HIPAA Notice of Privacy Practices

Effective date:
October 29, 2026
Last updated:

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

If you have questions about this notice, contact our Privacy Officer at support@cognitivemind.ai. Contact details are at the end of this notice.

1. Who follows this notice

This notice is given by NGDB.AI LLC and the Registered Dietitians who provide care through CognitiveMind ("we", "us"). CognitiveMind.AI, Inc. runs the CognitiveMind website, app and video service for us as our business associate, and must protect your information as this notice describes.

It applies to your health information: information that identifies you and relates to your physical or mental health, the care you receive, or payment for that care. Federal law calls this protected health information, or PHI.

2. Our duties

  • We are required by law to keep your health information private and secure, and to give you this notice of our legal duties and privacy practices.
  • We must follow the notice that is currently in effect.
  • We will tell you promptly if a breach occurs that may have compromised the privacy or security of your information.
  • We will not use or share your information in ways other than those described here unless you give us permission in writing.
  • When we use or share information, we limit it to the minimum needed for the purpose, except where the law does not require that, such as for your treatment.

3. How we use and share your health information

For your treatment

To provide and coordinate your nutrition care. For example, your dietitian reviews your health history and any lab results you upload, records your visit and writes your plan. We may share information with your doctor or another clinician involved in your care, for example to coordinate a referral.

For payment

To bill and collect payment for your care. For example, we record your payment, apply session credits, process refunds and respond to card disputes, sharing only what is needed with our payment processor. Visits through CognitiveMind are self-pay; we do not send your information to a health plan unless you ask us to.

For our health care operations

To run our practice and improve care. For example, we review the quality of visit notes, train staff, manage schedules, carry out audits and legal and compliance work, and keep the systems that protect your information secure.

Reminders and service messages

We use your contact details to send booking confirmations, reminders, calendar invitations, secure messages and visit alerts. Calendar invitations and device alerts use a plain title, such as “CognitiveMind visit”, rather than any health details. You can ask us to contact you in a different way (see Your rights).

Business associates

We use companies that provide services for us, such as hosting, our database, email, video connections and payment processing. Where they handle health information, they must agree in writing to protect it. HIPAA requires a business associate agreement with each vendor that stores or transmits health information for us, and we are putting those agreements in place.

Documentation tools and AI

With your agreement, your dietitian may use transcription during a visit to help write your note. It runs on your dietitian’s own computer, and the audio is not uploaded or stored. Drafting tools receive only text from which identifying details have been removed. Your dietitian reviews and signs every note. You can ask for transcription to be turned off at any time, and your care continues the same way. Turning it off stops new capture; it does not erase a record that already exists.

People involved in your care

We may share relevant information with a family member, friend or other person you name who is involved in your care or helps pay for it, if you agree, or if you are present and do not object. If you are not able to agree, for example in an emergency, we may share it if we believe it is in your best interest. You can tell us not to.

De-identified information

We may create information that no longer identifies you, following the HIPAA de-identification rules. It is then no longer PHI.

4. Other uses and disclosures the law allows or requires

We may use or share your information without your written permission in the situations below, only as the law allows and under the conditions it sets:

  • When a federal, state or local law requires it.
  • For public health activities, such as preventing or controlling disease, reporting problems with medicines or products to the Food and Drug Administration, and product recalls.
  • To report suspected abuse, neglect or domestic violence to the authorities, as the law requires or permits.
  • To health oversight agencies, for audits, investigations, inspections and licensing.
  • In a lawsuit or other legal proceeding, in response to a court or administrative order, or to a subpoena or other lawful request when the law’s conditions are met.
  • To law enforcement, in limited situations, such as in response to a warrant or court order, or to help identify or locate a suspect, fugitive, witness or missing person.
  • To coroners, medical examiners and funeral directors.
  • To organizations that handle organ, eye or tissue donation.
  • For research that meets the law’s privacy protections. We do not currently use health information for research.
  • To prevent or lessen a serious and imminent threat to the health or safety of a person or the public.
  • For specialized government functions: military and veterans’ activities, national security and intelligence, protective services for the President and others, and correctional institutions or custody.
  • For workers’ compensation and similar programs.
  • To the U.S. Department of Health and Human Services, when it checks that we are complying with federal privacy law.

5. Uses that need your written permission

  • Psychotherapy notes: we do not keep psychotherapy notes. If we ever did, we would need your permission to use or share them in most cases.
  • Marketing: we will not use or share your information for marketing without your written permission.
  • Sale of health information: we never sell your health information.
  • Any other use or disclosure not described in this notice.

You can withdraw your permission at any time by writing to us at support@cognitivemind.ai. Withdrawing does not undo anything we did while we had your permission.

We do not use your information for fundraising.

6. Stronger state privacy laws

Some state laws protect certain health information more strongly than federal law, for example information about mental health, HIV and sexually transmitted infections, substance use, reproductive and sexual health, and genetic testing. Where a stricter state law applies to your care, we follow it. In Washington, this includes the Uniform Health Care Information Act (chapter 70.02 RCW).

7. Your rights

To use any of these rights, email support@cognitivemind.ai or write to us at the address at the end of this notice. We may ask you to make a request in writing and to confirm your identity.

See and get a copy of your health information

You can ask to see or get a copy of the health information we hold about you, on paper or electronically, or ask us to send it to someone you choose. Much of it is already in your account. We will respond within 30 days; if we need more time, we will tell you why and when to expect it, within 30 more days. We may charge a reasonable, cost-based fee, and will tell you the amount first. In limited cases we may deny a request, and you can ask for that decision to be reviewed.

Ask us to correct your health information

If you think information in your record is wrong or incomplete, you can ask us to correct it. We will respond within 60 days. If we say no, we will explain why in writing, and you can send a statement of disagreement to be kept with your record.

Ask for confidential communications

You can ask us to contact you in a particular way, such as at a different email address or mailing address. We will agree to every reasonable request, and we will not ask why.

Ask us to limit what we use or share

You can ask us not to use or share certain information for treatment, payment or our operations. We do not have to agree, and may say no if it would affect your care. But if you pay for a service in full yourself, you can ask us not to share information about it with your health plan for payment or operations, and we will agree unless the law requires us to share it. Because CognitiveMind visits are self-pay, this applies to them.

Get a list of those we have shared your information with

You can ask for a list of the times we shared your health information in the six years before your request, who we shared it with and why. It will not include disclosures for treatment, payment or operations, or certain others, such as those you asked us to make. We provide one list a year free; for another within 12 months we may charge a reasonable, cost-based fee.

Get a copy of this notice

You can ask for a paper copy of this notice at any time, even if you agreed to receive it electronically. You can also print this page.

Choose someone to act for you

If you have given someone medical power of attorney, or someone is your legal guardian, that person can use your rights and make choices about your health information. We will check that they have this authority before we act.

Be told about a breach

We will notify you if a breach affects your unsecured health information.

8. How to complain

If you believe your privacy rights have been violated, you can complain to our Privacy Officer at support@cognitivemind.ai, or by phone at +1 (646) 585-9395.

You can also complain to the U.S. Department of Health and Human Services Office for Civil Rights by writing to 200 Independence Avenue, S.W., Washington, D.C. 20201, by calling 1-877-696-6775, or online at www.hhs.gov/ocr/privacy/hipaa/complaints.

We will not retaliate against you in any way for filing a complaint.

9. Changes to this notice

We can change the terms of this notice, and the changes will apply to all the information we have about you, including information we held before the change. The new notice will be available on this page and in the app, with its effective date, and we will give you a copy on request.

Before your first visit, we ask you to confirm in the app that you have received this notice.

10. Contact and effective date