Our Privacy

I am very aware (perhaps hyperaware!) of online privacy. Therefore, all of the programs I use to communicate with you are as privacy-focused as possible. I provide links to programs so you can read more, and I gain no financial benefits from you reading more.

All external links open in a new tab.

Service	What It's Used For	How Your Privacy Is Protected	What Information It Receives About You
DocuSealSelf-hosted	Filling out and e-signing practice consent forms	Self-hosted on my encrypted server.	Only what you directly provide: form responses and your signature; server logs for HIPAA compliance
Ivy Pay	Financial contribution collection	HIPAA-compliant with a signed Business Associate Agreement. Data encrypted in transit and at rest. PCI-DSS compliant for payment security.	Your initials, phone number, payment information, session date/time, and diagnostic code if needed for insurance reimbursement
LimeSurveySelf-hosted	Intake and consent forms	Self-hosted on my encrypted server.	Only what you directly provide: form responses; server logs for HIPAA compliance
NextcloudSelf-hosted	Forms and hosting this site	Self-hosted on my encrypted server.	Only what you directly provide: form responses; server logs for HIPAA compliance
Nextcloud Talk	Privacy-first virtual meetings	Self-hosted on my encrypted server. End-to-end encrypted calls.	Only what you directly provide during the call; server logs for HIPAA compliance
Proton Calendar	Calendar and scheduling	End-to-end encrypted. Event titles, descriptions, locations, and attendees are encrypted — even Proton cannot read them. Based in Switzerland under strong privacy laws.	Event start/end times and recurrence rules (needed to send notifications); your name and email address; all other event details are encrypted
Proton Drive	Shared document folder between usFor supervision and consultation only	End-to-end encrypted. Proton cannot read the contents of your files. Based in Switzerland under strong privacy laws.	Your email address (to share the folder); file metadata (names, sizes, timestamps)
Proton Mail	Email communication	End-to-end encrypted between Proton users. Zero-access encryption means even Proton cannot read your emails. No ads, no tracking.	Your email address, message content, and metadata (sender, recipient, timestamps)
Proton Meet	Default virtual meetings	End-to-end encrypted using Messaging Layer Security (MLS). Proton cannot access call contents. No tracking, no data collection, no AI training.	Minimal metadata; call contents are fully encrypted and inaccessible to Proton
SignalSecure messaging	Preferred between-session communication	End-to-end encrypted by default. Open source and independently audited. Signal cannot read your messages. Messages can be set to auto-delete.	Your phone number; the date you registered; the date you last connected.
SnikketXMPP · Self-hosted	Client communication	Self-hosted on my encrypted server. End-to-end encrypted using OMEMO.	Only what you directly provide: messages and any files you send; server logs for HIPAA compliance

This policy explains how I collect, use, and protect your personal information in the context of our therapeutic work together.

What Information I Collect

In the course of providing therapy services, I may collect the following types of information:

• Your name, contact information (phone number, email address), and emergency contact
• Scheduling and appointment information
• Intake forms, consent documents, and session notes
• Payment information (processed through a HIPAA-compliant third party)
• Communication content (emails, messages, and voicemails related to your care)

I do not collect any information beyond what is necessary to provide care and meet legal obligations.

How Your Information Is Used

Your information is used solely for the purpose of providing and coordinating your care. This includes:

• Scheduling and managing appointments
• Communicating with you between sessions
• Storing intake forms and signed documents
• Processing payment for services
• Meeting mandatory reporting and legal obligations as required by Colorado law

I do not sell, rent, or share your information with any third party for marketing or commercial purposes.

How Your Information Is Protected

I am a HIPAA-covered provider. All electronic protected health information (ePHI) is stored on hardware I own and control, encrypted at rest and in transit. The digital services I use in my practice have been selected for their privacy and security practices, as detailed in the Technology and Our Privacy section above.

Key protections include:

• All stored ePHI is encrypted on a LUKS-encrypted drive on my own server — no cloud provider holds your health data
• Business Associate Agreements (BAAs) are in place with all third-party vendors that handle ePHI
• All devices used for practice-related work require authentication to access
• Proton Mail and Proton Drive use end-to-end and zero-access encryption; even Proton cannot read your files or messages

Email and Messaging

Standard email and SMS are not secure channels. If you contact me through a standard email address or a non-encrypted text, I will respond but cannot guarantee confidentiality on your end.

For sensitive communication, I use and recommend:

• Signal — end-to-end encrypted messaging, my preferred between-session channel
• Proton Mail — fully encrypted email when both parties use Proton
• Snikket — self-hosted, end-to-end encrypted XMPP messaging

Video Sessions

All video session platforms I use are HIPAA-compliant and covered by a signed BAA. You have the option to choose the platform that works best for you — accessibility matters as much as privacy.

Your Rights

Under HIPAA, you have the right to:

• Access your health information
• Request corrections to your records
• Receive an accounting of disclosures of your information
• Request restrictions on how your information is used or shared
• Receive a copy of this Notice of Privacy Practices
• File a complaint if you believe your privacy rights have been violated

To exercise any of these rights, contact me directly at perri@guidedwanderings.com.

Data Retention and Disposal

Client records are retained for a minimum of seven years following the end of treatment, or seven years after a minor client turns 18, whichever is later — as required by Colorado law. When records are no longer required to be retained, they are securely deleted or physically destroyed.

Breach Notification

In the unlikely event of a data breach involving your protected health information, I will notify you in writing within 60 days of discovering the breach, as required by the HIPAA Breach Notification Rule. The notification will describe what happened, what information was involved, steps I have taken, and what you can do to protect yourself.

Changes to This Policy

I may update this policy from time to time. The date at the top of the page reflects when it was last revised. Material changes will be communicated to active clients directly.

Effective Date: July 2, 2026

This notice covers the HIPAA provisions that apply to Guided Wanderings. Items in red are additional protections beyond what HIPAA requires. Any crossed-out text does not apply to your care here but is preserved for educational purposes, unless otherwise noted in italics.

In this notice, your "health information" means records pertaining to your verbal disclosures and recovery efforts.

Your Rights and Choices

You have the right to:

• Consent to most uses and disclosures of your health information
• Get a copy of your paper or electronic medical record
• Correct your paper or electronic medical record
• Request confidential communication
• Ask us to limit the information we share
• Get a list of those with whom we've shared your electronic records
• Get a copy of this privacy notice
• Choose someone to act for you
• File a complaint if you believe your privacy rights have been violated
• Discuss this notice with Dr. Perri

You also have choices in how we use and share your information when we:

• Share information with your family, close friends, or others involved in your care
• Treat you and provide mental health care
• Help with medical emergencies
• Run our organization
• Bill for services
• Share your information at your request
• Report about court-referred treatment
• Report violence towards others or Dr. Perri, and suspected child and at-risk adult abuse and neglect
• Respond to audits and evaluations
• Address workers' compensation, law enforcement, and government requests
• Respond to lawsuits and legal actions, only by court order and subpoena
• Comply with the law
• Redisclosure of your information to other HIPAA-covered entities

In all these circumstances, we must protect your information and limit how we use and share it.

To the extent that we have your substance use disorder patient records, subject to 42 CFR Part 2, we will not share that information for investigations or legal proceedings against you without (1) your written consent or (2) a court order and a subpoena.

Consent to Most Uses and Disclosures

For certain health information, you can tell us your choices about what we share. If you have a clear preference for how we share your information in the situations described below, talk to us. Tell us what you want us to do, and we will follow your instructions.

In these cases, you have both the right and choice to tell us to:

• Share information with your family, close friends, or others involved in your care or payment for your care
• Share information in a disaster relief situation
• Include your information in a hospital directory

If you are not able to tell us your preference — for example, if you are unconscious — we may go ahead and share your information if we believe it is in your best interest. We may also share your information when needed to lessen a serious and imminent threat to health or safety.

Your psychotherapy notes are held to a higher standard of protection than other health information. We will not share your psychotherapy notes except in response to a court order and subpoena.

Get an Electronic or Paper Copy of Your Medical Record

You can ask to see or get an electronic or paper copy of your medical record and other health information we have about you. We will provide a copy or a summary of your health information within 30 days of your request. We may charge a reasonable, cost-based fee.

Correct Your Medical Record

You can ask us to correct health information about you that you think is incorrect or incomplete. We may say "no" to your request, but we'll tell you why in writing within 60 days.

Request Confidential Communications

You can ask us to contact you in a specific way (for example, home, office, or cell phone) or to send mail to a different address. We will say "yes" to all reasonable requests.

Ask Us to Limit What We Use or Share

You can ask us not to use or share certain health information for treatment, payment, or our operations. We are not required to agree to your request, and we may say "no" if it could affect your care. If we agree, we may still share this information in the event that you need emergency treatment.

If you pay for a service out-of-pocket in full, you can ask us not to share that information with your health insurer. We will say "yes" unless a law requires us to share that information.

Get a List of Those With Whom We've Shared Your Records

You can ask for a list of the times we've shared your health information for six years prior to the date you ask, who we shared it with, and why. We'll provide one accounting a year for free but will charge a reasonable, cost-based fee if you ask for another one within 12 months. We will provide the list within 30 days of your request.

Get a Copy of This Privacy Notice

You can ask for a paper or electronic copy of this notice at any time. We will provide it promptly.

Choose Someone to Act for You

If someone has authority to act as your personal representative — such as someone with your medical power of attorney or your legal guardian — that person can exercise your rights and make choices about your health information. We will make sure the person has this authority before we take any action.

File a Complaint

You can complain if you feel Dr. Perri has violated your rights by contacting Dr. Perri using the information on page 1. You can also file a complaint with the U.S. Department of Health and Human Services' Office for Civil Rights: 200 Independence Avenue, S.W., Washington, D.C. 20201, 1-877-696-6775, or hhs.gov/hipaa/filing-a-complaint. We will not retaliate against you for filing a complaint.

Discuss This Notice With Dr. Perri

You can ask questions or obtain more information about this notice and our privacy practices by calling or emailing Dr. Perri.

How We Use and Share Your Information

Share information with your family, close friends, or others involved in your care — With your permission, we may share information about your condition with family members, friends, or others you identify as involved in your care or support.

Treat you and provide mental health care — We can use your health information and share it with other professionals who are treating you. This includes the core work we do together. I may share your session content with other licensed practitioners who are held to the same confidentiality and HIPAA protections as I am. (Purpose: to support my approach to supporting you!)

Help with medical emergencies — We can share your information during a bona fide medical emergency with the personnel and health care providers responding to your emergency, even when you are unable to consent. We can also share your identifying information to assist the FDA in notifying you or your doctor about unsafe products you may be using. I mitigate my participation in notifying carceral systems by working with you to make plans to mitigate self-harm, including substances and behaviors.

Run our organization — We can use and share your health information to run our practice, improve your care, and contact you when necessary.

Bill for services — We can use and share your health information to bill and get payment from health plans or other entities.

Share your information at your request — You may provide a single consent for all future uses or disclosures for treatment, payment, and health care operations purposes. You may provide consent for more limited purposes; however, doing so may affect the services we can provide you or how you pay for services. You may provide a general consent to share your information through certain third parties, such as a health information network or a research institution.

Report about court-referred treatment — If your participation in treatment has been ordered by a court, we may be required to report your attendance and participation to the referring court or supervising agency. A release of information will be signed by you prior to any contact with court-ordered contacts. You have the right to refuse this reporting and to revoke the release of information at any time; however, refusing may have legal or court-related consequences, such as being found in violation of your probation. This only applies if you have substance use disorder records with us covered under 42 CFR Part 2.

Report violence towards self, others, and children and at-risk adults — While I am required by law to report suspected abuse and neglect of children and at-risk adults, threats or actual acts of violence towards yourself, others, and Dr. Perri, I prioritize supporting people to meet their needs before making a report.

Respond to audits and evaluations — We can use or share your information to improve the quality of our services, obtain needed credentials, and cooperate with oversight agencies authorized by law, as long as those who view or receive the information agree to destroy or return it when finished and agree not to use it against you.

• Quality of our services: review by auditors to ensure that the care you received meets clinical and professional standards
• Obtain needed credentials: confirm that providers meet the standards required to practice or to be reimbursed by insurers
• Cooperate with oversight agencies: verify that the services billed actually happened, were clinically appropriate, and were delivered by a qualified provider

Address workers' compensation, law enforcement, and government requests — We can use or share health information about you with a signed release of information:

• For workers' compensation claims
• For law enforcement purposes or with a law enforcement official
• With health oversight agencies for activities authorized by law
• For special government functions such as military, national security, and presidential protective services

Respond to lawsuits and legal actions — We must follow certain procedures before using or sharing your information for investigations and legal proceedings.

• We will not use or share your information or provide testimony about your information in any civil, administrative, criminal, or legislative proceedings for or against you unless accompanied by a court order and subpoena or other similar legal mandate requiring us to comply.
• We will only use or share your information in proceedings for or against you based on a court order after we have received notice and an opportunity to be heard, or you tell us that you have received notice.
• You have the right to seek to overturn or change the court order after you learn about it.

Comply with the law — We will not share your information with the Department of Health and Human Services or any other third party for legal or compliance purposes without a court order and subpoena.

Aid scientific research — We can use or share your information to conduct or help with health research. Researchers cannot include any patient identifying information in their reports about the research. We will not give your information to researchers or use your information for research without your written consent.

Redisclosure — When you consent to uses and disclosures for all future treatment and payment purposes and to run our business, we may share your information with other health care providers and health care businesses for those activities. If the person who receives it is subject to HIPAA, then they are allowed to use and share your information again without your consent for the purposes that HIPAA allows. Your information still cannot be used in legal proceedings against you unless (1) you consent or (2) based on a Part 2 court order and a subpoena (or similar legal requirement).

Our Responsibilities

• We are required to obtain your consent for most uses and sharing of your information.
• We are required by law to maintain the privacy and security of your protected health information.
• We will let you know promptly if a breach occurs that may have compromised the privacy or security of your information.
• We must follow the duties and privacy practices described in this notice and give you a copy of it.
• We will not use or share your information other than as described in this notice unless you tell us we can in writing. If you tell us we can, you may change your mind at any time. Let us know in writing if you change your mind.

For more information: hhs.gov/ocr/privacy/hipaa/understanding/consumers/noticepp.html

Other Instructions

• Contact Dr. Perri Corvino, LCSW, LAC for records requests.
• Record requests may take up to 30 business days to generate and transmit.
• Records will only be sent via encrypted email or document exchange.
• The information we can share about you for treatment is limited to: assessment summary, participation in psychotherapy, psychotherapy summary, summary of clinical assessment, diagnosis(es), support needs for accommodations, end of psychotherapy summary, and clinical recommendations for further care.

Changes to This Notice

We can change the terms of this notice, and the changes will apply to all information we have about you. The new notice will be available upon request and on this website.

Effective Date: July 2, 2026

This notice covers the 42 CFR Part 2 provisions that apply to Guided Wanderings. You will notice similarities and differences between this notice and the HIPAA notice. 42 CFR Part 2 provides additional protections and requires more acts of client consent than HIPAA. Any crossed-out text does not apply to your care here but is preserved for educational purposes, unless otherwise noted in italics.

In this notice, your "health information" means records pertaining to your substance use disclosures and recovery efforts.

Your Rights and Choices

You have the right to:

• Consent to most uses and disclosures of your health information
• Get a copy of your paper or electronic medical record
• Correct your paper or electronic medical record
• Request confidential communication
• Ask us to limit the information we share
• Get a list of those with whom we've shared your electronic records
• Get a copy of this privacy notice
• Choose someone to act for you
• File a complaint if you believe your privacy rights have been violated
• Discuss this notice with Dr. Perri

You also have choices in how we use and share your information when we:

• Share information with your family, close friends, or others involved in your care
• Treat you and provide mental health care
• Help with medical emergencies
• Run our organization
• Bill for services
• Share your information at your request
• Report about court-referred treatment
• Report violence towards others or Dr. Perri, and suspected child and at-risk adult abuse and neglect
• Respond to audits and evaluations
• Respond to lawsuits and legal actions, only by court order and subpoena
• Comply with the law
• Redisclosure of your information to other HIPAA-covered entities

In all these circumstances, we must protect your information and limit how we use and share it.

We will not share your substance use disorder patient records for investigations or legal proceedings against you without (1) your written consent or (2) a court order and a subpoena.

Consent to Most Uses and Disclosures

For certain health information, you can tell us your choices about what we share. If you have a clear preference for how we share your information in the situations described below, talk to us. Tell us what you want us to do, and we will follow your instructions.

In these cases, you have both the right and choice to tell us to:

• Share information with your family, close friends, or others involved in your care or payment for your care
• Share information in a disaster relief situation
• Include your information in a hospital directory

If you are not able to tell us your preference — for example, if you are unconscious — we may go ahead and share your information if we believe it is in your best interest. We may also share your information when needed to lessen a serious and imminent threat to health or safety.

Your psychotherapy notes are held to a higher standard of protection than other health information. We will not share your psychotherapy notes except in response to a court order and subpoena.

Get an Electronic or Paper Copy of Your Medical Record

You can ask to see or get an electronic or paper copy of your medical record and other health information we have about you. We will provide a copy or a summary of your health information within 30 days of your request. We may charge a reasonable, cost-based fee.

Correct Your Medical Record

You can ask us to correct health information about you that you think is incorrect or incomplete. We may say "no" to your request, but we'll tell you why in writing within 60 days.

Request Confidential Communications

You can ask us to contact you in a specific way (for example, home, office, or cell phone) or to send mail to a different address. We will say "yes" to all reasonable requests.

Ask Us to Limit What We Use or Share

You can ask us not to use or share certain health information for treatment, payment, or our operations after you have provided consent for all those purposes. We are not required to agree to your request, and we may say "no" if it could affect your care. If we agree, we may still share this information in the event that you need emergency treatment.

If you pay for a service out-of-pocket in full, you can ask us not to share that information with your health insurer. We will say "yes" unless a law requires us to share that information.

Get a List of Those With Whom We've Shared Your Records

You can ask for a list of the times we've shared your health information for six years prior to the date you ask, who we shared it with, and why. We'll provide one accounting a year for free but will charge a reasonable, cost-based fee if you ask for another one within 12 months. We will provide the list within 30 days of your request.

Get a Copy of This Privacy Notice

You can ask for a paper or electronic copy of this notice at any time. We will provide it promptly.

Choose Someone to Act for You

If someone has authority to act as your personal representative — such as someone with your medical power of attorney or your legal guardian — that person can exercise your rights and make choices about your health information. We will make sure the person has this authority before we take any action.

File a Complaint

You can complain if you feel Dr. Perri has violated your rights by contacting Dr. Perri using the information on page 1. You can also file a complaint with the U.S. Department of Health and Human Services' Office for Civil Rights: 200 Independence Avenue, S.W., Washington, D.C. 20201, 1-877-696-6775, or hhs.gov/hipaa/filing-a-complaint. We will not retaliate against you for filing a complaint.

Discuss This Notice With Dr. Perri

You can ask questions or obtain more information about this notice and our privacy practices by calling or emailing Dr. Perri.

How We Use and Share Your Information

Share information with your family, close friends, or others involved in your care — With your permission, we may share information about your condition with family members, friends, or others you identify as involved in your care or support.

Treat you and provide mental health care — We can use your health information and share it with other professionals who are treating you. This includes the core work we do together. I may share your session content with other licensed practitioners who are held to the same confidentiality and HIPAA protections as I am. (Purpose: to support my approach to supporting you!)

Help with medical emergencies — We can share your information during a bona fide medical emergency with the personnel and health care providers responding to your emergency, even when you are unable to consent. We can also share your identifying information to assist the FDA in notifying you or your doctor about unsafe products you may be using. I mitigate my participation in notifying carceral systems by working with you to make plans to mitigate self-harm, including substances and behaviors.

Run our organization — We can use and share your health information to run our practice, improve your care, and contact you when necessary.

Bill for services — We can use and share your health information to bill and get payment from health plans or other entities.

Share your information at your request — You may provide a single consent for all future uses or disclosures for treatment, payment, and health care operations purposes. You may provide consent for more limited purposes; however, doing so may affect the services we can provide you or how you pay for services. You may provide a general consent to share your information through certain third parties, such as a health information network or a research institution.

Report about court-referred treatment — If your participation in treatment has been ordered by a court, we may be required to report your attendance and participation to the referring court or supervising agency. A release of information will be signed by you prior to any contact with court-ordered contacts. You have the right to refuse this reporting and to revoke the release of information at any time; however, refusing may have legal or court-related consequences, such as being found in violation of your probation.

Report violence towards self, others, and children and at-risk adults — While I am required by law to report suspected abuse and neglect of children and at-risk adults, threats or actual acts of violence towards yourself, others, and Dr. Perri, I prioritize supporting people to meet their needs before making a report.

Respond to audits and evaluations — We can use or share your information to improve the quality of our services, obtain needed credentials, and cooperate with oversight agencies authorized by law, as long as those who view or receive the information agree to destroy or return it when finished and agree not to use it against you.

• Quality of our services: review by auditors to ensure that the care you received meets clinical and professional standards
• Obtain needed credentials: confirm that providers meet the standards required to practice or to be reimbursed by insurers
• Cooperate with oversight agencies: verify that the services billed actually happened, were clinically appropriate, and were delivered by a qualified provider

Address workers' compensation, law enforcement, and government requests — We can use or share health information about you with a signed release of information:

• For workers' compensation claims
• For law enforcement purposes or with a law enforcement official
• With health oversight agencies for activities authorized by law
• For special government functions such as military, national security, and presidential protective services

Respond to lawsuits and legal actions — We must follow certain procedures before using or sharing your information for investigations and legal proceedings.

• We will not use or share your information or provide testimony about your information in any civil, administrative, criminal, or legislative proceedings for or against you unless accompanied by a court order and subpoena or other similar legal mandate requiring us to comply.
• We will only use or share your information in proceedings for or against you based on a court order after we have received notice and an opportunity to be heard, or you tell us that you have received notice.
• You have the right to seek to overturn or change the court order after you learn about it.

Comply with the law — We will not share your information with the Department of Health and Human Services or any other third party for legal or compliance purposes without a court order and subpoena.

Aid scientific research — We can use or share your information to conduct or help with health research. Researchers cannot include any patient identifying information in their reports about the research. We will not give your information to researchers or use your information for research without your written consent.

Assist with cause of death inquiries — We can share patient identifying information about a deceased patient as required or allowed by laws that collect information relating to cause of death.

Redisclosure — When you consent to uses and disclosures for all future treatment and payment purposes and to run our business, we may share your information with other substance use disorder treatment programs, doctors' offices, and health care businesses for those activities. If the person who receives it is subject to HIPAA, then they are allowed to use and share your information again without your consent for the purposes that HIPAA allows. Your information still cannot be used in legal proceedings against you unless (1) you consent or (2) based on a Part 2 court order and a subpoena (or similar legal requirement).

Our Responsibilities

• We are required to obtain your consent for most uses and sharing of your information.
• We are required by law to maintain the privacy and security of your protected health information.
• We will let you know promptly if a breach occurs that may have compromised the privacy or security of your information.
• We must follow the duties and privacy practices described in this notice and give you a copy of it.
• We will not use or share your information other than as described in this notice unless you tell us we can in writing. If you tell us we can, you may change your mind at any time. Let us know in writing if you change your mind.

For more information: hhs.gov/ocr/privacy/hipaa/understanding/consumers/noticepp.html

Other Instructions

• Contact Dr. Perri Corvino, LCSW, LAC for records requests.
• Record requests may take up to 30 business days to generate and transmit.
• Records will only be sent via encrypted email or document exchange.
• The information we can share about you for treatment is limited to: assessment summary, participation in psychotherapy, psychotherapy summary, summary of clinical assessment, diagnosis(es), support needs for accommodations, end of psychotherapy summary, and clinical recommendations for further care.

Changes to This Notice

We are required to follow the terms of this notice that are currently in effect. We can change the terms of this notice, and the changes will apply to all information we have about you. The new notice will be available upon request and on this website.