Privacy Policy

Effective Date: 02/23/2026

Introduction

This Privacy Policy describes our policies and procedures for the collection, use, and disclosure of your information when you use the Service. It also informs You about Your privacy rights and how the law protects You. We use Your Personal Data to provide and improve the Service. By using the Service, You agree to the collection and use of information in accordance with this Privacy Policy.

Interpretation And Definitions

Interpretation

The words of which the initial letter is capitalized have meanings defined under the following conditions. The following definitions shall have the same meaning regardless of whether they appear in singular or in plural.

Definitions

For the purposes of this Privacy Policy:

  • You refers to the individual accessing or using the Service, or the company or other legal entity on behalf of which such individual is accessing or using the Service, as applicable. Under GDPR, You may be referred to as the Data Subject or the User.
  • Company (referred to as either “the Company”, “We”, “Us” or “Our” in this Agreement) refers to Astra Psychiatry, located at Rye Brook, NY 10573-1354, Stamford, CT 06901-3299 and Frankford, DE 19945-3 948. For GDPR purposes, the Company is the Data Controller.
  • Affiliate means an entity that controls, is controlled by, or is under common control with a party, where “control” means ownership of 50% or more of the shares, equity interest, or other securities entitled to vote for election of directors or other managing authority.
  • Account means a unique account created for You to access our Service or parts of our Service.
  • Website refers to Astra Psychiatry, accessible from www.astrapsychiatry.com.
  • Service refers to the Website.
  • Country refers to: United States, New York, Connecticut and Delaware.
  • Service Provider means any natural or legal person who processes the data on behalf of the Company. It refers to third-party companies or individuals employed by the Company to facilitate the Service, provide the Service on behalf of the Company, perform services related to the Service, or assist the Company in analyzing how the Service is used. Under GDPR, Service Providers are considered Data Processors.
  • Third-party Social Media Service refers to any website or social network through which a User can log in or create an account to use the Service.
  • Personal Data is any information that relates to an identified or identifiable individual. Under GDPR, Personal Data includes any information relating to You such as a name, identification number, location data, online identifier, or factors specific to physical, physiological, genetic, mental, economic, cultural, or social identity. Under CCPA, Personal Data means any information that identifies, relates to, describes, or is capable of being associated with You.
  • Cookies are small files placed on Your computer, mobile device, or any other device by a website, containing details of Your browsing history on that website among its many uses.
  • Device means any device that can access the Service such as a computer, cellphone, or digital tablet.
  • Usage Data refers to data collected automatically, either generated by the use of the Service or from the Service infrastructure itself (e.g., the duration of a page visit).
  • Eligible Users refers to individuals who are at least 13 years old, or 16 years old where required by applicable data protection laws; this Website is not intended for or directed to individuals under the minimum legal age.
  • Data Controller (GDPR) refers to the Company as the legal person which determines the purposes and means of the processing of Personal Data.

Notice of Privacy Practices under HIPAA and Applicable State Privacy Law

Effective Date: September 2026

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

Our Commitment to Your Privacy

Astra Psychiatry (“Astra”) is an outpatient psychiatric practice that creates and maintains protected health information (“PHI”) about the care and services you receive. PHI may include symptoms, diagnoses, medications, treatment plans, psychotherapy-related information, laboratory and diagnostic information, communications, insurance and billing information, and other information relating to your health care.

Astra is required by law to maintain the privacy and security of PHI, provide this Notice describing its legal duties and privacy practices, notify affected individuals following a breach of unsecured PHI when notification is required, and follow the terms of the Notice currently in effect. Where applicable state law provides greater privacy protection than federal law, Astra will follow the more protective requirement.

How We May Use and Disclose Your Health Information

  • Treatment: Astra may use and disclose PHI to provide, coordinate, and manage your health care. This may include communication among Astra clinicians and with other treating professionals, pharmacies, laboratories, hospitals, primary care clinicians, therapists, specialists, consultants, and other health care entities when permitted by law. Astra may use PHI to coordinate referrals, consultations, medication management, laboratory monitoring, prior authorization activity, and continuity of care.

  • Payment: Astra may use and disclose PHI as permitted by law to obtain payment for services. This may include determining eligibility or benefits, obtaining authorization, submitting and correcting claims, responding to payer inquiries, coordinating benefits, communicating about patient-responsibility amounts, and performing lawful billing and collection activities.

  • Health Care Operations: Astra may use and disclose PHI for activities necessary to operate the practice and provide quality care, including quality assessment and improvement, clinical consultation and supervision, credentialing, compliance, auditing, billing administration, business planning, legal and regulatory activities, staff or contractor training, information-technology support, practice management, and evaluating or improving services.

Business Associates, Technology, and Operational Vendors

Astra uses third-party service providers and technology platforms in clinical and administrative operations. These may include electronic health records, patient portals, telehealth platforms, secure communications, electronic prescribing, laboratory interfaces, claims and eligibility services, payment processing, document management, scheduling, cybersecurity, and other operational systems. When an outside service provider creates, receives, maintains, or transmits PHI on Astra’s behalf and is a HIPAA business associate, Astra uses agreements and safeguards required by applicable law. Some entities involved in your care, such as health plans, pharmacies, laboratories, hospitals, and other health care providers, may be independent covered entities that maintain information under their own legal duties and privacy practices.

Other Uses and Disclosures Permitted or Required by Law

Astra may use or disclose PHI without your written authorization in circumstances permitted or required by federal or state law. Depending on the circumstances, these may include:

  • Public-health activities, including legally authorized disease reporting and certain medication or product-safety activities.

  • Reporting suspected abuse, neglect, exploitation, or other circumstances when reporting is required or permitted by law.

  • Preventing or reducing a serious and imminent threat to the health or safety of a person or the public when disclosure is legally permitted.

  • Health-oversight activities such as audits, investigations, inspections, licensure matters, and other authorized oversight.

  • Judicial or administrative proceedings and lawful legal process, subject to any heightened protections that apply to mental-health, psychotherapy, or substance-use information.

  • Law-enforcement disclosures when specifically permitted or required by law.

  • Coroners, medical examiners, funeral directors, workers’ compensation programs, and specialized governmental functions when applicable.

  • Research that satisfies applicable federal and state requirements.

  • Any other use or disclosure required by law.

Specially Protected Information

  • Psychotherapy Notes: Psychotherapy notes, as specifically defined under HIPAA, receive additional protection. Most uses or disclosures of psychotherapy notes require written authorization, subject to limited exceptions permitted by law. Routine progress notes, diagnoses, medication information, treatment plans, symptoms, safety assessments, and other documentation maintained in the medical record are generally distinct from “psychotherapy notes” as that term is defined under federal law.

  • Substance-Use-Disorder and Other Special Records: Certain substance-use-disorder records may receive additional protections under federal law, including 42 CFR Part 2, when those rules apply. State law may also provide enhanced protection to certain mental-health, HIV-related, genetic, reproductive-health, or other sensitive information. Astra will apply special protections when required.

Uses and Disclosures Requiring Your Authorization

Except as otherwise permitted or required by law, Astra will obtain your written authorization before using or disclosing PHI for purposes not described in this Notice. Written authorization is generally required for most uses and disclosures of psychotherapy notes, most marketing uses of PHI, and the sale of PHI. Astra does not sell PHI in the ordinary course of business. You generally may revoke a written authorization in writing, except to the extent action has already been taken in reliance on it.

Your Rights Regarding Your Health Information

  • Inspect and obtain an electronic or paper copy of PHI maintained in your designated record set, subject to legal exceptions and applicable timeframes.

  • Request an amendment if you believe information in your record is incorrect or incomplete. Astra may deny a request in circumstances permitted by law and will provide any explanation required by law.

  • Request reasonable confidential communications by a particular method or at a particular location.

  • Request restrictions on certain uses or disclosures for treatment, payment, or health care operations. Astra is not always required to agree unless law requires it.

  • Request that information about a specific health care item or service you paid for in full out of pocket not be disclosed to a health plan for payment or health care operations when the legal requirements for that restriction are satisfied.

  • Request an accounting of certain disclosures as provided by law.

  • Receive a paper copy of this Notice at any time, even if you previously received it electronically.

  • Have a legally authorized personal representative exercise applicable privacy rights on your behalf, after Astra verifies the person’s authority when appropriate.

Astra’s Responsibilities

Astra must maintain the privacy and security of PHI, follow the duties and privacy practices described in the Notice currently in effect, and notify you as required by law if a breach occurs that may have compromised the privacy or security of unsecured PHI. Astra will not use or disclose PHI for purposes not permitted by this Notice or applicable law unless you provide an authorization when one is required.

Questions, Privacy Requests, and Complaints

You may contact Astra Psychiatry with questions about this Notice, to exercise a privacy right, or to make a privacy complaint:

  • Practice Name: Astra Psychiatry

  • Privacy Contact: Client Services

  • Mailing Address: 1 Main St, PO Box 106, Frankford, DE 19945-9998

  • Telephone: (914) 764-2954

  • Email: clientservices@astrapsychiatry.com

  • Patient Portal: Available for existing patients to submit secure requests.

You may also file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights. Astra will not retaliate against you for exercising a privacy right or filing a complaint.

Changes to This Notice

Astra may revise this Notice and its privacy practices as permitted by law. A revised Notice may apply to PHI already maintained as well as information received in the future. The current Notice will be made available as required by law, including electronically and upon request.

A2P Messaging Compliance

We comply with all applicable A2P messaging regulations. This includes obtaining explicit consent from users before sending any promotional messages. Users will be informed of the frequency of messages, message costs (if any), and how to opt-out.

Consent for Messaging

By providing your phone number, you consent to receive SMS messages from us regarding our services, promotions, and updates. Consent to receive marketing messages is not required as a condition of purchasing any goods or services. You may opt-out at any time by following the instructions provided in the messages or by contacting us directly.

Data Collection

We collect your name, email address, mailing address, phone number, and relevant inquiry details when you contact us, complete an intake or consultation request, or opt in for communications. This information is collected directly through our secure website contact forms, clinical intake workflows, electronic patient portal, or direct communications with our practice.

Data Usage

We use your data solely for sending updates, promotions, and reminders related to our products or services.

Data Security

We prioritize the security of your Personal Data. We protect your data with secure storage measures to prevent unauthorized access. While no method of transmission over the Internet or electronic storage is entirely secure, we implement appropriate measures to protect your information.

Data Retention

We retain your information as long as you are subscribed to our SMS service. You may request deletion at any time.

Opt-Out

You may opt-out of receiving SMS messages at any time by replying “STOP” to any message you receive. Upon receiving your opt-out request, we will send a confirmation message and cease further communication to that number, except for administrative purposes.

Opt-Out Confirmation

You can send HELP for additional assistance, and you will receive a text including our Phone number, email, and website. We are here to help you.

Message and Data Rates May Apply

Your mobile carrier may charge fees for sending or receiving text messages, especially if you do not have an unlimited texting or data plan. Messages are recurring, and message frequency varies.

Non-Sharing Clause

We do not share your data with third parties for marketing purposes. Astra Psychiatry will not sell, rent, or share the collected mobile numbers.

Contact Information

Contact Astra Psychiatry at (914)-764-2954 for HELP or to STOP receiving messages.

Children’s Privacy

This Website is not intended for individuals under the age of 13. We do not knowingly collect personal information from anyone under the age of 13. If we become aware that a user under 13 has provided personal information, we will promptly delete such data from our systems.

In jurisdictions that require a higher minimum age for data collection—such as 16 under the General Data Protection Regulation (GDPR)—we comply with those laws and do not knowingly collect or process data from individuals under the applicable age threshold.

If you believe that we may have collected personal data from a child in violation of these policies, please contact us.

California Consumer Privacy Act (CCPA) Compliance

Your Rights Under the CCPA

If you are a California resident, you have specific rights regarding your personal information. This section describes your CCPA rights and explains how to exercise those rights.

Right to Know and Access

You have the right to request that we disclose certain information to you about our collection and use of your personal information over the past 12 months. Once we receive and confirm your verifiable consumer request, we will disclose to you:

  • The categories of personal information we collected about you.
  • The categories of sources for the personal information we collected about you.
  • Our business or commercial purpose for collecting that personal information.
  • The categories of third parties with whom we share that personal information.
  • The specific pieces of personal information we collected about you.