Headspace the company says it is only a tech platform — the actual therapy, psychiatry, and coaching services are legally provided by separate affiliated medical entities. This distinction affects what legal protections apply to your health data.
Because Headspace positions itself as a technology platform rather than a healthcare provider, your mental health data collected through the app may have weaker federal privacy protections than data held by a traditional therapist or psychiatrist's office, even though the content of that data is equally sensitive.
Cross-platform context
See how other platforms handle Healthcare Provider Entity Separation and similar clauses.
Compare across platforms →This structural separation may mean Headspace Inc. does not consider itself a HIPAA-covered entity, potentially limiting your federal health privacy protections for mental health information processed through the platform.
(1) REGULATORY FRAMEWORK: HIPAA 45 CFR Parts 160 and 164 apply to covered entities and their business associates — the key question is whether Headspace Inc. qualifies as a Business Associate of Headspace Medical Group (CA) P.C. under 45 CFR §160.103. FTC Act Section 5 and the FTC Health Breach Notification Rule (16 CFR Part 318) apply to non-HIPAA health data platforms. California Confidentiality of Medical Information Act (CMIA) Cal. Civ. Code §56 et seq. may apply to mental health data collected by technology platforms. HHS OCR enforces HIPAA; FTC enforces the Health Breach Notification Rule. (2)
Compliance intelligence locked
Regulatory citations, enforcement risk, and due diligence action items.
Watcher: regulatory citations. Professional: full compliance memo.