Privacy Policy
Effective Date: August 12, 2026
1. Who We Are
Lean Medical PC ("Lean Medical," "we," "us," or "our") is a professional medical corporation organized under the laws of the State of California. We operate a platform that connects licensed mental health clinicians with patients seeking in-network outpatient behavioral health care. Our website is located at leanmedical.ai.
2. Information We Collect
2.1 Information You Provide Directly
- Contact information: name, email address, phone number, mailing address
- Professional credentials: license number, NPI, specialty, practice information (for clinicians)
- Insurance and billing information: insurance carrier, member ID, date of birth
- Health information: intake forms, clinical questionnaires, treatment-related communications
- Account information: login credentials and profile data
- Communications: messages, emails, and inquiries you send to us
- SMS program data: your mobile number, a record of the consent you gave and when you gave it, the content of text messages exchanged with us, and any opt-out request (see Section 6)
2.2 Information Collected Automatically
- Device and browser information: IP address, browser type, operating system
- Usage data: pages visited, time on site, referring URL
- Cookies and similar technologies: essential cookies used for site functionality, plus analytics and advertising cookies set by the third-party services described in Section 5
2.3 Information from Third Parties
- Insurance payers: eligibility and benefits verification data
- Professional directories: publicly available clinician profile information
- Credentialing databases: CAQH, NPPES, and state licensing board data
3. How We Use Your Information
We use the information we collect for the following purposes:
- Providing and managing mental health services, including matching patients with clinicians
- Processing insurance claims, billing, and payments
- Clinician credentialing, onboarding, and network management
- Verifying insurance eligibility and obtaining prior authorizations
- Communicating with you about appointments, services, and account activity
- Complying with legal and regulatory obligations, including HIPAA
- Improving our platform, services, and user experience
- Preventing fraud and ensuring security of our systems
4. How We Share Your Information
We do not sell your personal information for money, and we never disclose health information or anything you enter into a form on this website to advertising or analytics companies. We do use the third-party analytics and advertising services described in Section 5, which may involve "sharing" personal information as that term is defined under California law. We may share information in the following circumstances:
- With clinicians in our network, as necessary for treatment and care coordination
- With analytics and advertising service providers, limited to the website usage data described in Section 5
- With insurance payers, for claims processing, eligibility verification, and prior authorizations
- With credentialing organizations (e.g., CAQH) as required for provider enrollment
- With our business associates who perform services on our behalf, subject to HIPAA-compliant Business Associate Agreements
- With government agencies, as required by law or in response to valid legal process
- To protect rights, safety, or property of Lean Medical, our patients, or the public
All of the above categories exclude text messaging originator opt-in data and consent. This information will not be shared with any third parties, excluding aggregators and providers of the text messaging services themselves.
5. Cookies, Tracking Technologies, and Your Choices
Our website uses essential cookies required for site functionality (e.g., session management). We also use the following third-party services on our public marketing pages:
- Google Analytics and Google Ads. These measure how our pages perform and whether an advertisement led to an inquiry. They receive the address of the page you viewed, the page that referred you, your approximate location derived from your IP address, your device and browser type, and cookie-based identifiers. This is cross-site advertising technology.
- Microsoft Clarity. This provides aggregate usage analytics, including heatmaps and session replay, so we can see where pages are confusing. It receives the same categories of website usage data.
What these services never receive. We do not pass health information, form contents, or the identity of any patient or prospective patient to these services. Session replay is disabled entirely on every page that collects information from you, including our contact form, our partner referral forms, and our clinician application, and the contents of those forms are masked. We do not use these services to build advertising audiences from health conditions.
Your choices. If your browser or a browser extension sends a Global Privacy Control (GPC) signal, we treat it as a request to opt out: we disable session replay and instruct our advertising and analytics tags not to use advertising cookies or personalization for your visit. You can also block or delete cookies in your browser settings, opt out of Google Analytics using Google's browser add-on, and adjust ad personalization in your Google account settings. You may also contact us using the details in Section 12 to request that we not share your personal information.
6. Text Messaging (SMS)
6.1 What We Collect and Why
We collect phone numbers and message content for SMS communications. We obtain your mobile number and your express written consent through a checkbox on a form on this website - we never add a number to our SMS program from a purchased list, a referral, or a phone call. Your phone number is used solely for delivering SMS messages related to your care and your inquiry: appointment scheduling and reminders, insurance benefits verification, care coordination, and follow-up on a request you sent us. We do not send marketing or promotional text messages, and we do not use your mobile number for advertising.
6.2 How to Opt Out
You may opt out of SMS communications at any time by replying STOP to any message from us. You can also reach us through our contact form or by calling (628) 204-3449. We will send one confirmation message and then stop texting that number. Reply HELP for help. Message and data rates may apply, and message frequency varies based on your inquiry. Consent to receive SMS is not a condition of receiving care or of any purchase, and opting out will not affect your treatment - we will simply reach you by phone or email instead.
6.3 TCPA Compliance
We comply with the Telephone Consumer Protection Act (TCPA) and maintain an internal do-not-contact list of numbers that have asked not to receive messages from us. We honor every opt-out request across our systems, and we keep the record of your opt-out indefinitely so that the number is not messaged again.
6.4 Data Retention
SMS message content is retained for 24 months and then deleted, unless a longer period is required by law or the messages form part of a patient medical record, in which case the retention periods in Section 8 apply. Records of your consent and of any opt-out request are retained for at least five years to evidence compliance with the TCPA.
6.5 No Sharing of Mobile Data
Text messaging originator opt-in data and consent are excluded from every sharing category described in Section 4. This information will not be shared with any third parties, excluding aggregators and providers of the text messaging services themselves, who process it only to deliver messages on our behalf. We do not sell, rent, or share your mobile number with anyone for marketing purposes.
6.6 Questions and Disputes
For any issue or dispute regarding SMS communications, including a message you believe you should not have received, reach us through our contact form or by calling (628) 204-3449. We will respond within two business days.
7. Data Security
We implement administrative, physical, and technical safeguards designed to protect your information in accordance with HIPAA Security Rule requirements. These include encryption of data in transit and at rest, access controls, workforce training, and regular security assessments. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.
8. Data Retention
We retain personal information and health records for the minimum periods required by applicable federal and state law. For medical records in California, this is generally a minimum of seven years from the date of last treatment (or longer for minors). Non-health personal data is retained for as long as necessary to fulfill the purposes described in this policy or as required by law.
9. Your Rights
Depending on your jurisdiction, you may have the following rights regarding your personal information:
- Access: Request a copy of the personal information we hold about you
- Correction: Request correction of inaccurate information
- Deletion: Request deletion of your information, subject to legal retention requirements
- Opt-Out of Sale or Sharing: We do not sell personal information for money. You have the right to direct us not to share it for cross-context behavioral advertising - see Your Choices in Section 5
- Non-Discrimination: We will not discriminate against you for exercising your privacy rights
California residents may have additional rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA). For health information rights, see our Notice of Privacy Practices.
10. Children's Privacy
Our website is not directed to children under 13. We do not knowingly collect personal information from children under 13 through our website. However, we do provide clinical services to minors (pediatric patients) with the consent of a parent or legal guardian, and related health information is handled in accordance with HIPAA and applicable state law.
11. Changes to This Policy
We may update this privacy policy from time to time. We will post any changes on this page and update the effective date. Material changes will be communicated through our website or by direct notice.
12. Contact Us
If you have questions about this privacy policy, contact us at: