions

Right Mindset, PLLC provides all services through online virtual therapy (telehealth). We use a HIPAA-compliant, encrypted video conferencing platform, and our telehealth provider has entered into a Business Associate Agreement (BAA) with our practice.

Before beginning telehealth services, you will be asked to review and sign a telehealth informed consent form. We conduct sessions from a private, confidential location and recommend that you also find a quiet, private space. In the event of a technical disruption, we will attempt to reconnect. If reconnection is not possible, we will contact you by phone to reschedule or continue the session.

Karen Herbert, LCSW is licensed in North Carolina (LCSW C012208) and Texas (LCSW 51480). Telehealth services are only available to clients who are physically located in one of these states at the time of the session. Sessions are not recorded by our practice. We ask that you also refrain from recording sessions without prior written consent from all parties.

14. Social Media Policy

Right Mindset, PLLC may maintain a presence on social media platforms for educational content, mental health resources, and general practice information. We will never acknowledge or disclose that you are a client on social media and will not follow, friend, or connect with current or former clients on personal social media accounts. Please do not contact us through social media for therapy-related matters. Content shared on social media is for educational purposes only and does not constitute therapy, medical advice, or a therapeutic relationship.

15. Third-Party Links

Our website may contain links to third-party websites, resources, or services that are not owned or controlled by Right Mindset, PLLC. We are not responsible for the privacy practices or content of third-party websites. Please review the privacy policies of any third-party sites you visit. A link does not constitute an endorsement of that site's privacy practices or content.

16. Children's Privacy

Right Mindset, PLLC provides therapy services to adult women (ages 18 and over). Our website is not directed at children under the age of 13, and we do not knowingly collect personal information from children under 13. If we become aware that we have inadvertently collected personal information from a child under 13, we will take steps to delete it as soon as reasonably possible.

17. Data Breach Notification Procedures

In the event of a data breach involving personal or health information, we will promptly investigate and contain the incident, assess the nature and scope of the breach, mitigate potential harm, and notify affected individuals and regulatory authorities as required by law. If the breach involves unsecured PHI, we will notify affected individuals in writing without unreasonable delay and no later than 60 days after discovery, as required by the HIPAA Breach Notification Rule. We will notify HHS as required, notify media where required by HIPAA, and document all breaches, risk assessments, and responses.

18. Updates to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, services, or legal requirements. The updated policy will be posted at https://www.rightmindsetpllc.com/privacy with a revised Last Updated date. For significant changes that materially affect how we handle personal information, we will make reasonable efforts to notify you by email or through a notice on our website prior to the change taking effect. Changes take effect on the date posted unless otherwise specified. Continued use of the website or services after changes constitutes acknowledgment of the updated policy.

19. Contact Information

If you have questions, concerns, or requests regarding this Privacy Policy, your personal information, or your privacy rights, please contact us:

Right Mindset, PLLC Karen Herbert, LCSW Phone: (704) 327-2127 Email: karenherbert@rightmindsetpllc.com Website: https://www.rightmindsetpllc.com/ Mailing Address: Huntersville, NC 28078

To file a complaint with the U.S. Department of Health and Human Services (HHS), Office for Civil Rights: Website: https://www.hhs.gov/hipaa/filing-a-complaint/ Phone: 1-800-368-1019 Address: U.S. Department of Health and Human Services, 200 Independence Avenue SW, Washington, DC 20201

To file a complaint with the North Carolina Social Work Certification and Licensure Board: Website: https://www.ncswboard.gov/ Phone: (919) 733-9190

To file a complaint with the Texas Behavioral Health Executive Council: Website: https://www.bhec.texas.gov/ Phone: (512) 305-7700

This Privacy Policy is effective as of the date listed at the top of this document.

Copyright 2026 Right Mindset, PLLC. All Rights Reserved.