Headway complies with HIPAA law through end-to-end encryption on the website, encrypted email, BAA agreements with any third-party vendors, and protection of PHI. Their privacy policy describes how they collect, use, and protect data about their users.