Privacy policy
Mesa Valley Counseling operates this website for the counseling practice of Jason Cheney, M.Ed., LPC. This page explains how the public site and the secure forms work. The Notice of Privacy Practices covers protected health information once you become a client.
What we collect
The consultation form collects name, email, phone, and a brief scheduling note. Do not send clinical details there. Signed clinical forms collect the information printed on each form, plus a signature image, a submission identifier, a time stamp, and a hashed network identifier used only for abuse prevention.
How submissions are protected
- Transport uses HTTPS.
- Each form session uses a short-lived HMAC token stored in an HttpOnly, SameSite cookie.
- Submissions are rate limited and include a honeypot field.
- Completed packets are turned into a PDF and encrypted with AES-256-GCM before they are stored or emailed.
- Email bodies do not include clinical answers. Production email should use a vendor that will sign a BAA.
- Form field values are not written to application logs.
Cookies
This application sets first-party cookies only for security and staff sign-in. The form-security cookie expires in thirty minutes. The staff session cookie is set after a successful clock login and expires in twelve hours. Neither cookie is used for advertising.
Staff time clock
The staff clock stores usernames and punch times on the server so the practice can record hours. It is not a client record and should not include protected health information.
Contact
Privacy questions: jasonjcheney@gmail.com or (970) 762-2267. Office: 3198 F Road, Suite 204, Grand Junction, CO 81504.