Website Privacy Policy

This is the website privacy policy for Sasha Flores Therapy (Horizons of Hope Counseling, PLLC) (this website). It describes the kinds of information this website may collect and how that information is handled.

This Website Privacy Policy is separate from the practice's HIPAA Notice of Privacy Practices. The HIPAA Notice of Privacy Practices describes how protected health information is handled within the clinical practice and is provided through the practice's designated clinical platform, SimplePractice. You can read it on the Notice of Privacy Practices page. This website policy is limited to the website itself.

Sasha Flores, LCSW-S, PMH-C, RYT-200 is the therapist responsible for this practice. Where this policy says "we," "us," or "this practice," it refers to the practice operating this website.

If you choose to use a form on this website, you may provide:

• Your name
• Your email address
• Your phone number
• The group or offering you're interested in
• A short message or note you choose to include, such as general availability or what you're hoping to discuss
• A confirmation that you are 18 or older, where relevant

You do not have to use these forms. The only information requested is what's needed to follow up with you or, for the retreat, to confirm you understand the interest and screening process.

The free-text message fields on this website are not intended for sensitive clinical information. Please keep your note general.

This website uses a built-in analytics feature that records basic, non-clinical information about visits, such as:

• The page path you visited (for example, /group-therapy)
• The referring page, if one was sent by your browser
• A randomly generated session identifier stored for the length of your browser session
• When a form is submitted, a record that the form was submitted (including which form and which group or offering, where relevant)

This information is stored with the website's platform provider (see "Service Providers" below). It is used in a limited way to understand which pages and offerings are being viewed. It is not used to build a profile of you for advertising.

Information submitted through this website is used to:

• Respond to your request and follow up about the service or group you asked about
• Send the practice communications you signed up to receive through the newsletter
• Process a retreat payment when you have been accepted and choose to pay through this website
• Understand, in a limited way, which pages and offerings are being viewed

Information is not sold. The practice does not use this website to share your information for advertising or remarketing purposes.

This website relies on a small number of services to operate. When you use this website, information may be processed by:

• Base44 — the platform that hosts this website, stores submitted form information, stores the limited analytics described above, and can send notification emails to the practice when a form is submitted.
• Mailchimp — used for the newsletter signup. When you subscribe, your email address is sent to Mailchimp so the practice can send you the emails you requested.
• hCaptcha — used on forms to help distinguish real people from automated submissions. When a form includes a captcha, hCaptcha may receive information about that interaction.
• Stripe — used to process retreat payments. When you pay through this website, Stripe receives the payment information needed to complete the transaction, such as your email address and payment details.
• SimplePractice — the practice's designated clinical platform. You leave this website to access SimplePractice, for example when booking a consultation or completing clinical intake. Clinical intake and clinical records are handled separately through SimplePractice and under its own terms.

Site resources such as fonts and images are delivered through Google Fonts and the Base44 media service. As part of delivering those resources, those services may receive ordinary network information, such as an IP address or browser User-Agent.

This website does not use Google Analytics, Meta/Facebook pixels, advertising pixels, remarketing tools, or session-replay tools. If that changes, this policy will be updated.

The website has several forms: a general group interest form, a Hill Country Retreat interest form, an organizational support inquiry form, and a retreat registration page for accepted participants. Each form asks for only what's needed to follow up with you.

When you submit a form, the information you enter is saved so the practice can review and follow up. A short notification may also be sent to the practice so the request isn't missed. The free-text note you add is available to the practice, and for some forms the note is intentionally not included in the notification email and is instead reviewed inside the practice's protected admin area.

Please keep what you share in these forms general. Do not include diagnoses, medical records, detailed trauma histories, treatment information, or other sensitive clinical information. If clinical information is needed, you'll be directed to the practice's designated clinical platform, SimplePractice.

The footer newsletter signup asks for your email address only. Submitting your email signs you up to receive occasional practice communications. Your subscription information is processed through Mailchimp. You can stop receiving these emails using the unsubscribe link included in them.

The retreat registration page lets accepted participants pay through Stripe. When you pay, Stripe receives the information needed to process the transaction, such as your email address and payment details. The information sent with the payment is limited to what's needed to complete it and manage your enrollment. Clinical information is not sent to Stripe.

The built-in analytics described under "Information Collected Automatically" records page visits and form submissions in a limited way. It is not an advertising or tracking network, and it is not used to follow you across other websites.

Technologies operating directly on this website include:

• Base44 — uses in-browser sessionStorage for this website's analytics session identifier, rather than setting long-lived tracking cookies for advertising.
• hCaptcha — loads on the website forms where a captcha is enabled.
• Google Fonts — loads site font resources from Google's servers.

Separate third-party websites you may be redirected to from this website include Stripe (for payments, after you leave this website) and SimplePractice (for consultation booking and clinical intake). Those services operate on their own websites and handle information under their own terms once you leave this website.

Server-side processing includes the Mailchimp newsletter subscription, which is handled on the practice's behalf rather than through a script running on this website.

This website does not use Google Analytics, Meta/Facebook pixels, advertising pixels, remarketing tools, or session-replay tools. If that changes, this policy will be updated.

The practice takes reasonable steps to protect information submitted through this website. No website or online service can be guaranteed to be completely secure, and this policy does not claim that. Submission forms are protected against automated abuse with a combination of a hidden honeypot field, rate limiting, and, where enabled, a captcha. Access to submitted information within the practice is limited to authorized administrators.

This policy also does not claim that this website is "HIPAA compliant," and it does not represent that any third-party vendor is completely secure, encrypted, certified, or legally compliant. Sensitive clinical information is handled through the practice's designated clinical platform, SimplePractice, not through this website.

Website inquiry information, such as a group interest, retreat interest, organizational inquiry, or newsletter signup, may be retained as reasonably necessary to respond to the inquiry, administer the requested offering, maintain appropriate business records, or meet applicable legal obligations.

Submitting a general website inquiry does not, by itself, make that submission part of a psychotherapy clinical record. Clinical records are maintained separately through the practice's designated clinical systems and are subject to different legal and professional retention requirements.

Limited analytics information is retained for as long as is useful for understanding how the website is used.

The public inquiry and interest forms on this website are not intended for children to independently submit personal or clinical information. If services involving a minor are being considered, appropriate consent and clinical intake procedures are handled separately through the practice.

This website links to third-party services, including SimplePractice (for booking and clinical intake), Stripe (for payments), and Mailchimp (for the newsletter). This policy does not cover those services. Once you leave this website, the service you're visiting handles information under its own terms.

You can:

• Choose not to submit a form.
• Keep the free-text notes you do submit general and non-clinical.
• Unsubscribe from the newsletter using the link in any practice email.
• Ask the practice about information you've submitted by reaching out through the contact details below.

To book a consultation or begin clinical intake, you can also use the practice's SimplePractice client portal.

This policy may be updated to reflect how this website actually works. The "Last updated" date at the top of this page shows when it was last revised.

This Website Privacy Policy is effective as of August 25, 2026.