WPB Therapy, PLLC

d/b/a Counter Practice Therapy

Website Privacy Policy

Effective Date: 9/10/26


1. Introduction and Scope


This Privacy Policy (this “Policy”) is issued by WPB Therapy, PLLC, doing business as Counter Practice Therapy (“Counter Practice Therapy,” “we,” “us,” or “our”), a professional limited liability company operated by Walker Bunch, LPC A, a Licensed Professional Counselor Associate licensed in the State of Texas and Supervised by Austin Bridges LPC-S.


Counter Practice Therapy provides remote, evidence-based mental health services throughout Texas, with a clinical focus on Obsessive-Compulsive Disorder (OCD), anxiety-related conditions, and affirming care for LGBTQ+ individuals and communities.


This Policy explains how we collect, use, disclose, and safeguard information about you. It applies to:


  • our website located at counterpracticetherapy.com (the “Website”);

  • all online interactions you have with us through the Website, including contact and consultation request forms;

  • telehealth sessions and related clinical services delivered through our practice management and telehealth platform, Ensora Health, along with TheraNest (collectively, “Ensora”); and

  • any other services we provide that reference this Policy.


Because Counter Practice Therapy operates in both a clinical capacity and as an online presence, this Policy distinguishes between two categories of information:


  • Protected Health Information (PHI). PHI is information that relates to your past, present, or future physical or mental health or condition, the provision of health care to you, or payment for that care, and that identifies you or could reasonably be used to identify you. PHI is governed by the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and the regulations issued under it. When we handle PHI, we do so in accordance with our Notice of Privacy Practices, which is provided to you at the start of the therapeutic relationship and is available upon request.

  • General Personal Information. General personal information is information you provide or that is automatically collected when you visit or interact with our Website outside of a clinical context — for example, your name and email address when you submit a consultation request form. This type of information is not PHI and is governed by this Policy.


Effective Date: By using the Website or our services after the Effective Date, you acknowledge that you have read and understood this Policy.



2. Information We Collect


We collect different types of information depending on whether you are visiting our Website or are engaged in a therapeutic relationship with us. The sections below describe each category in detail.


2.1  Personal Information (Non-PHI)


When you interact with our Website without an existing therapeutic relationship, we may collect the following general personal information:


2.1(a)  Information You Provide Directly


Our Website includes a “Request a free consultation call” form. If you submit that form, then we will collect the information you enter, which includes:


  • your first and last name;

  • your email address; and

  • your phone number.


Submitting the consultation request form does not create a therapist-client relationship and does not constitute the delivery of mental health services. If, after a consultation call, you become a client, then information you subsequently provide in a clinical context will be treated as PHI under Section 2.2.


2.1(b)  Information Collected Automatically


When you visit our Website, our web hosting provider and any analytics tools we use will automatically collect certain technical information about your device and browsing session, including:


  • your Internet Protocol (IP) address;

  • browser type and version;

  • operating system and device type;

  • the pages you view on our Website and the time you spend on each page;

  • the URL of the page that referred you to our Website; and

  • the date and time of your visit.


This information is collected through standard server logs and, where applicable, cookies or similar tracking technologies. See Section 2.3 for more detail on cookies and analytics.


2.2  Protected Health Information (PHI)


If you become a client of Counter Practice Therapy, then we will collect and maintain PHI about you in connection with the therapeutic relationship. We collect PHI through Ensora, our HIPAA-compliant practice management and telehealth platform. PHI we collect may include:


  • intake forms and client demographic information;

  • clinical and progress notes;

  • treatment plans and treatment goals;

  • diagnoses and diagnostic impressions;

  • the content of therapy sessions, including information you share during telehealth sessions;

  • appointment history and scheduling records;

  • billing records, including insurance information, explanation of benefits documents, and payment history; and

  • any other health-related information you provide to us in the course of receiving services.


Your PHI is stored and processed within Ensora’s platform under a Business Associate Agreement that obligates Ensora to safeguard your PHI in accordance with HIPAA. Our use and disclosure of your PHI is governed by our Notice of Privacy Practices, not this Policy. If you have questions about how we handle your PHI, then please refer to the Notice of Privacy Practices or contact us directly.


2.3  Automatically Collected Website Information


In addition to the server-log data described in Section 2.1(b), we may use cookies and third-party analytics services to understand how visitors use our Website. Specifically:


  • Cookies. A cookie is a small text file placed on your device by a website you visit. We may use session cookies (which expire when you close your browser) and persistent cookies (which remain on your device for a set period) to remember your preferences and analyze traffic patterns. You may configure your browser to refuse cookies or to alert you when cookies are being sent; if you do so, then some features of our Website may not function as intended.

  • Analytics. We may use a third-party analytics service (such as Google Analytics) to collect aggregated information about Website traffic and user behavior. These services may collect your IP address and browsing activity on our Website using their own cookies. Information collected by analytics services is subject to those providers’ privacy policies. We use analytics data only to improve the Website and our communications.

  • Log Data. Our web server automatically generates log files that record technical details of each request made to the Website, including IP address, browser type, referring URL, and timestamps. We retain log data for a limited period for security and diagnostic purposes.


3. How We Use Your Information


The way we use your information depends on whether it is PHI collected in a clinical context or general personal information collected through the Website.


3.1  Use of Protected Health Information


HIPAA permits covered entities to use and disclose PHI without your written authorization for Treatment, Payment, and Healthcare Operations (TPO). We will use your PHI for TPO purposes as follows:


  • Treatment. We will use your PHI to provide, coordinate, and manage your mental health treatment, including conducting therapy sessions via Ensora’s telehealth platform, developing and updating your treatment plan, and, where appropriate, coordinating care with other providers you authorize us to contact.

  • Payment. We will use your PHI to bill you or your insurance carrier for services rendered, process payments, verify insurance eligibility, and pursue reimbursement where applicable.

  • Healthcare Operations. We may use your PHI for internal practice operations, including quality assurance, supervision (where applicable under Walker Bunch’s LPCA license), training, and compliance activities.


Uses of your PHI beyond TPO — such as marketing or research — require your written authorization, which you may revoke at any time. Please refer to the Notice of Privacy Practices for a complete description of permissible uses and disclosures of your PHI.


3.2  Use of General Personal Information


We will use the general personal information you provide through the Website for the following purposes:


  • Responding to Consultation Requests. If you submit the “Request a free consultation call” form, then we will use your name, email address, and phone number to contact you and schedule a free initial consultation call.

  • Scheduling and Appointment Reminders. If you become a client, then we may use your contact information to send appointment confirmations, reminders, and scheduling-related communications through Ensora or other HIPAA-compliant channels.

  • Communications. We may contact you by email, phone, or SMS/text message in connection with your inquiry or ongoing services. If you receive SMS messages from us, then standard message and data rates may apply. You may opt out of SMS communications at any time by replying STOP to any text message or by contacting us directly.

  • Website Analytics and Improvement. We will use automatically collected technical information (see Section 2.3) to analyze how visitors use the Website, identify technical issues, and improve the Website’s content, design, and functionality. This analysis is conducted on an aggregated or de-identified basis wherever possible.

  • Legal Compliance. We may use or disclose your information when required to do so by applicable law, regulation, court order, or lawful request from a government authority, or when we believe in good faith that disclosure is necessary to protect our rights, protect your safety or the safety of others, investigate fraud, or respond to a legal process.


4. How We Share Your Information


We share your protected health information (PHI) and other personal information only as permitted or required by law, as described in our Notice of Privacy Practices, and as authorized by you. We will not sell your PHI or personal information to any third party.


4.1 HIPAA-Permitted Disclosures


Under HIPAA, we may use and disclose your PHI without your written authorization for the following purposes:


  • Treatment, Payment, and Health Care Operations (TPO): We may share PHI with health care providers involved in your treatment, with health plans or insurers for payment purposes, and internally for health care operations such as quality assurance, staff training, and practice administration.

  • As Required by Law: We will disclose PHI when federal, state, or local law mandates such disclosure, including in response to valid court orders, subpoenas, or administrative demands.

  • Public Health Activities: We may report PHI to public health authorities authorized to collect or receive such information for the purpose of preventing or controlling disease, injury, or disability, including the reporting of child abuse or neglect as required under applicable state law.

  • Abuse, Neglect, and Domestic Violence Reporting: We will report suspected abuse, neglect, or domestic violence to government authorities authorized to receive such reports when we are required or permitted to do so under applicable law.

  • Judicial and Administrative Proceedings: We may disclose PHI in response to a court order, subpoena, discovery request, or other lawful process, subject to applicable legal requirements and, where feasible, notice to you.

  • Health Oversight Activities: We may disclose PHI to health oversight agencies for activities authorized by law, such as audits, investigations, and licensure proceedings.

  • Serious Threat to Health or Safety: We may use or disclose PHI when necessary to prevent or lessen a serious and imminent threat to the health or safety of a person or the public, consistent with applicable law and ethical standards.


4.2 Business Associates


We share PHI with vendors and service providers that perform functions on our behalf and require access to PHI to do so. These entities are our Business Associates under HIPAA. Before we share any PHI with a Business Associate, we will execute a written Business Associate Agreement (BAA) that requires the Business Associate to protect your PHI in accordance with HIPAA.


Our primary telehealth and practice management platform is Ensora. Ensora processes PHI to support scheduling, clinical documentation, billing, and telehealth video sessions. We have executed a BAA with Ensora governing its use and disclosure of PHI on our behalf.

Other Business Associates may include, but are not limited to, billing services, electronic health record platforms, payment processors that handle PHI, and IT support providers. Each such provider will have an executed BAA in place before receiving access to PHI.


4.3 No Sale of PHI or Personal Information


We will never sell, rent, or otherwise exchange your PHI or personal information for monetary consideration or other valuable consideration. This prohibition applies regardless of the medium or format in which the information is held.


4.5 Additional Third-Party Tools


We may use third-party tools to support the delivery of our services, such as scheduling platforms, email communications services, and web analytics providers. Where such tools process personal information that is not PHI, we enter into appropriate data processing agreements to protect your information. We will update this section as our vendor relationships change.


5. Cookies and Tracking Technologies


Our website uses cookies and similar tracking technologies to operate, improve, and understand how visitors use the site. This section describes the types of cookies we use and the choices available to you.


5.1 Types of Cookies We Use


We may use the following categories of cookies:


  • Essential Cookies: These cookies are necessary for the website to function and cannot be switched off. They are typically set in response to actions you take, such as filling out forms or setting privacy preferences. Without these cookies, services you have requested cannot be provided.

  • Analytics Cookies: These cookies allow us to count visits and measure traffic sources so that we can assess and improve the performance of our website. Information collected by analytics cookies is aggregated and anonymous. If you opt out of analytics cookies, then we will not be able to include your visit in our site statistics.


5.2 Your Cookie Choices


You may control cookies through the following means:


  • Browser Settings: Most web browsers allow you to refuse or delete cookies through your browser settings. Please consult your browser's help documentation for instructions. If you disable cookies, then some portions of our website may not function as intended.

  • Opt-Out Tools: For analytics tools such as Google Analytics, you may install the Google Analytics Opt-out Browser Add-on available at https://tools.google.com/dlpage/gaoptout to prevent your data from being used by Google Analytics.


6. Consultation Booking — Consent and Disclosures


This section applies to individuals who submit the 'Request a free consultation call' form on our website. Please read the following disclosures carefully before submitting the form.


6.1 Consent to Collection and Use of Contact Information


By submitting the consultation request form, you consent to our collection and use of the contact information you provide — including your name, email address, and phone number — for the purpose of scheduling and conducting your free consultation call, responding to your inquiry, and providing information about our services. We will use this information only as described in this Policy and our Notice of Privacy Practices.


6.2 Consent to Communication


By submitting the consultation request form, you consent to receiving communications from us via email, telephone, and SMS/text message at the contact information you provide. You understand that:


  • Email communications may include appointment reminders, responses to your inquiry, and general information about our services.

  • Phone calls may be made to the number you provide to schedule or confirm your consultation.

  • SMS/text messages may be sent to your mobile number to confirm your appointment or share follow-up information.


6.3 Telephone Consumer Protection Act (TCPA) Consent


By submitting this form, you expressly consent to receive communications from us, including via automated telephone dialing systems, prerecorded messages, and/or text messages, at the phone number you provide. You understand that consent is not a condition of receiving services. Message and data rates may apply. You may revoke consent at any time by contacting us at walkerbunch@counterpracticetherapy.com.


To stop receiving text messages, reply STOP to any text message we send you. For assistance, reply HELP or contact us directly at walkerbunch@counterpracticetherapy.com.


6.4 No Therapist-Client Relationship


Submitting this form does not establish a therapist-client relationship. A therapist-client relationship is established only after both parties agree to enter into such a relationship and complete the required intake process.


Until a therapist-client relationship is formally established, we are not your therapist, and the communications exchanged through the consultation process do not constitute mental health treatment, diagnosis, or advice.


6.5 Texas Residents


If you are a Texas resident, you have rights under Texas Business & Commerce Code § 321.054 with respect to your personal data. These rights include the right to confirm whether we process your personal data, to access your personal data, to correct inaccuracies, to delete your personal data, to obtain a copy of your personal data in a portable format, and to opt out of the processing of your personal data for the purposes of targeted advertising or profiling that produces legal or similarly significant effects.


To exercise any of these rights, please contact us using the information in Section 12 of this Policy. We will respond to verified requests within the timeframe required by applicable law.


7. Your Rights and Choices


Depending on where you live and the type of information we hold about you, you may have specific legal rights regarding your personal information and protected health information (PHI). This section describes those rights and explains how you will exercise them.


7.1 HIPAA Rights (for Protected Health Information)


If we maintain PHI about you, HIPAA gives you the following rights. If you wish to exercise any of these rights, then you must submit a written request to us using the contact information in Section 12.


  • Right to Access Your PHI. You may request a copy of the PHI we maintain about you in a designated record set. We will provide access or a copy within 30 days of receiving your written request. If we deny access, then we will explain the reason in writing and tell you whether you have a right to review that denial.

  • Right to Request Amendment. If you believe PHI we hold about you is inaccurate or incomplete, then you may ask us to amend it. We will act on your request within 60 days. If we deny the amendment, then we will notify you in writing and explain how you may submit a statement of disagreement.

  • Right to Request Restrictions on Uses and Disclosures. You may ask us to restrict how we use or disclose your PHI for treatment, payment, or health care operations. We are not required to agree to most restrictions, but if we do agree, then we will honor the restriction until you release us from it in writing. We must agree to a restriction if you request that we not disclose PHI to your health plan for services you paid for entirely out of pocket.

  • Right to Request Confidential Communications. You may request that we communicate with you about your PHI in a specific way or at a specific location. For example, you may ask us to contact you only by email or only at a particular phone number. We will accommodate reasonable requests without requiring you to explain why.

  • Right to Receive Breach Notification. If we discover that your unsecured PHI has been breached, then we will notify you without unreasonable delay and no later than 60 days after we discover the breach. The notification will describe what happened, what information was involved, steps you should take, and what we are doing to investigate and mitigate the breach.

  • Right to File a Complaint with HHS Office for Civil Rights. If you believe we have violated your HIPAA rights, then you may file a complaint with the U.S. Department of Health and Human Services (HHS) Office for Civil Rights at www.hhs.gov/ocr or by calling 1-800-368-1019. You may also file a complaint directly with us using the contact information in Section 12. We will not retaliate against you for filing a complaint.


7.2 Texas Law Rights


Texas law grants you additional rights regarding your health and personal information, which may overlap with or exceed your HIPAA rights.


  • Texas Medical Records Privacy Act (TMRPA) — Tex. Health & Safety Code Chapter 181. TMRPA extends HIPAA-level protections to a broader range of covered entities operating in Texas. If you are a Texas resident, then you have the right to access, amend, and restrict uses of your medical records under standards at least as protective as HIPAA. We will treat your records consistently with both HIPAA and TMRPA and will apply whichever standard affords you greater protection.

  • Mental Health Confidentiality — Tex. Health & Safety Code § 611. Records of mental health services are confidential under Texas law. We will not disclose your mental health records without your written consent except in the limited circumstances permitted by § 611, such as when disclosure is necessary to prevent serious and imminent harm to you or others. If you request a copy of your mental health records, then we will respond within the timeframe required by law and will explain any permitted limitation on access.

  • Texas Identity Theft Enforcement and Protection Act (TITEPA). If we experience a breach of your sensitive personal information as defined under Tex. Bus. & Com. Code Chapter 521, then we will notify you as soon as reasonably practicable. Sensitive personal information includes your name combined with your Social Security number, driver's license or government-issued ID number, financial account numbers, or medical information. We maintain a written information security program designed to protect this information.


7.4 New York Residents


If you are a New York resident, the following state laws provide you with additional protections.


  • New York SHIELD Act — Data Security Protections. The Stop Hacks and Improve Electronic Data Security (SHIELD) Act requires us to implement reasonable administrative, technical, and physical safeguards for private information about New York residents, which includes your name combined with financial account numbers, Social Security numbers, biometric information, or log-in credentials. If we experience a breach of your private information, then we will notify you in compliance with the SHIELD Act, which requires notice in the most expedient time possible and without unreasonable delay.

  • New York Mental Health Confidentiality Provisions. New York Mental Hygiene Law § 33.13 protects the confidentiality of clinical records of patients who receive mental health services. We will not disclose your mental health clinical records without your written consent except in the limited circumstances permitted by law, such as when necessary to coordinate your care or when required by a court order. If you request access to your mental health records, then we will respond in accordance with applicable law and will explain any permitted limitation on access.


7.5 How to Exercise Your Rights


You may exercise any of the rights described in this Section 7 by contacting us using the information provided in Section 12.


  • Submitting a Request. To submit a request, send a written communication to the address, email, or fax number listed in Section 12. Please include your full name, date of birth, the right you wish to exercise, and enough detail to allow us to identify and locate your records. HIPAA requests must be submitted in writing, and we recommend the same format for all other rights requests to ensure proper routing and timely response.

  • Identity Verification. Before we fulfill a rights request, we will verify your identity to protect your information from unauthorized access. We will ask you to confirm information we already have on file, such as your date of birth and the last four digits of a government-issued ID. If we cannot verify your identity, then we will deny the request and explain what additional information you may provide to support verification.

  • Authorized Agents. If an authorized representative submits a request on your behalf, then we will require a written authorization signed by you, a valid power of attorney, or proof of legal guardianship before processing the request. We may still contact you directly to confirm the request.

  • Response Timing. We will acknowledge your request within 10 business days and will respond substantively within the timeframe required by applicable law — generally 30 days for HIPAA requests and 45 days for CCPA/CPRA requests. If we need additional time, then we will notify you in writing before the initial deadline expires and explain the reason for the delay.

  • No Retaliation. We will not retaliate against you for exercising any right described in this section. Exercising your rights will not affect the quality of services we provide to you.


For full contact information, including our mailing address, email, and privacy officer details, see Section 12.


8. Data Retention and Security


8.1 Retention Periods


We will retain protected health information (PHI) in accordance with applicable Texas law. For adult patients, we will retain records for a minimum of seven (7) years from the date of service or the date of last treatment, whichever is later. For minor patients, We will retain records until the patient reaches the age of twenty-one (21) or for seven (7) years from the date of last treatment, whichever period is longer. We will not destroy records before the applicable retention period expires.


9. Children's Privacy


Our website is not directed to children under the age of thirteen (13). We do not knowingly collect personal information from children under thirteen (13) without verifiable parental consent. If we discover that we have inadvertently collected personal information from a child under thirteen (13) without verifiable parental consent, then we will delete that information promptly. If you believe we have collected information from a child under thirteen (13) without the required consent, then please contact us using the contact information in Section 12 of this Policy.


If we provide mental health services to minor patients between the ages of thirteen (13) and seventeen (17), then we will obtain appropriate parental or legal guardian consent prior to treatment, in accordance with Texas law and HIPAA requirements. We will handle PHI of minor patients with the same protections applicable to adult patients, subject to the parental access rights and confidentiality limitations established under Texas law.


10. Third-Party Links and Services


our website may contain hyperlinks to third-party websites, resources, or services that are not owned or controlled by us. We provided these links for informational purposes only. If you click on a third-party link, then you will be directed to that third party's website, which is subject to its own privacy policy and terms of use.


We use Ensora as its telehealth and practice management platform. Ensora processes certain information on behalf of us as a Business Associate under a executed Business Associate Agreement (BAA). Ensora is subject to its own privacy policy, which governs Ensora's independent data practices. We encourage you to review Ensora's privacy policy to understand how Ensora handles your information.


We are not responsible for the privacy practices, content, or security of any third-party website or service. We do not endorse, and has no control over, the privacy practices of any third party. Your use of third-party websites and services is at your own risk and is subject to those third parties' terms and policies.


11. Notice of Privacy Practices (HIPAA NPP Summary)


As a covered entity under HIPAA, we are required to maintain a Notice of Privacy Practices (NPP) that describes how we may use and disclose your PHI, and your rights with respect to that information. This Policy incorporates key elements of our NPP and is intended to provide accessible information about our privacy practices. This Policy does not, however, constitute our standalone HIPAA NPP.


For a description of your rights as a patient under HIPAA and Texas law — including your right to access, amend, and request restrictions on your PHI — please refer to Section 7 of this Policy. To exercise any of those rights, please contact us using the information provided in Section 12 of this Policy.


12. How to Contact Us / Submit a Privacy Request


If you have questions about this Policy, wish to exercise your privacy rights, or need to submit a privacy-related request, then please contact us using the information below. We will respond to all requests within the timeframes required by applicable law.


WPB Therapy, PLLC d/b/a Counter Practice Therapy

Privacy Contact: Walker Bunch, LPC Associate, Supervised by Austin Bridges LPC-S

Email:  walkerbunch@counterpracticetherapy.com


12.1 Filing a Complaint


If you believe we have violated your HIPAA privacy rights or applicable Texas privacy law, then you may file a complaint with the following authorities. We will not retaliate against you for filing a complaint.


  • HHS Office for Civil Rights (HIPAA complaints): U.S. Department of Health and Human Services, Office for Civil Rights. Complaints may be submitted online at https://www.hhs.gov/ocr/complaints, by mail, or by phone.

  • Texas Health and Human Services Commission (Texas complaints): Complaints regarding state privacy violations may be submitted to the Texas Health and Human Services Commission through its designated complaint intake process.


13. Changes to This Privacy Policy


We reserve the right to update or modify this Policy at any time to reflect changes in applicable law, our practices, or other operational, legal, or regulatory requirements.


If we make a material change to this Policy, then we will post the updated Policy on our website with a revised effective date prominently displayed at the top of the Policy. We may also notify you of material changes by email or through a notice on its website, where practicable.


Your continued use of our website or services after the posting of a revised Policy will constitute your acceptance of the updated terms. If you do not agree to the revised Policy, then please discontinue use of our website and services and contact us to discuss your options.


14. Effective Date


Effective Date: 9/10/26


This Policy is effective as of the date set forth above.