Privacy policy
What we collect, why we collect it, who sees it, and how to make us delete it. Written to be read, not skimmed past.
In effect since September 2, 2026. This policy covers newyorkesaletter.org. Health information handled by our clinicians carries additional protections described on our HIPAA compliance page.
An inventory, not a wall of text
Most privacy policies bury the substance. Here is the whole picture in one table: what we hold, why we hold it, and how long it stays.
| What we hold | Why | How long |
|---|---|---|
| Name, email, phone, address | To schedule your consultation and address your letter correctly | With your clinical record |
| Screening answers and consultation notes | Because a clinician cannot evaluate you without them | At least six years, per New York record rules |
| Payment confirmation and last four card digits | To match a payment to a booking and process refunds | As long as tax and accounting law requires |
| IP address, browser and device type, pages visited | To keep the site working and detect fraud and abuse | Short-term server logs |
| Emails and chat messages you send us | To answer you and to resolve any later dispute | Until no longer needed for either |
Four things we do not do
- We do not sell your information. Not to advertisers, not to data brokers, not to lead generators. It is not a revenue line and will not become one.
- We do not run advertising trackers. No cross-site pixels following you around the internet after you leave.
- We do not contact your landlord, board, employer or university unless you have authorised it in writing and told us exactly what to send.
- We do not use your health information to market anything to you.
Cookies, in plain terms
The site sets cookies that are necessary for it to function: keeping your place during booking, and protecting the payment step against fraud. Where analytics are used they are configured to avoid collecting information that identifies you. You can block cookies in your browser and still read every page on this site; the booking and payment steps will stop working, because they genuinely depend on them.
Live chat
The chat widget in the corner of every page is operated by a third-party provider with its own privacy policy. Treat it as you would any support channel: fine for questions about booking, pricing or a letter you already hold, and not the place to type clinical details. Bring those to your consultation instead, where they travel over an encrypted, HIPAA-aligned channel.
Exercising your rights
Email support@newyorkesaletter.org with the subject "Privacy request". We verify who you are, then act within 30 days.
- Access — a copy of what we hold about you.
- Correction — fixing anything inaccurate.
- Deletion — removing what we are not legally required to keep. We will tell you specifically what falls into the retained category and why.
- Marketing opt-out — unsubscribe from any email. Transactional messages about your appointment and letter continue, since those are the service itself.
- Complaint — to us, to the New York State Attorney General's Consumer Frauds Bureau, or to the HHS Office for Civil Rights on health privacy specifically.
Security, stated honestly
Traffic runs over TLS with 256-bit encryption. Stored data is encrypted at rest. Access is restricted and logged. Vendors handling health information sign business associate agreements. What we will not tell you is that any of this makes a system unbreakable, because no system is. We review our controls, we patch, and we would tell you promptly if something went wrong.
Under 18
This service is built for adults. A minor who needs an evaluation must have a parent or legal guardian arrange and attend it. If you believe we hold information about a child collected without proper consent, write to us and we will delete it.
Changes
The effective date at the top always reflects the current version. Where a change materially affects you we will say so by email rather than quietly updating the page.
Privacy questions
Do you sell or share my data with advertisers?
No. Not to advertisers, data brokers or lead generators, and we do not run cross-site advertising trackers. Your health information is never used for marketing.
Is the live chat widget private?
It is operated by a third-party provider under its own privacy policy. Use it for booking, pricing and letter questions. Keep clinical details for your consultation, which runs on an encrypted, HIPAA-aligned channel.
Can I use the site with cookies blocked?
You can read every page. Booking and payment depend on functional cookies, so those steps will fail without them.
How do I get my data deleted?
Email support with the subject 'Privacy request'. We delete what we can. Clinical records must be retained for a period set by New York law and professional standards, and we will tell you exactly what that covers.
Who can I complain to about how you handle data?
Us first, so we can investigate. Beyond that, the New York State Attorney General's Consumer Frauds Bureau handles consumer data complaints, and the HHS Office for Civil Rights handles health privacy specifically.
Official sources for this page
Nothing legal on this page is asserted without a source behind it. Open them and read the originals rather than taking our summary on trust.
- Federal Trade Commission — Privacy and Security guidanceThe federal standard for how companies should handle consumer data and describe their practices.
- New York State Attorney General — Consumer issuesWhere New Yorkers raise concerns about how a business handles their data.
- HHS — HIPAA for IndividualsYour federal health privacy rights, which apply alongside this policy.
- FTC Consumer Advice — Online privacy and securityPractical federal guidance on protecting your own information online.
- FTC — Children's Online Privacy Protection RuleThe federal rule shaping our under-18 policy.
- CISA — Secure Our WorldFederal cybersecurity guidance on protecting your accounts and devices.
- HHS Office for Civil Rights — File a ComplaintThe federal route for health privacy complaints.