You would never let a stranger sit in your session and take notes on everything your client says. But chances are your website is doing exactly that right now. And handing these notes to companies that sell them.
Your website is not just an info page with your CV baked in. The moment someone visits your website considering whether you can help them and are safe enough to contact, they engage in a therapeutic interaction. This is their first session with you. So the confidentiality you uphold in a physical session needs to extend to your website too. And this is what most therapists and healers are not aware of.
Open Door Website vs. Safe Space Website
Your website might look professional.
It might have a cookie banner.
It might have a privacy policy.
And it probably still leaks your clients' data to third parties without their knowledge and consent.
A cookie banner and a privacy policy are not protection. If your site still hands visitor data to third parties without their consent, those labels are mere decoration. And a decorated door is still an open one.
Let's take the IP address (Internet Protocol) as an example. This is a unique label that is tied to a specific device within a network. So this device and its location can be identified. Every website collects this data to function at all. But with the less careful general population, this address can be tied back to the individual. So the act of visiting a therapist website is already health data. If you don't actively protect this data, you might as well leave the door open and tell the world that this person suffers from depression.
According to HIPAA Journal, unauthorized access and disclosure breaches have spiked since 2021 to up to 16 million affected people in 2024 in the US, and in 2022, 55% of the financial penalties imposed by OCR were on small medical practices. You don't even need a hack to break confidentiality. Your website might be doing it voluntarily through a piece of tracking code you didn't know existed.
That would be an Open Door Website.
So what do you do in a physical session? You close the door. You create a safe space for trust and openness. So a healthy relationship can be built that can heal.
Your visitor trusts you to enter a Safe Space when visiting your website. They trust you to care and protect them the same way you would protect them in a physical session. But if your website has an Open Door it betrays that trust even before you've ever met your client.
This is personal
For me, online privacy is not theoretical. Years ago, a contact matching feature on a networking platform informed a violent person from my past that I had joined. That also revealed my whereabouts. A feature I knew nothing about. Never gave consent to. Never got the option to opt out of, no matter how carefully I locked down my own account upon sign-up. I didn't get the option to not disclose my location, to not disclose my name. All I wanted to do is to start building a professional network like everyone else and connect with my colleagues.
But what followed was months of harassment. I had to give up a leadership position I worked hard for. A business I spent years building. I paid lawyers instead of saving for my future. That professional network never happened.
I've been faceless online ever since.
And I've never felt safe ever since, not even in my own home.
Because a platform shared my data with someone who should never have had it.
The standard in the healthcare industry
If you think this is just an odd case and a different context, let's take a look at the therapy industry.
In 2023, the FTC (Federal Trade Commission) fined BetterHelp $7.8 million for sharing users' health questionnaire data, email addresses, and IP addresses with Facebook, Snapchat, Pinterest, and Criteo.
For advertising.
Without consent.
Despite promising confidentiality.
BetterHelp let Facebook know if a visitor had been in therapy before so Facebook could serve them therapy-related ads. BetterHelp's own defense was “industry-standard practice.”
BetterHelp is not alone in this. In 2024, Cerebral (another mental health telehealth company) got hit by the FTC with a $7 million fine for the same issue. They sent patients' sensitive health data to advertising platforms and mailed promotional postcards that revealed people's diagnoses.
So if a company that is built entirely around therapy and therefore confidentiality sold out the trust of 3.5 million users, do you think a generic website builder or plugin would protect your one-person practice by default?
As reported by HIPAA Journal, a 2024 study of 3,419 websites found that 33% of healthcare websites were using Meta's tracking pixel. That's the snippet of code that tells Facebook who visited which page on a website. That might be pages about treatment for depression or information about drug abuse. Trackers from Google and Microsoft were found as well. HHS (the Department of Health & Human Services) has made clear that this combination (identifiable person + health-related site visit) is protected health information. Leaking this data without consent does more than violate GDPR and HIPAA. It also betrays your visitors' trust. Simply informing visitors about the tracking via a banner is not enough.
The standard applied to small therapist websites
This study lines up with my own findings. Out of 68 therapist websites I have audited, 83% had privacy issues.
One therapist website I saw had the hosting provider's analytics running and Google Fonts loading externally, sending visitors' data to third parties. There was no cookie consent banner.
The clearly outdated, generic privacy policy mentioned session cookies, permanent cookies, and third-party cookies being stored in the visitor's browser without any way to opt out.
The whole policy was copy-pasted straight from a generator and the paragraph about how user data is being protected consisted mainly of the generator's placeholder with instructions for the website owner to actually fill it in.
The policy mentioned possibly displaying ads from “networkadvertising“ and the link to their privacy policy was insecure (via http, not https).
Google and the hosting provider are watching this therapist's potential clients as they are looking to find help and trying to figure out if they can trust this therapist. No way to opt out.
So is this a bad therapist that doesn't care about privacy? No. This is a therapist who cares deeply about their work and clients. One who did their best and doesn't know better. Overwhelm oftentimes leads to avoidance.
“On the dark web, therapy records sell for $1,000 or more per record” ~ Oversecured
A credit card number sells for under $10. Your clients' vulnerable moments are the most valuable data on the planet. And most therapist websites hand it over for free.
Most therapist websites I've seen are Open Door Websites.
A Safe Space Website
I am not telling you all this to scare you. My goal is to empower you to protect the people in your care that rely on you with their most intimate problems.
Your website is your digital office, not just some page on the internet with your contact details. If someone visits to get to know you and explore the ways you could help them, that visit is itself a signal that they might require help. That they suffer from something. This is an indication of their mental state and health. They are actively engaging with you and their problem, even if you are not there physically.
So this online session should be treated with the same care as a physical one. Your visitor requires the same protection as the client sitting next to you in your physical office. They require the same Safe Space.
Your visitors have a right to not be tracked by anyone without their consent - not even by you. They have a right to not have their data collected by third-parties. They have a right to transparency about what is happening with their data when they visit your website - to be able to read a comprehensive privacy policy that actually reflects what is happening to their data on your site instead of a generic filler.
That is a Safe Space for a vulnerable person. That is a respectful place for everyone else.
What does a Safe Space Website look like
I built Therajava's own website from the ground up with privacy in mind. Privacy is not a label I slapped on in the end. The goal was to grant privacy and choice as much as possible, not just comply with regulations.
This includes:
- self-hosted, privacy-respecting analytics instead of Google Analytics
- a custom cookie banner that already protects when the page loads and respects the visitor's choices regarding tracking
- self-hosted fonts instead of Google Fonts that don't collect data
- a custom, transparent privacy policy instead of a generated one
- signed data processing agreements with every service provider I couldn't do without
- providers that comply with GDPR at the minimum or care about privacy beyond regulations themselves
- custom API-based forms instead of third-party forms that track
Had it been built to the generic industry standard instead, the standard most therapist websites are built to, I would have to replace roughly 11 tools to get it to its current state.
This is a different way of building websites. The work is in the intentional details. This is why so few websites get there by accident.
Honoring trust
As a therapist and healer, you are more than a website owner. You create safe spaces for vulnerable people so they can heal instead of being harmed - in the physical world and in the digital one. You are the person people trust with their sensitive information. You are the person who honors this trust - in all encounters. You are someone who cares.
Caring involves knowing the state of your website. I know it can be scary and daunting to confront yourself with facts like that. To see where you might have slipped up or were unaware. I've been there and done that too. But once you have worked through that process, I can guarantee you will feel and sleep better at night, knowing that you don't cause harm to your website visitors.
To help you through that process, I have created a privacy checklist for you. It's free. So you can take that first step right now to make sure your website visitors are respected and protected as they should be. To make sure your website is the Safe Space it needs to be.
