Privacy Policy
- Effective date:
- October 29, 2026
- Last updated:
This policy explains what information CognitiveMind collects through our website, app and video visits, why we collect it, who we share it with, how long we keep it, and the choices and rights you have. We have tried to write it in plain English. If anything is unclear, email us at support@cognitivemind.ai.
1. The short version
- We do not sell your information. We do not use advertising cookies, ad pixels or third-party analytics.
- Health information you share for your care is protected by federal law (HIPAA). Our HIPAA Notice of Privacy Practices explains how it is used and the rights you have over it. This policy covers everything else, and explains how the two fit together.
- Your card details go straight to our payment processor, Stripe. They never reach our servers.
- Secure messages and their attachments are encrypted when we store them.
- AI tools that help dietitians write notes receive text with identifying details removed. We do not send information that identifies you to an AI vendor.
- Washington law gives you specific rights over consumer health data. They are set out in the Washington section, and we apply the same commitments wherever you live.
2. Who we are and what this policy covers
CognitiveMind.ai is operated by CognitiveMind.AI, Inc., a Delaware corporation based in Seattle, Washington ("CognitiveMind", "we", "us"). We run the website at cognitivemind.ai, the patient and provider app, our video visit service and the systems behind them.
Nutrition care is provided by Registered Dietitians who see patients through CognitiveMind, through NGDB.AI LLC.
When you become a patient, the health information you share with your dietitian, and the records created during your care, are protected health information ("PHI") under HIPAA. Our HIPAA Notice of Privacy Practices describes how PHI is used and shared and the rights you have. Where both documents speak about PHI, the HIPAA Notice controls.
This policy covers everything else: people who visit our website, join a waitlist or contact us; account and payment records; and dietitians who apply to work with us or contract with us. Dietitians who contract with us are also covered by the terms of their agreement.
3. Information we collect
Information you give us
- Account details: your name, email address, password (we store only a scrambled, one-way version, never the password itself), time zone and account type.
- Patient profile: date of birth, sex, phone number, mailing address, emergency contact, preferred language, height and weight.
- Health history: the conditions, symptoms, goals, allergies, medications and supplements you choose to tell us about.
- Booking details: the dietitian and time you choose, the US state you will be in for the visit, and your acceptance of the policies that apply to it.
- Secure messages you send your care team, and the files you attach to them.
- Lab results and other documents you upload.
- Consent and agreement records: which documents you accepted, which version, and when.
- Waitlist sign-ups: your email address and the state you are waiting for.
- Support requests and anything else you send us by email.
- For dietitians: professional details such as your name, credentials, license and NPI numbers, practice states and work history, and the information needed for contracting and payment.
Information created during your care
Your dietitian creates records of your care, such as your appointment history and the visit notes they review and sign. With your agreement, a visit may be transcribed to help with notes (see AI and note-taking tools). These records are PHI and are covered by the HIPAA Notice.
Information collected automatically
- A sign-in cookie that keeps you signed in (see Cookies and browser storage).
- How you found us: when you first arrive, your browser keeps the campaign tags in the link you followed (such as utm_source), the domain of the website that sent you, and the path of the first page you saw, with any ID numbers removed. This stays in your browser for up to 30 days and reaches us only if you book a visit or apply as a dietitian.
- Technical details sent with every request, such as your IP address and browser type. We use them to keep the service secure, to limit abuse, and to record evidence that you accepted a policy, such as the no-show policy you accept at checkout.
- Security records: we keep an audit record of sign-ins, bookings, cancellations, payment events and access to clinical notes. These records identify accounts by ID number.
We do not use third-party analytics, advertising pixels, session-replay tools or any tracking across other websites.
Information from other sources
- Stripe tells us whether a payment, refund or card dispute succeeded.
- Dietitians who connect Google Calendar let us see when they are busy, so we can offer open times. We do not read the details of their other events.
- For dietitians, we may confirm credentials using public professional registries, such as the national NPI registry and state license lookups.
4. How we use information
- To create and run your account, book visits, and connect you with your dietitian by video.
- To send the messages the service needs: booking confirmations, reminders, calendar invitations, payment notices, password resets and security alerts.
- To take payments, apply session credits, process refunds and handle fees and card disputes.
- To check that a dietitian may see you in the state you will be in at the time of your visit.
- To keep CognitiveMind secure: preventing fraud and abuse, investigating problems and keeping audit records.
- To comply with the law and with professional and record-keeping duties, and to respond to lawful requests.
- To learn which pages and links bring people to us, using the how-you-found-us details described above.
- To improve the service, using information that is combined across many people or de-identified.
- To review applications from dietitians, verify credentials, and manage their agreements and payments.
We do not make decisions about you by automated means alone that have legal or similarly significant effects. We do not use your information to train AI models.
5. AI and note-taking tools
Some CognitiveMind features use artificial intelligence to help dietitians with paperwork. They are documentation aids only. Your dietitian decides what goes into your record, and reviews and signs every note.
- Transcription: with your agreement, your dietitian may turn on transcription during a visit. It runs on your dietitian’s own computer, and the audio of your visit is not uploaded to or stored by CognitiveMind. The visit screen shows whether recording and transcription is off, waiting for consent, or on, and you can have it turned off at any time. If you would rather not, your dietitian documents the visit by hand, and your care continues the same way.
- Drafting help: before any text is sent to an AI service, our system removes identifying details such as names, dates, contact details, addresses and ID numbers, following the HIPAA “Safe Harbor” list of identifiers. We send drafting requests through OpenRouter to the AI model providers it connects us with. We do not send information that identifies you to any AI vendor.
- Working transcripts are encrypted when stored, and are set to be deleted 30 days after your dietitian finishes the note, unless they must be kept as part of your medical record, for a legal hold or to meet another legal duty.
- Turning transcription off stops new capture. It does not erase a medical record that has already been created.
8. How long we keep information
We keep information only as long as we need it for the purposes in this policy, and longer only when the law, a professional rule or a legal dispute requires it.
- Medical records, including signed visit notes: kept for at least as long as the law of the state where you received care requires.
- Working visit transcripts: no longer than 30 days after the note is finished, with the exceptions described in AI and note-taking tools.
- Payment and billing records: kept for as long as tax and accounting law requires.
- Dietitian agreements and their signing records: seven years after the later of the end of the agreement or final settlement, or longer if the law, a payer or a dispute requires it.
- Security and audit records: kept for at least six years. Our application cannot change or delete them.
- Waitlist sign-ups: kept until you ask us to remove you or the waitlist closes.
- How-you-found-us details in your browser: 30 days. The sign-in cookie: 8 hours.
Closing an account does not erase a medical record or a signed agreement that we must keep. When we no longer need information, we delete or de-identify it through an authorized process that we record.
9. How we protect information
- In transit: connections to CognitiveMind are encrypted (HTTPS). Video and audio are encrypted between the people in the call, and travel directly between devices where possible, or through our own relay server when they cannot.
- At rest: secure messages, their attachments and working transcripts are encrypted with AES-256 before we store them, and our database and file storage providers also encrypt the data they hold. This is not end-to-end encryption: our systems decrypt messages to show them to you and your care team.
- Access: every request is checked on our servers, so patients see only their own records and dietitians only the patients they care for.
- Audit records of sign-ins, bookings, cancellations, payments and access to clinical notes.
- Passwords are stored only as one-way hashes, repeated failed sign-ins lock an account for 15 minutes, and sessions end after 8 hours.
- Our system logs record ID numbers, not names, email addresses, dates of birth, notes or passwords.
- Card numbers are handled by Stripe and never reach our servers.
No system is perfectly secure. If a breach affects your information, we will tell you and the authorities as the law requires.
10. Your choices and rights
Wherever you live, you can ask us to:
- Tell you what personal information we hold about you, and give you a copy.
- Correct information that is wrong.
- Delete your information. We will delete what we can, but we must keep medical records, signed agreements, payment records and security records for as long as the law requires. We will tell you what we kept and why.
- Withdraw a consent you gave us. This does not undo what we did before you withdrew it.
- Stop non-essential email. We do not send patients marketing email unless they ask for it. Messages about your account, visits and payments are part of the service.
You can turn visit alerts off in your browser or device settings, and you can close your account by emailing us. For PHI, the HIPAA Notice explains your rights to see, copy and correct your health record, and your other rights.
How to make a request
Email support@cognitivemind.ai from the address on your account. We will confirm your identity before we act, using information we already hold. You can ask someone to make a request for you; we will ask for proof that you authorized them. We answer within 45 days. If we need longer, we will tell you why, and take no more than 45 extra days. Requests are free.
If we turn down a request, we will explain why and how to appeal. To appeal, reply to our answer with the word “Appeal”. We will answer within 45 days. If you are not satisfied with the result, you can contact your state attorney general. We will never treat you differently for using your rights.
11. Washington consumer health data privacy policy
Washington’s My Health My Data Act protects “consumer health data”: personal information that is linked or reasonably linkable to you and that identifies your past, present or future physical or mental health. This section is our consumer health data privacy policy. It applies to Washington residents and to anyone whose consumer health data we collect in Washington. PHI covered by HIPAA is governed by our HIPAA Notice instead.
The consumer health data we collect
- That you are looking for nutrition care, for example when you create an account, book a visit or join a waitlist.
- The first page you landed on, which may be a page about a health condition (part of the how-you-found-us details).
- Health details you choose to put in an email or support request.
- Any other information listed in Information we collect that reveals something about your health.
Why we collect it, and where it comes from
We collect it from you and from your browser, and use it only to provide the service you asked for: creating your account, booking and holding your visits, communicating with you, taking payment, keeping the service secure and meeting our legal duties.
Who we share it with
We share consumer health data only with the service providers listed in Who we share information with, which process it for us under contract, and with your dietitian and care team.
Our commitments
- We collect consumer health data only when it is necessary to provide the product or service you asked for, or with your consent.
- We share it only when that is necessary to provide what you asked for, or with your separate consent.
- We never sell consumer health data.
- We do not use geofencing around health care facilities, and we do not use consumer health data for advertising.
Your rights
- Confirm whether we collect, share or sell your consumer health data, and see it.
- Get a list of every third party and affiliate we have shared it with, with their contact details.
- Withdraw your consent to our collecting or sharing it.
- Have it deleted. We will also tell the service providers and third parties that received it to delete it, including from archives and backups.
To use these rights, email support@cognitivemind.ai. We follow the process in How to make a request: an answer within 45 days (extended by up to 45 more days only when necessary, with notice), free of charge, and an appeal if we say no. If your appeal is denied, you can contact the Washington State Office of the Attorney General.
Nevada and Connecticut have similar consumer health data laws. We give residents of those states, and everyone else, the same commitments and rights.
12. California privacy rights
This section adds detail required by the California Consumer Privacy Act, as amended by the California Privacy Rights Act. Medical information protected by HIPAA or California’s Confidentiality of Medical Information Act is governed by those laws and our HIPAA Notice. We offer the rights below to California residents whether or not the Act applies to us.
What we collected in the last 12 months
- Identifiers and contact details, such as name, email address, phone number, mailing address and IP address.
- Personal characteristics, such as age (from date of birth) and sex.
- Commercial information, such as visits and packages bought, session credits and refunds.
- Internet activity, limited to the how-you-found-us details and the requests your browser makes to our servers.
- Professional information, for dietitians.
- Sensitive personal information: account sign-in details and health information.
The sources, purposes and recipients are described in Information we collect, How we use information and Who we share information with. We disclose these categories to our service providers for business purposes only. We do not sell or share personal information, as those words are defined in the Act, and have not done so in the last 12 months. We do not knowingly sell or share the information of anyone under 16.
We use sensitive personal information only to provide the service you asked for and for the other purposes the Act permits, so the right to limit its use does not apply. How long we keep each category is described in How long we keep information.
Your California rights
You can ask to know what we collect, use and disclose; to get a copy; to correct it; and to delete it. Use the process in How to make a request. An authorized agent may make a request for you. We will not discriminate against you for using these rights. We do not share personal information with others for their direct marketing, so California’s “Shine the Light” law gives you nothing to opt out of.
13. Other US state privacy laws
Colorado, Connecticut, Oregon, Texas, Virginia and a growing number of other states give their residents rights over personal information: to access it, correct it, delete it, receive a portable copy, and opt out of targeted advertising, sale and profiling. We offer the access, correction, deletion and copy rights to everyone, through How to make a request, including the right to appeal. We do not sell personal information, use it for targeted advertising, or use it for profiling that produces legal or similarly significant effects, so there is nothing to opt out of.
14. Children
CognitiveMind is for adults 18 and older. We do not knowingly collect information from anyone under 18. If you believe a child has given us information, email support@cognitivemind.ai and we will delete it, except anything the law requires us to keep.
15. Where information is stored
CognitiveMind serves people in the United States, and we host our application and database in the United States.
16. Changes to this policy
When we change this policy, we will post the new version here and update the “Last updated” date. If a change is material, we will tell you by email or in the app before it takes effect. We will not use information we already hold in a materially different way without your consent.
17. Contact us
- Email: support@cognitivemind.ai
- Privacy Officer: Privacy Officer, reached at support@cognitivemind.ai
- Phone: +1 (646) 585-9395
- Mail: CognitiveMind.AI, Inc.; write to support@cognitivemind.ai for our mailing address