Version 1.6.1 — Last Updated: August 4, 2026 · Effective Date: August 5, 2026
This notice explains TMatch's role when HIPAA applies. It is not a healthcare Provider's Notice of Privacy Practices and does not replace the notice provided by your therapist, practice, clinic, school, or other Covered Entity.
1. TMatch and HIPAA
TMatch is a service operated by Tmind AI Inc., doing business as TMatch. TMatch is not a healthcare provider. When TMatch creates, receives, maintains, or transmits PHI on behalf of a HIPAA Covered Entity, TMatch may act as that entity's Business Associate.
The Covered Entity and TMatch enter into a Business Associate Agreement that defines permitted uses and disclosures of PHI, required safeguards, incident reporting, subcontractor obligations, and other HIPAA responsibilities.
2. Our Role
Depending on the services selected by a Covered Entity, TMatch may support Provider matching, intake, care navigation, scheduling, reminders, communication, self-pay payment support, telehealth access or integrations, Client support, security, and related platform operations.
Tracy may help collect and organize information, create non-diagnostic intake summaries, and support matching and navigation. Tracy does not provide clinical care, diagnosis, treatment, medical advice, crisis intervention, clinical supervision, or emergency services.
3. Uses and Disclosures of PHI
When HIPAA applies, TMatch may use or disclose PHI only as permitted by the applicable Business Associate Agreement, HIPAA, and other law. Permitted activities may include:
Providing the contracted platform services to the Covered Entity.
Supporting matching, navigation, intake summaries, scheduling, reminders, communications, telehealth access or integrations, payments, refunds, disputes, security, and support where applicable.
Managing and administering TMatch and carrying out legal responsibilities as permitted by the Business Associate Agreement and HIPAA.
Creating information that is de-identified in accordance with HIPAA when authorized.
Responding to valid legal, regulatory, safety, security, audit, or reporting obligations.
4. Safeguards and Incident Response
When HIPAA applies, TMatch uses administrative, technical, and physical safeguards designed to protect PHI and complies with applicable HIPAA Security Rule requirements for electronic PHI.
TMatch requires applicable subcontractors that create, receive, maintain, or transmit PHI to agree to appropriate restrictions and safeguards. If TMatch discovers a Breach of Unsecured PHI or another reportable incident, TMatch will notify the applicable Covered Entity as required by HIPAA and the Business Associate Agreement.
5. Individual Rights and Requests
HIPAA may give you rights to request access, amendment, restrictions, confidential communications, or an accounting of certain disclosures. The healthcare Provider, practice, clinic, school, placement site, or other Covered Entity responsible for your care or record generally receives and decides these requests.
You may contact hi@tmind.ai, and TMatch will help route a request or assist the Covered Entity where required by the applicable Business Associate Agreement.
6. Non-HIPAA Health Information
Some health-related information handled through TMatch may not be PHI under HIPAA. That information may still be protected by Washington's My Health My Data Act, other state or provincial privacy laws, consumer health data laws, professional confidentiality, contract, or the TMatch Privacy Policy.
7. Provider Responsibilities
Providers and Covered Entities remain responsible for their own HIPAA compliance, Notice of Privacy Practices, patient or Client authorizations, treatment and telehealth consent, clinical records, workforce access, minimum necessary policies, and legal responses to individual requests.
8. Contact
Questions about TMatch's HIPAA practices may be sent to hi@tmind.ai.
Tmind AI Inc., doing business as TMatch
1100 NE Campus Pkwy,
Suite 200,
Seattle, WA 98195