HIPAA Notice of Privacy Practices

Head Clear is a digital coordination platform operated by The Focus Lab, developed under the guidance of Dr. Michael K. Mens, Ph.D. When you use the DPT Method™ (Doctor · Parent · Teacher) features inside Head Clear, The Focus Lab acts as a Business Associate under the Health Insurance Portability and Accountability Act of 1996 ("HIPAA") on behalf of you and your child's care team.

• Child name, date of birth, grade, and school
• Medical diagnosis (e.g. ADHD)
• Medication behavioral observations
• Teacher assessments, scores, and structured notes
• Doctor observations and care notes
• AI-generated clinical summary reports
• Audit metadata (who accessed what data, when, and from where)

We use PHI strictly for permitted purposes:

• Treatment coordination — sharing observations between authorized parents, teachers, and doctors.
• Care management — generating reports and trend summaries to support clinical decisions.
• Operations — maintaining secure, reliable, and compliant service delivery.

• We never sell PHI to anyone.
• We never use PHI for marketing or advertising.
• We never use PHI for research without separate, explicit, written authorization.
• We never disclose PHI to a third party except as required to operate the service or as required by law.

• Access — request a copy of all PHI we hold about your child.
• Amend — request corrections to inaccurate or incomplete PHI.
• Accounting of disclosures — request a list of who has accessed your child's PHI.
• Restrict — request limits on certain uses or disclosures.
• Confidential communications — ask us to contact you in a specific way.
• Revoke access — instantly revoke any team member's access to your child's data.
• Withdraw consent — withdraw your DPT consent at any time. Future PHI collection will stop.
• Request deletion — request complete deletion of all PHI within 30 days.

• We are required by law to maintain the privacy and security of your child's PHI.
• We must follow the duties and privacy practices described in this Notice.
• We must notify you promptly if a breach occurs that may have compromised the privacy or security of your child's PHI.
• We must obtain your written consent before using or disclosing PHI for purposes outside this Notice.

In the event of a breach of unsecured PHI, we will notify you without unreasonable delay and in no case later than 60 calendar days after the breach is discovered, in accordance with the HIPAA Breach Notification Rule (45 CFR §§ 164.400–414). Notifications will describe what happened, what information was involved, what we are doing about it, and what you can do to protect yourself.

If you believe your privacy rights have been violated, you may file a complaint with us at privacy@thefocuslab.org or with the U.S. Department of Health and Human Services, Office for Civil Rights at hhs.gov/ocr/privacy/hipaa/complaints. You will not be retaliated against for filing a complaint.