Website Privacy Policy

Effective Date: August 14, 2026

This Website Privacy Policy explains how Haku Kauka LLC d/b/a Na Aliʻi o Ka Malu (“Na Aliʻi o Ka Malu,” the “Practice,” “we,” “us,” or “our”) collects, uses, discloses, and protects information when you visit https://www.naaliiokamalu.com and any webpages on that domain that link to this Policy (collectively, the “Website”), or when you communicate with the Practice through the general business channels identified on the Website.

This Policy applies to the public Website and information the Practice receives through general business communications. It does not govern third-party websites or platforms that you visit through links from the Website. Those third parties may provide their own privacy notices and terms. When a third-party platform processes information on behalf of the Practice, its handling of that information may also be subject to its agreement with the Practice, the Practice’s Notice of Privacy Practices, professional confidentiality requirements, and applicable law.

This Policy does not replace the Practice’s Notice of Privacy Practices, informed-consent documents, service agreements, or other clinical policies. Information created or maintained as part of a clinical or other professional service is governed by the applicable service agreement, the Notice of Privacy Practices, professional confidentiality requirements, and applicable federal and Hawaiʻi law. If this Policy conflicts with the Notice of Privacy Practices regarding protected health information, the Notice of Privacy Practices controls.

1. Information We Collect

The information we collect depends on how you interact with us.

Information You Provide Directly

The public Website does not contain intake, appointment-request, payment, or clinical-information forms. The Practice does not collect personal, clinical, scheduling, payment, or document information directly through the Website. If you select an appointment or service link, you will be redirected to SimplePractice, a separate platform authorized by the Practice, where any information needed to request, schedule, receive, or pay for services will be collected. Information submitted through SimplePractice is governed by the Practice’s Notice of Privacy Practices, applicable consent and service documents, the Practice’s agreement with SimplePractice, and applicable law.

If you contact the Practice through ordinary email, the information contained in that email is transmitted through email services rather than through the Website or SimplePractice. Please do not include sensitive clinical information in ordinary email.

Depending on how you communicate with us or use services linked from the Website, we may receive information that you voluntarily provide, including:

• Your name, email address, telephone number, mailing address, and preferred method of contact;
• Information included in an inquiry, email, message, consultation request, appointment request, registration, or other communication;
• Information needed to establish or administer a client or participant account, verify identity, schedule services, or provide requested information;
• Appointment, service, billing, transaction, and payment-related information;
• Documents, forms, electronic signatures, messages, and other information submitted through a secure client portal or another service authorized by the Practice; and
• Any other information you choose to provide.

Please do not send sensitive health information, detailed clinical information, Social Security numbers, financial account numbers, or urgent or emergency communications through the public Website, ordinary email, or social media. These channels are not intended for emergencies and may not be secure. When health or other sensitive information is needed, we may direct you to an authorized secure platform.

Clinical and Health Information

If you become a client or receive another professional service from the Practice, we may collect health, demographic, identity, family, cultural, appointment, payment, and other information needed to provide and administer that service. This information may be collected through SimplePractice, Spruce Health, telehealth technology, or another platform specifically authorized by the Practice.

Clinical records and protected health information are not governed solely by this Website Privacy Policy. Please review the Practice’s Notice of Privacy Practices and applicable informed-consent or service documents for more information about how such information may be used, disclosed, accessed, amended, retained, and protected.

Information Collected Automatically

When you visit the Website, our hosting, security, content-delivery, and technical service providers may automatically receive limited technical information, such as:

• Internet Protocol (IP) address;
• Browser type, device type, operating system, and language settings;
• Referring and exit pages;
• Date and time of access;
• Pages viewed, links selected, and general interaction or performance data;
• Approximate geographic location inferred from an IP address; and
• Security, diagnostic, error, and anti-fraud information.

The public Website currently uses Webflow for website hosting and delivery, Cloudflare for network security and rate limiting, and Google Fonts for typeface delivery. Cloudflare may set cookies that are necessary for security or rate limiting. When Google Fonts delivers a typeface, Google may receive technical request information such as an IP address, the requested resource, browser and operating-system information, and the referring webpage. These providers process information under their applicable terms and privacy notices.

The public Website does not currently use Google Analytics, Meta Pixel, or similar advertising or cross-site behavioral-analytics technologies. We do not permit third parties to collect personally identifiable information through the Website over time and across unaffiliated websites for targeted advertising. If our technology practices materially change, we will update this Policy and implement any notice, choice, consent, authorization, or contractual measures required by applicable law before the changed practice begins.

2. How We Use Information

We may use information to:

• Operate, maintain, secure, troubleshoot, and improve the Website and our services;
• Respond to questions, inquiries, and requests;
• Determine whether and how we may be able to provide a requested service;
• Schedule consultations or appointments and administer client, participant, or customer relationships;
• Create and manage secure portal access;
• Provide psychotherapy, psychological services, telehealth, Hoʻoponopono, consultation, education, training, workshops, or other requested services, as applicable;
• Process payments, maintain business and transaction records, and address billing questions;
• Send administrative communications, forms, appointment reminders, security notices, policy updates, or other service-related messages;
• Protect the safety, rights, property, and security of the Practice, our clients, Website visitors, and others;
• Detect, investigate, and prevent fraud, misuse, security incidents, or unlawful activity;
• Comply with legal, licensing, ethical, accounting, insurance, risk-management, and professional obligations;
• Establish, exercise, or defend legal claims; and
• Carry out another purpose that we disclose when the information is collected or that you authorize.

We do not use information submitted in connection with an inquiry or request for mental-health or culturally informed services for targeted advertising.

3. How We Disclose Information

We may disclose information only as reasonably necessary for the purposes described in this Policy, including as follows.

Service Providers

We use vendors to support our Website, communications, scheduling, records, telehealth, payment processing, security, and business operations. Depending on how you interact with us, these providers may include Webflow, Cloudflare, Google (including Google Fonts and Google Workspace), SimplePractice, Spruce Health, Stripe, other information-technology providers, and professional advisers.

Some providers process information on behalf of the Practice, while others operate platforms with which you interact directly. Where a provider processes information on our behalf, it may use that information only as permitted by its agreement with the Practice and applicable law. When a provider creates, receives, maintains, or transmits protected health information on behalf of the Practice, we enter into a business associate agreement when HIPAA requires one.

With Your Direction or Authorization

We may disclose information to a person or organization you direct us to contact or when you otherwise consent to or authorize the disclosure.

Legal, Safety, and Professional Obligations

We may disclose information when we reasonably believe disclosure is required or permitted by applicable law or regulation, including in response to valid legal process, a lawful governmental request, or a legally authorized professional or licensing obligation. We evaluate legal requests under applicable confidentiality, privilege, and protected-health-information requirements. We may also disclose information when permitted by law and reasonably necessary to protect a person from serious harm, respond to a security incident, investigate fraud or unlawful conduct, protect legal rights, or defend a claim.

Clinical and protected health information will be disclosed only as described in the Notice of Privacy Practices, applicable consent or authorization documents, and applicable law.

Business Changes

If the Practice is reorganized, sold, merged, dissolved, or transfers some or all of its operations, information may be transferred only as permitted by law and subject to applicable confidentiality, record-custody, and professional obligations.

4. No Sale or Targeted Advertising

We do not sell personal information or protected health information. We do not disclose personal information collected through the Website for cross-context behavioral or targeted advertising, and we do not exchange health information for advertising or marketing value.

5. Third-Party Platforms and Links

The Website may link to services operated by other organizations, including SimplePractice, Spruce Health, payment processors, social-media services, map or scheduling services, and other external websites. When you leave our Website or interact directly with one of these services, that organization’s privacy notice and terms may apply.

A link does not mean that the Practice controls or is responsible for an external service’s privacy, security, availability, or content. You should review the applicable third party’s privacy notice before submitting information. This paragraph does not limit the Practice’s obligations for a vendor that processes protected health information or other information on the Practice’s behalf.

6. Retention

We retain personal information only for as long as reasonably necessary for the purpose for which it was collected and to comply with legal, licensing, ethical, tax, accounting, insurance, contractual, record-retention, and dispute-resolution obligations.

General Website inquiries that do not lead to services may be deleted when they are no longer reasonably needed. Clinical, billing, consent, and professional-service records may be retained for longer periods required or permitted by applicable law and professional standards. A deletion request does not require us to delete information that we are legally or professionally required or permitted to retain.

7. Security

We use administrative, technical, and physical safeguards reasonably designed for the nature of the information we maintain and the risks involved. Security measures vary by system and service.

No Website, email service, electronic platform, transmission, or storage system is completely secure. We therefore cannot guarantee absolute security. If you believe information you provided to us has been accessed or disclosed improperly, contact us promptly using the information below, but do not include additional sensitive information in an ordinary email.

8. Your Choices and Privacy Requests

You may:

• Choose not to provide information through the public Website or ordinary email;
• Contact us to request correction of general contact information;
• Adjust browser settings for cookies or local storage;
• Use available notification settings within an authorized client portal or communication platform; and
• Exercise any access, correction, deletion, withdrawal, or other privacy right available to you under applicable law.

To protect confidentiality, we may need to verify your identity and authority before acting on a request. Certain requests may be limited by legal, clinical-record, professional, security, or record-retention requirements.

Requests involving clinical records or protected health information are governed by the Notice of Privacy Practices and applicable law. Please do not send sensitive details needed to verify a clinical-record request through ordinary email; contact us first so that we can provide an appropriate secure method.

Browser Privacy Signals

Because we do not sell personal information, disclose it for cross-context behavioral advertising, or permit third parties to collect personally identifiable information through the Website over time and across unaffiliated websites for targeted advertising, a browser “Do Not Track” or Global Privacy Control signal does not currently change how the Website operates. Strictly necessary security and rate-limiting technologies may continue to operate. If our practices change in a way that makes an opt-out signal legally applicable, we will respond to the signal as required by applicable law.

9. Children’s Privacy

The public Website is intended for adults seeking information about the Practice and is not directed to children under 13. We do not knowingly collect personal information directly from a child under 13 through the public Website. If we learn that we collected such information in a manner that requires parental consent, we will take reasonable steps to delete it or otherwise address it as required by law.

The Practice does not currently offer therapy or other services to minors.

10. Visitors Outside Hawaiʻi

The Practice is based in Hawaiʻi, United States. The Website may be viewed from other locations, but viewing the Website does not establish eligibility for services. Eligibility is determined separately based on the service requested, the person’s location, professional licensure requirements, and other applicable law.

Information may be processed and stored in the United States and in other locations where authorized service providers operate, subject to applicable legal and contractual requirements.

11. Changes to This Policy

We may update this Policy when our Website, services, vendors, or legal obligations change. The revised version will be posted on the Website with a new effective date. Material changes will apply prospectively unless applicable law permits or requires otherwise. We encourage you to review this Policy periodically.

12. Contact Us

For questions about this Website Privacy Policy or a general privacy request, contact:

Haku Kauka LLC d/b/a Na Aliʻi o Ka Malu
Honolulu, Hawaiʻi
Email: info@naokm.com
Website: https://www.naaliiokamalu.com

For clinical-record or protected-health-information requests, contact the Practice first so that we can direct you to a secure communication method. Do not include sensitive clinical information in an ordinary email.

‍