Skip to content
BrainMeBack — Powered by HAAIS

Evidence & safety

What your compliance, security, and clinical teams will ask — answered upfront.

BrainMeBack is built so your review conversations are shorter. Everything below maps to questions hospital procurement, clinical, and security teams typically ask first.

Scientific foundations

Built on peer-reviewed cognitive neuroscience and nutritional psychiatry — not proprietary single-author frameworks.

Attention network cycle

Nutritional psychiatry

Facial rehabilitation

Citations reflect the literature foundations of the platform's clinical architecture. No individual researcher is named as an advisor.

Clinical architecture

Severity gating and dose-aware protocol design — not a black-box recommendation engine.

Rancho Los Amigos severity gating

Every module declares a minimum Rancho Los Amigos level (1–10) and a per-level difficulty cap, derived from clinical consensus. Exercises above the clinician-set access band are surfaced with rationale for clinician review — never silently dropped.

Session rhythm — alerting, focused practice, recovery

Sessions follow a three-phase rhythm mapped to the canonical attention networks in cognitive neuroscience — alerting, executive engagement, and default-mode recovery (Posner & Petersen, 1990; Petersen & Posner, 2012; Raichle et al., 2001). Cognitive sets can begin with a brief optional settling protocol cited to Balban et al. (2023), followed by focused practice and a recovery break at the end. Ratios and durations are configurable under clinician supervision.

Adaptive within bounds, never outside them

In-session difficulty adapts within the clinician-prescribed tier — never across it. Focus Forge uses static stimulus-ratio tiers (Foundational / Intermediate / Advanced); the engine adapts duration, ISI, and distractor complexity inside those bounds only.

Built for use with cognitively-impaired patients

BrainMeBack is designed for use under clinician supervision with patients whose cognitive capacity may be impaired by injury, stroke, or disease. The platform does not make treatment recommendations directly to the patient — every prescription, severity assessment, and protocol change remains the responsibility of the supervising clinician. Capacity to consent should be assessed by the supervising clinician per institutional policy; legally authorized representative (LAR) workflows are supported.

Clinician-managed safeguards

The platform supports — but does not replace — the supervising clinician's decisions about exclusion and escalation. Screening considerations the prescribing clinician owns include:
  • Photosensitivity / seizure history for modules with rapid visual contrast or alternating stimuli
  • Vestibular or oculomotor symptoms for modules with sustained gaze tracking
  • Post-concussion exercise intolerance prior to motor-cortex modules (Finger Flow family)
  • Behavioral-health escalation pathway for Mood Mind and any module that surfaces emotional content
  • Family / caregiver involvement per Safe Steps ADL caregiver-mode and per institutional discharge protocol

These are considerations for the supervising clinician — not platform-level medical determinations. BrainMeBack does not screen or exclude on its own.

Regulatory posture

Designed to support clinician-reviewed CDS workflows — not positioned as a regulated device.

21st Century Cures Act §3060 — CDS-aware design

BrainMeBack is designed to support clinician-reviewed workflows consistent with the Clinical Decision Support framework in FD&C Act §520(o)(1)(E), as added by §3060 of the 21st Century Cures Act, and FDA's September 2022 CDS Final Guidance:
  1. The platform does not acquire, process, or analyze a medical image, an in-vitro diagnostic signal, or a pattern from a signal-acquisition system.
  2. It displays, organizes, and supports review of structured cognitive-rehabilitation information about a patient.
  3. It presents clinician-facing protocol and configuration options for non-time-critical rehabilitation support.
  4. Each option is designed to surface its basis so the supervising clinician can independently review that basis before acting.

The platform is not intended for time-critical clinical decision-making and is not a substitute for clinical judgment. Regulatory positioning should be reviewed with counsel for each deployment context.

What BrainMeBack is not

Not a digital therapeutic. Not a Class II device. Not a diagnostic tool. We do not refer to the platform as “DTx” and we don't market against device-cleared peers. Clinician-supervised cognitive exercises is the core category language used in our materials.

Designed to support survey workflows

Hash-chained audit log of PHI access, prescription changes, and overrides, exportable to CSV in formats designed for survey reviewers (TJC, CARF) and internal audit teams. Off-platform integrity attestation (daily signed root digest) is on the post-seed roadmap.

Security posture

HIPAA-aligned architecture designed for BAA-backed healthcare deployment.

Field-level PHI encryption

Patient identifiers, clinical notes, and free-text fields are designed to be encrypted at the field level using the platform cryptographic boundary. Encryption coverage and key-management practices are detailed in the security overview, available under NDA.

Session and lock policy

15-minute idle session timeout. 2-minute background lock on the patient app. Optional biometric re-auth (Face ID / Touch ID). For deployments that connect to an EHR via SMART on FHIR, OAuth tokens are designed to be encrypted at rest with AES-256-GCM in __Host- prefixed cookies.

Multi-tenant by Row-Level Security

Postgres Row-Level Security is designed to enforce per-clinician patient isolation server-side. A signed-in clinician sees only their assigned caseload — even a misbehaving client query should not cross the boundary.

Consent, in 8 languages

HIPAA authorization, data usage, research participation, clinician data sharing, and third-party integration consents are authored in English, Spanish, French, Portuguese, Mandarin, Arabic, Hindi, and Filipino. Per-locale legal review status is surfaced in the dashboard.

Want the full security overview?

HIPAA Business Associate Agreement template and a written security overview (architecture, encryption, audit-log design, subprocessor list) are available under NDA. Independent SOC 2 and penetration-test reports are in the work plan for the post-seed milestone — until then we'll share roadmap and remediation commitments directly with your security team.

Request access
Evidence & safety · BrainMeBack