Privacy Policy
Last updated:
Overview
Privacy matters to us, and the people who reach this practice tend to have more reason than most to care about who sees what. This policy lays out how we handle information collected through this website (drmantonya.com).
Information we collect
This site is mostly informational. These are the places where we pick up data:
- Contact form submissions. If you use the contact form, we collect your name, email address, service interest, and message content. We use that to reply and, as described under "Our own visit records" below, to follow up and fix problems.
- Email correspondence. If you write to us at contact@drmantonya.com, we keep the thread so we can deliver what you've asked for.
- Private intake and booking pages. If we send you a link to our secure intake or booking page, the information and documents you submit there go directly into our HIPAA-standard practice systems. Third-party analytics are disabled on those pages. To help us fix problems and follow up, those pages keep a basic progress record (for example, which step was reached, when, and whether a submission went through) under a random number stored in your browser, and, once you have a private link, under that link's code. Our website's hosting provider also keeps operational records tied to that code: steps reached, error records, the appointment time you picked, and payment status and references (never card numbers). These records do not contain your answers or documents, record nothing you type until you choose to send it, and are not shared with any analytics or advertising service.
- Our own visit records. Like most websites, we keep a record of how our site is used: which pages are visited and how they are used, how visitors arrived, the device and browser, and the IP address with the approximate location that comes with it. If you send us a message or a form, that record is linked to it so we can follow up with you and troubleshoot problems. We do not sell this information or share it with advertisers.
- Site analytics. On our public informational pages we use Google Analytics and Microsoft Clarity to understand which pages help visitors (pages visited, general region, how the page is used). We do not use this data for advertising, and it is never joined to any client record.
Information we do not collect
- No advertising cookies, and no use of your information for advertising. Analytics cookies (see "Site analytics" above) measure how our public pages are used, such as visits, clicks and scrolling, and are disabled entirely on our private intake and booking pages.
- No sale of personal information, and no sharing of it for advertising. Service providers that help run the practice, such as email, scheduling, and payment processing, receive only what they need to do that work.
- This website is not directed to children, and we do not knowingly collect information from children through it. When an evaluation involves a minor, it is arranged through a parent, guardian, or attorney.
How we use information
Anything you send through the contact form or email is used for these purposes only:
- To respond to your inquiry.
- To answer questions about our professional services.
- To schedule a consultation if you've asked for one.
Clinical records
The public pages of this website do not collect or store clinical records. If we send you a private intake link, the answers and documents you submit there are stored in the practice's HIPAA-standard systems (Amazon Web Services and Google Workspace, each under a signed Business Associate Agreement). The public website itself does not keep a copy of your answers or documents (it keeps only the operational records described above). Clinical records created during professional services follow the Health Insurance Portability and Accountability Act (HIPAA), California law, and applicable professional ethics standards, and are covered by our Notice of Privacy Practices below, which you also receive and acknowledge on the private booking page.
Third-party services
The site uses these third-party services:
- Google Analytics (GA4). Page-visit measurement on public pages only. Advertising features are turned off. Not loaded on the private intake or booking pages.
- Microsoft Clarity. Usage measurement on public pages only. Not loaded on the private intake or booking pages.
Data security
This website is served over HTTPS with TLS encryption. We take reasonable steps to protect anything you send through the contact form.
Your rights (California residents)
The California Consumer Privacy Act (CCPA) applies to businesses above size thresholds this practice does not meet (California Civil Code 1798.140(d)), but you can still:
- Ask what personal information we hold.
- Ask us to delete it, except records the law requires us to keep.
- Count on us not to sell your personal information. We don't sell it.
Protection of immigration client records
Our practice works with immigration clients who carry privacy risks most clients never have to think about. The protections below apply to every evaluation record we handle.
Legal protections
- Confidentiality under California medical-privacy law (including the Confidentiality of Medical Information Act) limits when your mental-health information may be disclosed without your consent. Because a forensic evaluation is prepared for submission in an immigration case rather than for treatment, the psychotherapist-patient privilege recognized in Jaffee v. Redmond (518 U.S. 1, 1996) and California Evidence Code 1014 may not fully apply to it, so ask your immigration attorney about the protections for your specific records.
- Attorney work product protections may apply to evaluations prepared at the direction of an immigration attorney for use in a legal proceeding. These protections are limited and can be waived, for example when a report is filed with an immigration agency, so ask your attorney how they apply to your case.
- California Confidentiality of Medical Information Act (CMIA) goes further than federal HIPAA in limiting disclosure. We share medical information only with your written authorization or where the law permits or requires it; the notice of privacy practices below explains when. Ask your immigration attorney how these rules apply to your specific records.
Government access
- Immigration and Customs Enforcement (ICE) administrative subpoenas are not self-enforcing: if a recipient does not comply, the agency has to ask a federal court to enforce the subpoena.
- We do not share client records, client lists, appointment records, or the contents of an evaluation with Immigration and Customs Enforcement (ICE), U.S. Customs and Border Protection (CBP), or any other enforcement agency without your authorization, unless the law requires it. (Your evaluation report itself is prepared to be filed with United States Citizenship and Immigration Services (USCIS) or the immigration court — that filing happens with your authorization, through you and your attorney.)
- Any subpoena or demand that arrives is reviewed with legal counsel before we respond, including whether a privilege or a legal objection applies.
- Violence Against Women Act (VAWA) cases sit under an extra layer of protection: 8 United States Code (U.S.C.) 1367 generally prohibits government officials from disclosing information about VAWA applicants, with exceptions listed in the statute.
Technical safeguards
Client records are kept in the practice's HIPAA-covered systems (Amazon Web Services and Google Workspace, each under a signed Business Associate Agreement), which encrypt data in storage and in transit. We use reasonable administrative, technical, and physical safeguards to protect them. Reports go only to the people you authorize in writing, unless the law requires otherwise (see section 4).
Your client's evaluation records are kept confidential and encrypted, and we do not share them with immigration enforcement without authorization, unless the law requires it. An immigration enforcement administrative subpoena is not self-enforcing, and any demand is reviewed with counsel before we respond. For how these protections apply to a specific case, the client's immigration attorney is the right guide.
Notice of Privacy Practices (HIPAA)
THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.
This notice is given under the Health Insurance Portability and Accountability Act (HIPAA) and California law. It applies to Dr. Julia Mantonya, Licensed Psychologist (California license PSY28494), and everyone who works with her practice. Effective date: September 24, 2026.
1. Our legal duties
We are required by law to keep your protected health information private, to give you this notice of our legal duties and privacy practices, and to notify you if a breach of your unsecured protected health information occurs. We must follow the terms of the notice currently in effect. Protected health information is information that identifies you and relates to your health, the services you receive, or payment for them.
2. How an evaluation is different
Our main service is a forensic psychological evaluation that you or your attorney request for a legal purpose. It is not treatment. The written report is prepared to be shared with the person or agency you choose, such as your attorney, an immigration agency, or a court. We release the report only with your written authorization, and you decide who receives it, except where the law requires disclosure (see section 4).
3. Treatment, payment, and our operations
The law lets us use and share your information for these purposes without a separate authorization. Treatment: for example, if you ask for a referral, we may share information with a therapist or doctor who will care for you. Payment: for example, our payment processor receives what it needs to process your payment. We do not bill health insurance. Operations: for example, we may review our own work for quality, and companies that provide services to us, such as secure email, record storage, scheduling, and interpretation, may handle your information for us. The law requires them to protect it. Where California law gives you more protection than federal law, we follow California law.
4. Other uses and sharing the law permits or requires
In limited situations the law permits or requires us to use or share information without your authorization. We share only what the law allows, and where California law is stricter we follow it. These situations are: when a law requires it; to report suspected abuse or neglect of a child, an elder, or a dependent adult, as California law requires; to prevent or lessen a serious threat to someone's health or safety, including warning a reasonably identifiable victim of a serious threat of violence; for public health activities; for health oversight, such as audits, investigations, or licensing reviews by the California Board of Psychology; in lawsuits and legal proceedings, in response to a court order, or to a subpoena or other lawful request as the law allows; to law enforcement, as the law requires or allows; to a coroner, medical examiner, or funeral director; for research approved under privacy safeguards; for organ, eye, or tissue donation; for workers' compensation, as the law allows; for special government functions such as military, national security, and protective services, as the law allows; to a family member or other person you name who is involved in your care, if you agree or do not object; and to the U.S. Department of Health and Human Services when it checks our compliance with privacy law.
5. Substance use disorder records
If we receive records from a federally assisted substance use disorder program covered by 42 Code of Federal Regulations (CFR) Part 2, or testimony describing what they contain, we will not use or share them in civil, criminal, administrative, or legislative proceedings against you unless you give written consent, or a court orders it after you or the record holder are given notice and a chance to be heard, as 42 CFR Part 2 provides. A court order authorizing use or disclosure must be accompanied by a subpoena or other legal requirement compelling disclosure before the record is used or shared.
6. Uses that need your written authorization
We need your written authorization for any use or sharing not described in this notice. Examples: sending your report or records to your attorney, an agency, or anyone else you choose; most uses and sharing of psychotherapy notes (a clinician's separate private notes, if any exist); marketing; and any sale of your information. We never sell your information or use it for marketing. You may revoke an authorization in writing at any time, except to the extent we have already acted on it.
7. Information shared outside this practice
Once we share information as you authorize or as the law allows, the person or agency that receives it may share it again, and it may no longer be protected by federal privacy law. For example, a report filed with an immigration agency or a court becomes part of that agency's or court's records.
8. Your right to see and get a copy of your records
You may ask to see or get a copy, on paper or electronically, of the information we keep about you. Ask in writing. We will respond within the time federal and California law require, and we may charge a reasonable, cost-based fee. In limited situations the law allows us to deny access; if we do, we will explain why in writing and tell you how to ask for a review.
9. Your right to ask us to correct your records
If you believe information we keep about you is wrong or incomplete, you may ask us in writing to correct it and say why. We may say no, but if we do we will explain why in writing, and you may add a statement of disagreement to your file.
10. Your right to confidential communications
You may ask us to contact you in a specific way, for example only at a certain phone number, email, or mailing address, or not by certain channels. We will agree to all reasonable requests. This is how we honor the safe-contact choices you make on our forms.
11. Your right to ask us to limit what we use or share
You may ask us not to use or share certain information for treatment, payment, or our operations. We are not required to agree. If you pay for a service in full yourself, you may ask us not to share information about that service with your health insurer for payment or operations, and we will agree unless a law requires us to share it.
12. Your right to a list of disclosures
You may ask for a list of the times we shared your information during the six years before your request, who received it, and why. The list does not include sharing for treatment, payment, or operations, sharing you authorized, and certain other sharing the law excludes. We provide one list a year free; for more, we may charge a reasonable, cost-based fee.
13. Your right to a paper copy and to name someone to act for you
You may ask for a paper copy of this notice at any time, even if you received it electronically. If you have given someone medical power of attorney, or someone is your legal guardian, that person may exercise your rights and make choices about your information.
14. Changes to this notice
We may change the terms of this notice, and a change will apply to all information we keep about you. The current notice is posted on our website at drmantonya.com/privacy, and we will give you a copy on request.
15. Complaints
If you believe your privacy rights have been violated, you may complain to us using the contact below, or to the U.S. Department of Health and Human Services, Office for Civil Rights, online at ocrportal.hhs.gov, by email to OCRComplaint@hhs.gov, or by mail to Centralized Case Management Operations, U.S. Department of Health and Human Services, 200 Independence Avenue S.W., Room 509F HHH Bldg., Washington, D.C. 20201. You may also contact the California Board of Psychology at (866) 503-3221. We will not retaliate against you for filing a complaint.
16. Who to contact
For questions about this notice, or to use any of the rights above, contact our privacy officer: Dr. Julia Mantonya, (818) 351-3354, contact@drmantonya.com.
Contact
For privacy questions or to exercise your rights, write to us at contact@drmantonya.com.
Changes to this policy
We will update this policy when something material changes. The updated date at the top of the page is the source of truth.