Privacy Policy

Effective Date: May 21, 2026
This Privacy Policy describes how StarrTherapy collects, uses, protects, stores, and disposes of personal information and protected health information (“PHI”) obtained through our website and related services.
Our privacy and security practices are designed to align with applicable federal and New Jersey privacy and cybersecurity requirements, including the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”), applicable HIPAA Security Rule safeguards, and cybersecurity best practices published by the New Jersey Cybersecurity and Communications Integration Cell (NJCCIC).

1. Information We Collect

We may collect the following categories of information through our website, forms, or secure upload systems:
· Full name
· Contact information, including email address and telephone number
· Date of birth
· Health insurance information
· Images or photographs of insurance cards
· Any information voluntarily submitted through website forms or communications

Information that identifies an individual and relates to healthcare coverage or medical services may constitute Protected Health Information (“PHI”) under HIPAA.

2. How We Use Information

We use collected information solely for legitimate business and healthcare-related purposes, including:
· Verifying insurance information
· Processing patient or client inquiries
· Coordinating healthcare-related services
· Responding to requests submitted through our website
· Maintaining secure operations and fraud prevention
· Meeting legal, regulatory, and compliance obligations
We do not sell personal information or protected health information to third parties.

3. Data Security and HIPAA Safeguards

We implement administrative, technical, and physical safeguards designed to protect personal information and PHI from unauthorized access, disclosure, alteration, or destruction in accordance with HIPAA Security Rule principles and New Jersey cybersecurity guidance.

Security measures include:
· Encryption of data transmitted through the website using industry-standard SSL/TLS encryption
· Encrypted storage of submitted information
· Restricted access to sensitive information on a need-to-know basis
· Secure authentication and access controls
· Monitoring and security review procedures
· Timely deletion of sensitive uploaded materials

Images of insurance cards and associated submitted sensitive information are retained temporarily and are generally deleted within approximately forty-eight (48) hours after submission unless a longer retention period is legally required or operationally necessary.
While we take commercially reasonable and HIPAA-aligned measures to protect information, no internet transmission or electronic storage method can be guaranteed to be completely secure.

4. Data Retention

We retain personal information and PHI only for as long as reasonably necessary to fulfill the purposes described in this Privacy Policy, comply with applicable laws, resolve disputes, and enforce agreements.
Uploaded insurance card images and temporary intake submissions are designed to be automatically deleted within two (2) days after receipt unless retention is required by law, contractual obligations, ongoing care coordination, security investigations, or regulatory compliance requirements.

5. Sharing and Disclosure of Information

We may disclose information:
· To authorized workforce members or service providers who require access to perform services on our behalf
· To healthcare providers, insurers, or business associates as permitted by HIPAA
· When required by law, court order, subpoena, or regulatory request
· To protect the rights, safety, and security of our organization, users, or the public

Any third-party service providers handling PHI on our behalf are expected to maintain appropriate safeguards and, where required, enter into Business Associate Agreements (“BAAs”).

6. Cookies and Website Analytics

Our website may use cookies, analytics tools, and similar technologies to improve website functionality, security, and user experience.

These technologies may collect limited technical information such as:
· Browser type
· Device information
· IP address
· Website usage patterns
· Date and time of access

We use reasonable measures to ensure that any analytics or website technologies are configured appropriately for environments involving healthcare-related information.

7. Your Rights

Subject to applicable law and HIPAA requirements, individuals may have the right to:
· Request access to their information
· Request correction of inaccurate information
· Request restrictions on certain disclosures
· Request deletion where legally permissible
· Receive information regarding our privacy practices

Requests may be submitted using the contact information below.

8. Children’s Privacy

Our services are not directed toward children under the age of 13 without parental or guardian involvement. We do not knowingly collect personal information from children except as permitted by law or necessary for healthcare-related services.

9. Third-Party Websites

Our website may contain links to external websites or services not operated by us. We are not responsible for the privacy or security practices of third-party websites.

10. Breach Notification

In the event of a data breach involving unsecured personal information or PHI, we will provide notifications as required under applicable federal and New Jersey law, including HIPAA breach notification requirements where applicable.

11. Changes to This Privacy Policy

We may update this Privacy Policy periodically to reflect operational, legal, or regulatory changes. Updated versions will be posted on this page with a revised effective date.

12. Contact Information

If you have questions regarding this Privacy Policy or our privacy and security practices, please contact us here