A Note Before You Read

At Alafiora, privacy is not a legal formality. It is a foundational expression of how we serve you. The people who find their way to this practice often carry experiences they have shared with very few others, and they deserve to know precisely how their information is handled before they ever reach out. This policy is written to be read, not archived. We encourage you to move through it thoughtfully, and to contact us at legal@alafiora.com with any questions.

Welcome

Welcome to Alafiora LLC ("Company," "we," "us," or "our"). This Privacy Policy ("Policy") describes how we collect, use, share, and protect your personal information when you visit our website at https://www.alafiora.com/ and any related subpages (the "Website"). By accessing or using our Website, you agree to the practices described in this Policy.

Alafiora LLC is a private psychological practice operated by a licensed psychologist. As a healthcare provider, Alafiora LLC is also a covered entity under the Health Insurance Portability and Accountability Act of 1996 (HIPAA). This Policy governs personal information collected through our Website and general business operations. The collection and use of Protected Health Information (PHI) generated in the course of clinical services is governed separately by our Notice of Privacy Practices, which can be accessed at the footer of this Website and is provided to all clients at the commencement of care. If there is any conflict between this Policy and our Notice of Privacy Practices regarding PHI, the Notice of Privacy Practices will control.

1. Purpose of This Policy

This Policy is designed to provide you with clear, transparent information about how your data is collected and handled, so that you can make informed decisions when engaging with us. It applies when you:

• Visit or browse our Website.

• Engage with any features on our Website, including contact forms, chat functionality, user submissions, or electronic messaging.

• Opt into email newsletters or marketing communications.

• Purchase services, digital products, or courses through our Website.

• Interact with our content or advertising on third-party websites or platforms.

This Policy does not govern data collected offline or through third-party websites and platforms, including affiliates or service providers. It does not replace or supersede our Notice of Privacy Practices, which governs the use of PHI in clinical contexts.

2. Who We Are and Our Commitment to HIPAA Compliance

Alafiora LLC is a private psychological practice providing specialized psychological services. As a HIPAA covered entity, we are committed to maintaining the privacy and security of all Protected Health Information in accordance with federal law. We require that any third-party service provider or vendor who may access PHI in connection with the services they provide to us execute a Business Associate Agreement (BAA) with Alafiora LLC prior to accessing any such information. We do not engage vendors for clinical operations unless this requirement is satisfied.

This Website is a public-facing digital platform and does not itself constitute a clinical service. Information submitted through this Website, including inquiry forms, is treated with the same discretion as clinical correspondence; however, the submission of information through a website contact form does not establish a therapeutic relationship with Dr. Esther Lapite-Garrett or Alafiora LLC.

3. Age Requirements

We do not knowingly collect or solicit personal information from individuals under the age of sixteen. If you are under sixteen, please do not submit any personal information through this Website. If we learn that we have inadvertently collected personal information from someone under sixteen, we will promptly delete it. To report a concern of this nature, please contact us at legal@alafiora.com.

4. Information We Collect

We collect various types of personal information, which may include:

• Personal Identifiers. Your name, email address, phone number, billing or mailing address, and similar identifying details.

• Financial Information. Payment details such as credit card or banking information, processed securely through third-party payment processors.

• Geolocation Data. IP address and location data transmitted by your device.

• Demographic Information. Age, gender, occupation, and similar characteristics, where voluntarily provided.

• Internet and Device Activity. Browser type, operating system, and browsing behavior on our Website.

• Authentication Data. Account credentials and security data, where applicable.

• Media. Photographs, videos, or other files you choose to upload to the Website.

This information is collected directly from you when you provide it, such as when completing a form or making a purchase, and automatically through cookies and other tracking technologies when you browse our Website.

5. Sources of Personal Information

Your personal information may be collected from the following sources:

• Directly from You, when you complete forms, subscribe to services, create an account, or submit inquiries through our Website.

• Payment Processors, such as Stripe or similar platforms, when you make a purchase or pay for services.

• Analytics Providers, such as Google Analytics, which help us understand how visitors interact with our Website.

• Social Media Platforms, if you connect your account or interact with our content on platforms such as LinkedIn or Facebook.

• Email Marketing Platforms, when you subscribe to a newsletter or download a resource.

• Advertising Networks, when you interact with our content on platforms such as Google Ads or similar services.

• Automated Data Collection, including cookies, web beacons, log files, and tracking technologies that record browsing behavior, device information, and related data.

6. Private Pay Practice and What It Means for Your Privacy

Alafiora LLC operates exclusively as a private pay practice. We do not bill insurance companies, submit claims to third-party payers, or participate in insurance networks of any kind. This means that your diagnostic information, treatment history, and session records are never transmitted to an insurance carrier or entered into a shared insurance billing system as part of your care at Alafiora.

Your payment records are maintained in our internal systems solely for the purposes of bookkeeping, documentation, and service delivery. They are not shared with third-party payers. If you choose to seek reimbursement from your insurance provider using a superbill we provide, the decision to share your clinical information with that insurer rests entirely with you, and we will make that choice clear at every relevant step.

For clients with meaningful privacy needs, this structure provides a meaningful distinction. Your engagement with this practice is not reported to any registry, insurer, or employer benefit system unless you direct it to be.

7. Telehealth, Electronic Communications, and Platform Security

Alafiora LLC provides psychological services through telehealth, utilizing HIPAA-compliant video conferencing and practice management platforms. The specific platforms we use may evolve over time as we continue to evaluate the best available options for privacy, security, and clinical quality. Platforms we have used or may use include, but are not limited to, CarePatron, Google Meet, Doxy.me, and Sessions Health. Regardless of which platform is in use at any given time, we require that all telehealth and practice management vendors meet HIPAA compliance standards and that Business Associate Agreements are in place before any PHI is processed through those platforms.

Standard email is not a fully encrypted medium. We encourage you to use the secure contact methods we make available for any communications that contain sensitive personal or clinical information. When you submit an inquiry through this Website, please be aware that general internet transmission carries inherent limitations in security. Our team will always respond through the most secure channel available.

Session Recording Policy. Sessions conducted through Alafiora are not recorded by Dr. Lapite-Garrett or any member of the practice without your explicit written consent. If you wish to request that a session be recorded, you must submit that request in writing and receive written authorization before recording begins. If you choose to record any portion of a session on your own device, you must notify Dr. Lapite-Garrett prior to doing so, and you bear full responsibility for the secure storage and appropriate handling of that recording. Unauthorized recording of sessions is not permitted.

Your Responsibilities During Telehealth. The security of a telehealth session depends on both parties. To protect the privacy of your session, we ask that you join from a private location where you cannot be overheard, use a secure and trusted internet connection, and avoid public Wi-Fi networks or shared devices when possible. Alafiora LLC is not responsible for privacy breaches that result from the use of an unsecured device, network, or environment on your end. By participating in telehealth services, you acknowledge these conditions and accept responsibility for your end of the session environment.

8. Artificial Intelligence and Automated Tools

Alafiora LLC does not use artificial intelligence in any form for clinical work. This includes, but is not limited to, AI-assisted session recording, AI-generated therapy notes, AI-driven intake screening, or automated AI systems for clinical decision-making. Your sessions are conducted, documented, and reviewed by Dr. Lapite-Garrett personally, using her own clinical judgment and professional training.

Where our Website or administrative operations incorporate any automated tools, those tools are evaluated for privacy compliance before deployment and are used only for non-clinical functions such as scheduling, website analytics, or marketing communications. If this practice changes in a material way, this Policy will be updated accordingly. We believe that the absence of AI from clinical work is not merely a preference but a reflection of the standard of care our clients deserve.

9. Limits of Confidentiality

While Alafiora operates with the highest standards of professional discretion, there are legal and ethical circumstances under which confidentiality has limits. These apply within the context of clinical services and are described fully in our Notice of Privacy Practices. We share them here in plain language as a matter of transparency:

• We are required by law to report suspected abuse, neglect, or exploitation of children, elders, or other vulnerable individuals to the appropriate authorities.

• We are required to take steps to protect the safety of an identifiable third party when a client presents a serious and credible threat of harm to that person.

• We are required to respond to a valid court order or subpoena compelling the disclosure of records or testimony.

• We may disclose information where necessary to prevent serious and imminent harm to a client or others.

Outside of these circumstances, what you share with us remains protected. These exceptions are not taken lightly. They reflect the ethical and legal responsibilities of a licensed psychologist, and they are handled with care, professionalism, and the minimum disclosure necessary.

10. Mental Health Records: Retention and Access

Clinical records maintained by Alafiora LLC are subject to federal HIPAA requirements and the specific mental health records laws of each state in which we are licensed to practice. We retain records for no less than the period required by applicable law, which may vary by state and by the age of the client at the time of service.

Requests to access, amend, or receive a copy of your records must be submitted in writing and will be processed in accordance with HIPAA and applicable state law. Please note that a request to delete personal information, while honored for website-related data where legally permissible, may not apply to clinical records where retention is required by law or is necessary for the ongoing protection of your health and safety.

If you wish to make a records-related request, please submit it through our Compliance Contact Form or by writing to us at legal@alafiora.com. We will respond within the timeframes required by applicable law.

11. Breach Notification

In the unlikely event of a breach of unsecured PHI, Alafiora LLC will respond in full accordance with the HIPAA Breach Notification Rule. This means we will notify affected individuals, the U.S. Department of Health and Human Services, and, where required, relevant media outlets, within the timeframes established by federal law. We will communicate clearly, promptly, and with the guidance of legal counsel. Any breach affecting website-related personal information will similarly be disclosed to affected individuals in a timely manner.

If you believe your information may have been compromised in connection with our Website or services, please contact us immediately at legal@alafiora.com or through our Compliance Contact Form.

12. Automated Data Collection: Cookies, Log Files, and Web Beacons

We use cookies and similar tracking technologies to enhance your experience on our Website and to understand how visitors engage with our content. The technologies we use include:

Cookies. Cookies are small data files placed on your device that often include an anonymous unique identifier. We use two types of cookies:

• Session Cookies, which are temporary and are deleted automatically when you close your browser.

• Persistent Cookies, which remain on your device between sessions to remember your preferences and improve your experience.

We use cookies in the following categories:

• Necessary and Essential Cookies are required for the Website to function. They enable core features and cannot be disabled without affecting your ability to use the site.

• Cookie Acceptance Cookies record whether you have acknowledged our cookie notice.

• Functionality Cookies allow the Website to remember choices you have made, such as language preferences or previously entered information, to provide a more consistent experience.

Log Files. Our servers automatically collect log files when you visit our Website. These files record information such as your IP address, browser type, internet service provider, referring and exit pages, and the date and time of your visit.

Web Beacons and Pixels. Certain pages of our Website and email communications may contain small electronic files known as web beacons, clear gifs, or pixel tags, which allow us to track page visits, email opens, and related engagement data.

You may manage or disable cookies through your browser settings. Please be aware that disabling cookies may affect certain features of the Website. To opt out of targeted advertising, you may visit https://optout.networkadvertising.org/?c=1 or https://optout.aboutads.info/. For information regarding Global Privacy Control (GPC) signals, please visit https://globalprivacycontrol.org.

13. Behavioral Advertising and Platform-Specific Opt-Outs

We may use your personal information to deliver targeted advertising or marketing communications that we believe may be of interest to you. If you wish to opt out of behavioral advertising delivered through specific platforms, you may do so directly through the following links:

• Google:https://www.google.com/settings/ads/anonymous

• Facebook / Meta:https://www.facebook.com/settings/?tab=ads

• Microsoft / Bing:https://advertise.bingads.microsoft.com/en-us/resources/policies/personalized-ads

Additionally, you may opt out through the Digital Advertising Alliance's opt-out portal at https://optout.aboutads.info/ or the Network Advertising Initiative at https://optout.networkadvertising.org/?c=1.

14. Third-Party Tracking and Affiliate Marketing

We may allow third-party cookies and tracking technologies to collect data about your browsing activity on our Website for marketing and analytics purposes, including retargeting. We may also participate in affiliate marketing programs through which we may receive compensation when visitors engage with partner offers. Tracking data may be shared with partners for this purpose.

15. Third-Party Websites

Our Website may contain links to external websites, resources, and organizations that are not operated or controlled by Alafiora LLC. This Privacy Policy applies exclusively to our Website. We are not responsible for the privacy practices, data collection methods, or content of any third-party site, regardless of whether we have linked to it. We encourage you to review the privacy policy of every external site you visit.

16. User-Generated Content and Intellectual Property

If you submit content through our Website or social media channels, including testimonials, reviews, or other creative works, you grant Alafiora LLC a non-exclusive, royalty-free, perpetual, and worldwide license to use, modify, distribute, and display that content for marketing and promotional purposes, subject to applicable confidentiality and privacy obligations.

Content you share publicly is shared at your own discretion. While we handle all submissions with care, we cannot control how other users or third parties interact with publicly available content.

17. Digital Products, Courses, and Membership Programs

When you purchase a digital product, enroll in a course, or join a membership program through our Website, we may collect and store additional information related to your progress, engagement, and completion history. This information is used solely to personalize your experience and ensure access to the resources you have purchased. It is stored securely and is not shared beyond what is necessary to operate the service.

18. How We Use Your Information

Your personal information may be used for the following purposes:

• To personalize your experience and tailor content, recommendations, and resources to your interests.

• To process transactions, including payments, and to facilitate the delivery of services or digital products.

• To communicate with you regarding your account, purchases, inquiries, or service updates.

• To deliver relevant marketing and promotional content where you have consented to receive it.

• To comply with legal obligations and protect the legal rights of Alafiora LLC.

• To analyze Website performance and improve our services and offerings.

• To track engagement with digital courses or membership programs and provide relevant support.

• To manage subscriptions, billing cycles, and account status.

• To support customer relationship management and deliver personalized service.

• To administer surveys, feedback forms, or other tools used to improve our practice.

• To manage and optimize advertising campaigns and marketing efforts.

• To generate testimonials or promotional materials where you have provided explicit consent.

19. Data Sharing, Disclosure, and the Question of Sale

We value your privacy and are committed to transparency in how your information is shared. Your personal data may be shared with:

• Service Providers who assist in the operation of our business, including payment processors, email marketing platforms, web hosting services, and analytics providers. All service providers who may access PHI are required to execute Business Associate Agreements with Alafiora LLC.

• Affiliates and Business Partners for purposes such as affiliate marketing or jointly offered programs, where relevant.

• Advertising Networks and Social Media Platforms to facilitate targeted advertising and campaign optimization.

• Legal Authorities when required by law, court order, or governmental process.

• Successor Entities in the event of a merger, acquisition, or restructuring, with appropriate notice to affected individuals.

• Non-Identifiable Aggregated Data may be shared freely for analytics, research, or marketing purposes, as it cannot reasonably be used to identify you.

We do not sell your personal information to third parties for direct financial compensation. However, in certain jurisdictions, the sharing of personal information with advertising networks or affiliate partners through tracking technologies may be considered a "sale" of personal data under applicable law, including the California Consumer Privacy Act (CCPA). If you wish to opt out of such sharing, please contact us at legal@alafiora.com or use the instructions provided on our Website.

20. Practice Jurisdiction and Scope of Services

Dr. Esther Lapite-Garrett provides psychological services exclusively within the states in which she holds active licensure at the time of service. Services are not provided to individuals located in states where she is not currently licensed or otherwise authorized to practice. The states in which she is licensed may expand over time; current licensure information is available upon inquiry. Nothing on this Website constitutes the provision of psychological services, and accessing this Website from any jurisdiction does not establish a clinical relationship or create an obligation on the part of Alafiora LLC.

21. Social Media, Online Reviews, and Professional Boundaries

To protect the privacy and dignity of all clients, Dr. Lapite-Garrett does not initiate or accept social media connection requests with current or former clients on personal platforms. If you choose to leave a review of Alafiora or Dr. Lapite-Garrett on a public platform, please be thoughtful about what personal details you share. We will never publicly acknowledge, confirm, or deny any individual's status as a client, including in response to publicly posted reviews. Our responses to any public feedback will honor the confidentiality of the therapeutic relationship above all other considerations.

22. Consumer Rights: GDPR, CCPA, and Applicable U.S. State Laws

You have meaningful rights regarding your personal data. Depending on your jurisdiction, these may include:

• Right to Access. The right to request access to the personal data we hold about you.

• Right to Correction. The right to request correction of inaccurate or incomplete data.

• Right to Deletion. The right to request deletion of your personal data, subject to legal exceptions, including those applicable to clinical records.

• Right to Opt Out. The right to opt out of the sale of your data or the use of your data for targeted advertising.

• Right to Data Portability. The right to request that your data be transferred to another provider in a portable format.

If you are a resident of the European Union or European Economic Area, you have additional rights under the General Data Protection Regulation (GDPR), including the right to restrict or object to our processing of your data. Please be aware that your information may be transferred to and processed in the United States, which may have data protection standards that differ from those in your home jurisdiction. We take steps to ensure such transfers comply with applicable law.

To exercise any of these rights, please contact us at legal@alafiora.com or submit a request through our Compliance Contact Form. Requests involving PHI will be handled in accordance with HIPAA and applicable state mental health confidentiality law, which may provide additional protections beyond federal standards.

23. Filing a Complaint

If you believe your privacy rights have been violated or have a concern about how your information has been handled, we encourage you to contact us directly at legal@alafiora.com or through our Compliance Contact Form so that we may address your concern promptly.

You also have the right to file a complaint with external regulatory authorities:

Federal Level The U.S. Department of Health and Human Services, Office for Civil Rights (OCR) investigates HIPAA-related privacy and security complaints. You may file a complaint at https://www.hhs.gov/ocr/complaints or by calling 1-800-368-1019. Filing a complaint with OCR will not affect your access to care or your relationship with this practice in any way.

State Level — New Mexico Complaints regarding the professional conduct of a licensed psychologist practicing in New Mexico may be submitted to:

New Mexico State Board of Psychologist Examiners P.O. Box 25101 Santa Fe, NM 87504 Phone: (505) 476-4890 Website: https://www.rld.nm.gov/boards-and-commissions/individual-boards-and-commissions/psychologist-examiners/

Other States As this practice expands its licensure over time, clients located in other states may locate the appropriate psychology licensing board for their jurisdiction through the Association of State and Provincial Psychology Boards (ASPPB) at https://www.asppb.net. ASPPB maintains a complete and current directory of all state and provincial psychology licensing and regulatory boards.

24. Data Retention

We retain your personal information for only as long as necessary to fulfill the purposes for which it was collected. Clinical records are retained for no less than the period required by the mental health records laws of each state in which we are licensed to practice, and may be retained longer where clinically or legally appropriate. Website-related data is retained in accordance with the terms of this Policy and applicable law. You may request deletion of non-clinical personal data by contacting us directly, except where retention is required by law.

25. Data Security

We implement administrative, technical, and physical safeguards designed to protect your information from unauthorized access, loss, or misuse. Our telehealth platforms, practice management systems, and communication tools are selected for HIPAA compliance, and Business Associate Agreements are in place where required.

No transmission of data over the internet is entirely without risk. We cannot guarantee absolute security, and we encourage you to protect your own account credentials and to use secure, private networks when communicating with us. If you have reason to believe that your information has been compromised, please notify us immediately at legal@alafiora.com.

26. Accessibility

Alafiora LLC is committed to maintaining a Website that is accessible to individuals with disabilities, in accordance with applicable standards including the Web Content Accessibility Guidelines (WCAG). If you encounter any accessibility barriers on our Website or require an accommodation to access our services or communications, please contact us at legal@alafiora.com and we will make every reasonable effort to assist you.

27. Do Not Track and Global Privacy Control

Our Website may recognize and respond to browser-initiated Do Not Track (DNT) signals or Global Privacy Control (GPC) signals. We cannot guarantee that all tracking will be fully disabled in all circumstances. For more information, please consult your browser's help documentation or visit https://globalprivacycontrol.org.

28. International Data Transfers

If you are located outside of the United States, please be aware that your personal information may be transferred to and processed in the United States or in other countries where our service providers operate. We take steps to ensure that such transfers comply with applicable data protection laws, including through standard contractual clauses or comparable legal mechanisms where required.

29. Changes to This Policy

We may update this Privacy Policy periodically to reflect changes in our practices, legal obligations, or the expansion of our services and licensure. The "Last Updated" date at the top of this page reflects the most current version. If material changes are made, we will notify you by email or through a notice posted on our Website. Your continued use of the Website following the posting of changes constitutes your acceptance of the updated Policy.

30. Contact Us

If you have questions about this Privacy Policy, wish to exercise your privacy rights, or need to report a concern, you may reach us through the following channels:

Email: legal@alafiora.com
Compliance Contact Form
Notice of Privacy Practices
Mail: 1209 Mountain Road Place Northeast, Suite R, Albuquerque, NM 87110, USA

All formal privacy requests, HIPAA-related concerns, and data rights inquiries should be submitted through our Compliance Contact Form for proper tracking and timely response.