Privacy Policy

This Policy is about our website. It covers the contact form, the booking page, and the chat widget in the corner of the screen.

We keep this simple. We use website analytics and marketing tools — currently Google Analytics, including its advertising and measurement features — to understand how people find and use the Site and to improve and promote the Practice, and we may use similar tools over time. They are on unless you opt out, and you can opt out at any time — decline in the cookie banner, use the "Cookie settings" link in the footer, or turn on Global Privacy Control in your browser, which we honor automatically before anything loads — and only the essential cookies remain. We do not sell your information for money and we run no advertising-network pixel. What we will not tell you is that nothing about you reaches an advertising system, because that is not true while those features are on: Google receives the addresses of the pages you open, and several state privacy laws call that targeted advertising. Section 10 says what that means and how to switch it off. There is one line we never cross: we never send these tools your name, your contact details, or anything you type into a form or the chat widget.

Three more things reach other companies, explained in full below: the map on our contact page is a window into another company's service, and your browser talks to that company directly when it loads. The booking page reads and writes the practice's own Google Calendar so it can offer you real open times and put your appointment on the therapist's calendar. And the chat widget sends what you type to an outside AI service. That widget is not your therapist and is not a private clinical channel — please don't type health details into it.

If you are in crisis, this website cannot help you. Call or text 988. See "If you are in crisis" below.

Quez Therapeutic Solutions, LLC ("the Practice," "we," "us," "our") is an Ohio limited liability company owned by Joselyn Vasquez, LISW-S — a Licensed Independent Social Worker with Supervision Designation — who serves as its Clinical Director. The Practice provides individual, couples, and family therapy in Stow, Ohio, by telehealth across Ohio, and by telehealth to clients located in Florida, through the independently licensed behavioral health clinicians it engages (each, a "Clinician"). Each Clinician's name and credentials are published at https://queztherapy.com/therapists.

This Policy explains what happens to information you give us through our website at queztherapy.com (the "Site").

This Policy does not cover your treatment. Once you are a client, what you tell your clinician, your appointment history, your billing records, and your clinical chart are handled under separate and stricter rules. Those are described in our Notice of Privacy Practices, and they are protected by Ohio's confidentiality and testimonial-privilege protections for licensed independent social workers and by the licensing board's own confidentiality rules — independent of anything on this page. Nothing in this Policy weakens those protections, and website data and clinical records are not kept in the same place.

To the extent HIPAA applies to the Practice's clinical services, information created inside your care is governed by HIPAA and by the Notice of Privacy Practices rather than by this Policy.

Plainly, and verified against how the Site is actually built:

• We never share anything sensitive. The analytics and marketing tools we use never receive your name, your contact details, or anything about your health or the reasons you might seek care. They measure how the website is used, not who you are.
• No session recording or session replay. Nothing watches your mouse, records your scrolling, or plays back your visit.
• No sale of your information. No data brokers. Not for money, not for "partnerships." We do not sell or rent what we know about you.
• Your care is separate and stricter. Nothing about your treatment — your appointments, your billing, or your clinical chart — ever flows to an analytics or marketing tool. Those records live under the Notice of Privacy Practices, not this Policy.
• No account, no login, and no password for visitors. There is nothing to sign up for.

We built the Site so these claims stay true by default rather than by promise.

Ordinary web serving. Like every website, ours cannot deliver a page to you without your device's IP address and basic request information (such as your browser type and the page you asked for). Our hosting provider processes this as a technical necessity of putting the page on your screen. We do not use it to build a profile of you.

Abuse protection on the chat widget. To stop the chat widget from being flooded, our server briefly counts how many messages have come from a given IP address in the last 60 seconds. That count lives in the server's temporary memory, is not written to a database, and disappears on its own. It is a turnstile, not a profile.

Error records. When something breaks, our systems record a technical entry — for example, that a request failed and what status code came back — so we can find and fix it.

There is a chat widget available on the pages of this Site. Please read this section before you use it.

Essential cookies keep the Site working and remember your privacy choice — they are always set, because the Site cannot function without them. Analytics cookies are the only optional ones, and you are in control of them.

• Analytics and marketing — on unless you opt out. If you do not opt out, Google Analytics — including its advertising and measurement features — sets cookies that help us understand how the Site is found and used and reach people who might benefit from the Practice. These tools never receive your name, your contact details, or anything about your health. A banner tells you this on your first visit and lets you opt out; you can also opt out later from the "Cookie settings" link in the footer. Opt out and these cookies are not used, leaving only the essentials below.
• A browser-level opt-out is honored automatically. If your browser or a browser extension sends a Global Privacy Control signal, we read it as a decline before any tag loads, no banner interrupts you, and nothing has to be stored on your device to make it work. If you later choose to turn analytics back on from "Cookie settings", that later choice is yours and it governs.
• Your privacy choice. When you make a choice in the banner, we save it in a small cookie on your own device so we do not ask again. This one is essential.
• A staff sign-in cookie. A session cookie created when Practice staff sign in to the website's content-management system. It is never set for an ordinary visitor reading the public Site.
• A display preference. If you switch between light and dark appearance, your browser saves that single choice on your own device. It is never transmitted to us and is not used to identify you.
• Third-party embeds. The map (Section 7) may set or read its own cookies as part of its own operation, under its own policy. The booking page talks to Google Calendar from our server, not from your browser, so Google sets no cookies through it.

We keep this list short on purpose. The Site relies on outside companies only where it must:

We may also disclose information where the law requires it, or where it is necessary to protect someone's safety.

Links out. The Site links to our social media page. A link is just a link — nothing loads from that company until you click it, and once you do, you are on their site under their policy.

If you are in crisis, please reach out right now.

• Call or text 988 — the 988 Suicide & Crisis Lifeline. Free, confidential, 24/7.
• Text HOME to 741741 — Crisis Text Line. Free, 24/7.
• Call 911 if you or someone else is in danger or needs immediate medical attention.

You can also chat with the 988 Lifeline at chat.988lifeline.org.

Quez Therapeutic Solutions, LLC is not a crisis service. Our office is open Monday through Saturday, 9:00 a.m.–9:00 p.m., and we cannot respond to emergencies. If this is an emergency, use one of the resources above. When you are safe, we are here for what comes next — call 330-203-1559 or use the contact form.

• Contact-form messages: as long as reasonably necessary to respond to you, to run the Site, and to meet any legal or record-keeping obligation.
• Chat conversations: our server does not retain them at all (Section 5.4).
• Abuse-protection counts: seconds. They expire on their own (Section 4).
• Clinical and billing records, once you are a client: kept under the schedule described in our Notice of Privacy Practices and Ohio's record-retention requirements for licensed independent social workers — a longer and more protective framework than anything governing general Site data.

You can use this Site without giving us anything at all. Reading it requires no account and no personal information. The banner offers a one-tap way to turn analytics and advertising off; turning them off costs you nothing and the Site works exactly the same.

The browser signal. If your browser or a browser extension sends a Global Privacy Control signal, we treat it as an opt-out before anything loads. California's regulations at 11 Cal. Code Regs. § 7025 require a business subject to them to honor a signal like this, and Colorado, Connecticut, Texas, Montana, New Jersey, Delaware, and Oregon have followed. We honor it whether or not any of those statutes reaches a practice this size.

What we do, and what we do not do. We are specific here on purpose, because a comfortable sentence in this spot is how people get misled:

• We do not sell your personal information for money.
• We run no advertising-network pixel, tag, or conversion tracker — no Meta pixel, no LinkedIn tag, no TikTok tag, no remarketing pixel of any kind.
• We do not send an analytics or advertising tool your name, your contact details, anything you type into the contact form, anything you type into the chat widget, or any clinical, diagnostic, appointment, or billing information.
• We do run Google Analytics with its advertising features on unless you opt out, which means Google receives the addresses of the pages you open on this Site. Under the state privacy laws that use the term, that is targeted advertising; under California's, it is a share for cross-context behavioral advertising; and some of those statutes define "sale" broadly enough to reach a disclosure like it even where no money changes hands. Rather than tell you it is none of those things, we tell you what it is, and we give you the switch in three places — the banner, the "Cookie settings" link in the footer, and the browser signal above.

Why this matters more here than on most websites. A page address on this Site can name a condition. That makes the fact of your visit a reasonable inference about your health, which is the precise thing the Federal Trade Commission has pursued against telehealth and health-discount companies under Section 5 of the Federal Trade Commission Act, 15 U.S.C. § 45. A therapy practice should not make you read carefully to discover it. So it is in the summary at the top of this page, in the table in Section 7, and here.

Asking us about information you have already given us. If you sent us something through the contact form and you want to know what we hold, want it corrected, or want it deleted, ask us — Section 17. We will honor the request, and we will not treat you any differently for making it. Where a record is part of a clinical or billing file, the Notice of Privacy Practices governs instead, because those records carry retention duties we are not free to ignore.

We protect this Site with measures suited to what it actually holds, which is a contact form and a scheduling request rather than a clinical record. Traffic to and from the Site is encrypted in transit. The content-management system requires a named account, and staff accounts are provisioned individually rather than shared. Form submissions are protected by the bot challenge described in Section 7. The chat widget keeps nothing on our server at all — Section 5.4. Your clinical record is not stored on this website; it lives under the far stricter framework described in our Notice of Privacy Practices.

No system is perfect, and we will not claim otherwise. What we can promise is that we do not collect what we do not need, which is the one security measure that never fails.

If information is compromised, more than one deadline can apply to us at once, and we follow whichever protects you soonest.

One rule people expect to apply here does not, and we would rather explain it than let you assume it. The Federal Trade Commission's Health Breach Notification Rule, 16 C.F.R. Part 318, covers health apps and websites that HIPAA does not reach. It expressly excludes a HIPAA-covered entity from its definitions — 16 C.F.R. § 318.2. The Practice is a HIPAA-covered entity, so HIPAA's own breach rule governs us instead. That is a stricter standard, not a gap.

This is one website, but which law reaches it depends on who is reading. This section states our position on each framework, and then tells you what we do regardless of the answer.

Ohio. Ohio has no comprehensive consumer-privacy statute of general application; the Ohio Privacy Act bills introduced through 2026 have not been enacted. Ohio's breach statute, Ohio Rev. Code § 1349.19, does apply, and Section 12 describes how we follow it.

Florida. The Florida Digital Bill of Rights, Fla. Stat. §§ 501.701–501.813, applies only to a controller with more than one billion dollars in global gross annual revenues that also meets one of three further tests — half its revenue from online advertising, a smart-speaker business, or an app store with at least 250,000 applications. See Fla. Stat. § 501.702. None of that describes a therapy practice, so it does not reach us. Florida's breach statute, Fla. Stat. § 501.171, does. So do Florida's clinical confidentiality statutes, Fla. Stat. § 491.0147 and Fla. Stat. § 456.057, which reach your treatment information directly and are addressed in our Notice of Privacy Practices.

California, and the other states with comprehensive privacy statutes now in force. Twenty are in effect in 2026 — California's Consumer Privacy Act as amended, Cal. Civ. Code §§ 1798.100–1798.199.100, together with the statutes of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland, Rhode Island, Indiana, and Kentucky. Each carries a threshold keyed to revenue or to the number of consumers whose data a business processes, and a single-office practice serving two states does not meet them. We are not going to argue about thresholds. We extend all of the following to any visitor, from anywhere, as a matter of policy:

• Know what personal information we hold about you, and where it came from.
• Correct it if it is wrong.
• Delete it, subject only to records the law requires us to keep.
• Take a copy in a portable form.
• Opt out of targeted advertising and of any disclosure that could be characterized as a sale or a share — through the banner, through "Cookie settings," or through Global Privacy Control.
• Be left alone about it. We will not deny you service, charge you differently, or give you a lesser experience because you exercised any of these.
• Appeal. If we refuse a request, say so and a person will look again and answer you in writing within 45 days. If we refuse a second time, you may complain to your state Attorney General, and we will tell you how to do it.

We do not use your information for automated decision-making or profiling that produces a legal or similarly significant effect. There is no algorithm here deciding whether you get an appointment.

Consumer health data — Washington and Nevada. Washington's My Health My Data Act, Wash. Rev. Code ch. 19.373, and Nevada's consumer-health-data law reach an entity that conducts business in that state or offers products or services targeted to that state's consumers — see Wash. Rev. Code § 19.373.010(23). The Practice does neither. It may lawfully deliver care only to people located in Ohio or Florida, it holds no office elsewhere, and it does not direct this Site to residents of Washington or Nevada. Both statutes also exempt protected health information held under HIPAA. So neither reaches us — and the substance of what they require is what Sections 10, 11, and 12 already commit to: no sale of health data, an honest account of what goes where, and an opt-out that works.

The Site is operated in the United States, and information collected through it is stored and processed there. The Practice provides services only to people physically located in Ohio or Florida. It does not offer services to, market to, or monitor the behavior of anyone in the European Economic Area or the United Kingdom, and on that basis we do not believe the General Data Protection Regulation applies to us. If you are reading from outside the United States, understand that your information is processed in the United States under United States law, and please do not use this Site to seek care we cannot lawfully provide you.

The Site is intended for adults. It is not directed at children, and we do not knowingly collect personal information through the Site from a child. The Practice does see clients ages 7 and up — but that care is arranged by a parent or guardian through a person, not through this website. If you believe a child has sent us information through the Site, contact us and we will remove it.

If we change this Policy, we will post the revised version here and update the "Last updated" date at the top. If we ever make a change that materially affects what happens to your information, we will make that clear rather than quietly editing a line.

We do not publish an email address, and we do not accept intake by email. Email is not a secure or confidential channel for health information, and we would rather not invite you to use one.

Use any of these instead:

• The contact form on our contact page — the written channel for the Site.
• Phone: 330-203-1559 — office hours are Monday through Saturday, 9:00 a.m.–9:00 p.m.
• Mail: Quez Therapeutic Solutions, LLC · 3653 Darrow Rd, Ste 7, Stow, OH 44224

If your question is about your clinical record rather than the website, our Notice of Privacy Practices explains how to make that request.