Privacy Policy

Last Updated: June 25, 2026

Blume Health Co. ("Blume," "we," "us," or "our") respects your privacy and is committed to protecting the personal information of the mental health clinicians, prospective customers, and website visitors who interact with us.

This Privacy Policy explains what information we collect when you visit blumehealthco.com (the "Site"), schedule a demo, sign up for our services, or otherwise interact with Blume, how we use and share that information, and the choices you have. It applies to all information collected through the Site, by email, by phone, or through any related services, sales, marketing, or events (together, the "Services").

This Privacy Policy should be read alongside our Terms of Service. By using the Site or submitting information to us, you acknowledge that you have read and understood this Privacy Policy.

If you have questions about this Privacy Policy or how we handle your information, contact us at support@blumehealthco.com.

1. About Blume and the Scope of This Policy

Blume is a practice growth platform built exclusively for independent mental health clinicians — therapists, counselors, psychiatric mental health nurse practitioners (PMHNPs), and psychiatrists. We help providers grow their private practices through directory listing management, local SEO, websites, Psychology Today profile optimization, reputation management, social media, and paid advertising.

Blume is not a healthcare provider. We do not diagnose, treat, or provide medical or mental health care to patients. We do not provide credentialing, billing, or insurance services. Nothing on our Site or in our Services is medical advice.

If you are experiencing a mental health emergency, call or text 988 (the Suicide and Crisis Lifeline) or dial 911 immediately.

This Privacy Policy covers information collected from website visitors, prospective customers, current customers (clinicians and their staff), and members of the public who interact with us. It does not cover Protected Health Information ("PHI") that may flow through certain features of our Services on behalf of a clinician customer. See Section 5 below for how we handle PHI under HIPAA.

2. Information We Collect

We collect information you give us directly, information we collect automatically when you use the Site, and information we receive from third parties.

2.1 Information You Provide to Us

You give us information when you fill out forms, request a demo, create an account, communicate with us, or otherwise engage with our Services. This may include:

• Contact and identity information: name, email address, phone number, mailing address.
• Practice information: practice name, license type (PMHNP, LCSW, LPC, LMFT, MD, etc.), NPI number, specialties, states where you practice, practice size, website URL, and existing directory profiles.
• Account information: username, password, and any preferences you set.
• Billing and payment information: billing address and payment card or bank details. Card and bank details are processed by our payment processors (Stripe and Mercury) and are not stored on Blume's servers.
• Marketing and creative inputs: photos, logos, biographies, service descriptions, testimonials, and other content you upload or share so we can market your practice.
• Account credentials you authorize us to use on your behalf to manage directory listings, social profiles, ad accounts, or website platforms (for example, Google Business Profile, Psychology Today, Facebook, Healthgrades). We use these credentials only to perform the Services you have hired us to perform.
• Communications: the contents of emails, demo calls, chat messages, support tickets, and any other correspondence with us.

2.2 Information Collected Automatically

When you visit the Site, we and our service providers collect certain information automatically using cookies, pixels, server logs, and similar technologies, including:

• IP address and approximate location.
• Browser type, device type, operating system, language preference, and referring URLs.
• Pages visited, links clicked, time spent on pages, and other usage data.
• Information about how you arrived at the Site (for example, search terms or ad clicks).

We use this information to operate and secure the Site, understand how visitors use it, measure marketing campaigns, and improve the Services. See Section 8 for more on cookies and your choices.

2.3 Information from Third Parties

We may receive information about you from:

• Referral and partner sources (for example, Headway, Alma, or other practice partners) when you indicate you found us through them or when they introduce you.
• Service providers and integrations you connect to your account (for example, your scheduling tool, EHR, or directory accounts), limited to the data needed to deliver the Services.
• Publicly available sources such as state licensing boards, the NPI registry, professional directories, and your existing public web presence, which we may consult to build accurate listings for your practice.
• Analytics, advertising, and fraud-prevention vendors that help us understand and protect our Site.

3. How We Use Your Information

We use the information we collect for the following purposes:

• To provide our Services: set up and manage your account, build and optimize your directory listings, design and host your website, create and place ads, manage your social media, respond to reviews, and deliver the other marketing services you have engaged us to perform.
• To process payments and manage billing through Stripe, Mercury, and our other financial service providers.
• To communicate with you about your account, demo requests, onboarding, project updates, support questions, service changes, and policy updates. These are service-related communications you cannot opt out of while you remain a customer.
• To send you marketing communications about Blume products, features, educational content, events, and special offers — only where permitted by law. You can opt out of marketing emails at any time (see Section 9).
• To improve our Services, develop new features, conduct research, run analytics, train our team, and measure the performance of our marketing.
• To prevent fraud, abuse, and security incidents and to protect the rights, property, and safety of Blume, our customers, and the public.
• To comply with legal obligations, respond to lawful requests from public authorities, and enforce our Terms of Service.
• To request feedback or testimonials. If we publish a testimonial that identifies you, we will ask for your consent first. You can withdraw your testimonial at any time by emailing us.

We will not use your information for materially different purposes without notifying you and, where required, obtaining your consent.

4. How We Share Your Information

Blume does not sell your personal information. We share information only as described below.

• Service providers and subprocessors. We share information with vendors who help us run our business — including cloud hosting, email delivery, customer support tools, CRM and spreadsheet tools, payment processors (Stripe, Mercury), analytics providers, advertising platforms, communication tools (such as our calendar and email systems), and contractors who help deliver the Services. These providers are bound by contract to use the information only to perform services for Blume and to keep it confidential.
• Directory platforms and partners (for example, Google Business Profile, Psychology Today, Healthgrades, WebMD, Zocdoc, Apple Maps, Facebook, Yelp, TherapyDen, and other listing or advertising platforms) where we publish or update information you have asked us to publish on your behalf.
• Business transfers. If Blume is involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of all or part of our assets, your information may be transferred as part of that transaction. We will notify you of any change in ownership or use of your information.
• Legal and safety reasons. We may disclose information if we believe in good faith that disclosure is necessary to comply with applicable law, a subpoena, a court order, or other lawful request; to enforce our Terms of Service; to detect, prevent, or address fraud, security, or technical issues; or to protect the rights, property, or safety of Blume, our customers, or others.
• With your direction or consent. We will share your information for other purposes when you ask us to or give us permission.

We may also share aggregated or de-identified information that cannot reasonably be used to identify you for any business purpose.

5. HIPAA, Protected Health Information, and Business Associate Relationships

We take HIPAA compliance seriously. Most of the personal information Blume handles is information about clinicians, not about their patients or clients. However, some of our Services — including websites we build, intake forms we configure, virtual front desk services, and certain reputation management workflows — may involve Protected Health Information ("PHI") as that term is defined under the Health Insurance Portability and Accountability Act of 1996 and its implementing regulations ("HIPAA").

When Blume creates, receives, maintains, or transmits PHI on behalf of a clinician or practice that is a HIPAA-covered entity, Blume acts as a Business Associate. In those engagements:

• We will sign a Business Associate Agreement ("BAA") with the covered entity before any PHI is shared with us.
• We use and disclose PHI only as permitted by the BAA, HIPAA, and applicable law.
• We apply administrative, physical, and technical safeguards to protect the confidentiality, integrity, and availability of PHI.
• We will report any Security Incident or Breach of Unsecured PHI to the covered entity in accordance with the BAA and HIPAA's Breach Notification Rule.
• We require any subcontractor that handles PHI on our behalf to agree to substantially the same restrictions in writing.

This Privacy Policy describes Blume's privacy practices with respect to non-PHI personal information. PHI is governed by HIPAA, the applicable BAA, and the covered entity's own Notice of Privacy Practices. If you are a patient or client of a clinician who uses Blume and you have questions about how your health information is used, please contact that clinician directly.

If you are a clinician or practice and would like to request a BAA, email us at support@blumehealthco.com.

6. Data Security

We use administrative, technical, and physical safeguards designed to protect your information against unauthorized access, use, disclosure, alteration, and destruction. These safeguards include:

• Encryption of data in transit using TLS, and encryption at rest for sensitive data.
• Access controls, including least-privilege access for our team and contractors, multi-factor authentication for internal systems, and regular access reviews.
• Vetted, reputable hosting and infrastructure providers.
• Logging, monitoring, and incident response procedures.
• Workforce training on privacy and security responsibilities.

No method of transmission or storage is 100% secure. While we work hard to protect your information, we cannot guarantee absolute security. You are responsible for keeping your account credentials confidential and for notifying us immediately if you believe your account has been compromised.

7. Data Retention

We keep your personal information only as long as we need it for the purposes described in this Privacy Policy, including to provide the Services, comply with our legal and accounting obligations, resolve disputes, and enforce our agreements. When we no longer need your information, we will either delete it or de-identify it. Backups may persist for a limited period after deletion in accordance with our standard retention schedule. PHI is retained and disposed of in accordance with the applicable BAA and HIPAA.

8. Cookies and Tracking Technologies

We and our service providers use cookies, pixels, web beacons, local storage, and similar technologies to operate the Site, remember your preferences, analyze traffic, measure marketing performance, and deliver relevant advertising. These tools fall into a few general categories:

• Strictly necessary technologies that the Site needs to function (for example, to keep you logged in or remember form inputs).
• Analytics tools (such as Google Analytics) that help us understand how visitors find and use the Site.
• Advertising and marketing tools (such as Google Ads and Meta) that help us reach people who may benefit from Blume and measure the effectiveness of our campaigns.

You can control cookies through your browser settings and through some platforms' opt-out tools (for example, the Network Advertising Initiative at optout.networkadvertising.org and the Digital Advertising Alliance at optout.aboutads.info). Blocking cookies may affect how the Site works.

Do Not Track. Some browsers transmit "Do Not Track" signals. There is no consistent industry standard for responding to these signals, and we do not currently respond to them. We will update this Privacy Policy if that changes.

9. Your Choices and Your Rights

You have choices about your information:

• Account information. You can review, update, or correct your account information by logging in or by emailing support@blumehealthco.com. You can ask us to close your account at any time. Because Blume offers month-to-month service with no long-term contracts, you can cancel whenever you wish; some information may be retained for legal, accounting, fraud-prevention, or compliance purposes.
• Marketing emails. You can opt out of marketing emails at any time by clicking the unsubscribe link in any marketing email or by emailing us. We will still send you service-related communications about your account.
• Text messages. If you have opted in to receive text messages from us, you can opt out by replying STOP to any message. Standard message and data rates may apply.
• Cookies. See Section 8.

9.1 California Residents (CCPA / CPRA)

If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act, gives you certain rights regarding your personal information. Subject to verification of your identity and certain exceptions, you have the right to:

• Know what categories and specific pieces of personal information we have collected about you, the sources of that information, the purposes for collecting it, and the categories of third parties with whom we share it.
• Access a copy of the personal information we have collected about you.
• Correct inaccurate personal information we hold about you.
• Delete personal information we have collected from you, subject to certain exceptions.
• Opt out of the sale or sharing of your personal information. Blume does not sell personal information and does not "share" it for cross-context behavioral advertising as those terms are defined under California law.
• Limit the use of sensitive personal information. We do not use sensitive personal information for purposes that would trigger this right.
• Non-discrimination. We will not deny you services, charge you a different price, or provide a different level of quality because you exercised your privacy rights.

To exercise these rights, email support@blumehealthco.com. We will need to verify your identity before responding. You may also authorize an agent to make a request on your behalf; we will require proof of the agent's authority and may still require you to verify your identity directly.

Shine the Light. California residents may request information about disclosures of personal information to third parties for those parties' direct marketing purposes. To make such a request, contact us at the email above.

9.2 Other U.S. State Privacy Rights

Residents of certain other states (including but not limited to Colorado, Connecticut, Virginia, Utah, Texas, and Oregon) may have similar rights to access, correct, delete, or obtain a portable copy of their personal information, and to opt out of targeted advertising or certain profiling activities. To exercise these rights, email support@blumehealthco.com. We will respond as required by applicable law.

9.3 Appeals

If we decline to act on your request, you may appeal our decision by replying to our response or emailing support@blumehealthco.com with the subject line "Privacy Appeal." We will respond within the time required by applicable law.

10. Third-Party Sites and Services

The Site may contain links to websites, platforms, and services that Blume does not own or control — for example, Psychology Today, Google, Meta, Stripe, Calendly, Mercury, and the various directories where we publish your practice information. This Privacy Policy does not apply to those third parties. We encourage you to review the privacy policies of any third-party site or service before providing your information to them.

11. Children's Privacy

Blume's Services are intended for licensed mental health professionals and adults acting on behalf of a practice. The Site is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe we have collected information from a child under 13, please contact us at support@blumehealthco.com and we will take steps to delete it.

If you are a clinician customer who treats minors and we handle related PHI on your behalf, the use and disclosure of that information is governed by your BAA with us and by HIPAA, not by this Section.

12. Geographic Scope and International Visitors

Blume serves customers in the United States. The Site is operated from and our information is stored in the United States. If you access the Site from outside the United States, you understand that your information will be transferred to, stored in, and processed in the United States, which may have different data protection laws than your country.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, our Services, or the law. When we make material changes, we will update the "Last Updated" date at the top of this page and, where appropriate, notify you by email or through the Site. Your continued use of the Services after a change becomes effective means you accept the updated Privacy Policy.

14. Contact Us

Questions, comments, or requests about this Privacy Policy or your information? We're here to help.