Here is the honest version for a clinician in New York, New Jersey, or Connecticut who bills through an aggregator: what is actually being collected, who it reaches, why "you can't opt out" is the part that should bother you, and what a private-practice therapist can do about it.
What Headway is actually collecting
Two things. A photo of a valid government-issued ID, and a facial scan you take with your device's camera. The face check is not a still selfie. Users are asked to move their head side to side so the system can confirm a live person is present and not an AI-generated deepfake. That biometric — a scan of your face geometry — gets processed by Persona, an outside identity-verification vendor, not by Headway's clinical team.
Headway told clients about this in an email dated April 3, 2026. The message read, in part, "To make sure Headway stays a safe and reliable place to get care, you'll soon be asked to verify your identity by taking a picture of a valid government-issued photo ID in your portal," and stated that "The facial image is never used for anything but identity verification" (404 Media, May 28, 2026).
The reassurance is worth reading closely. "Never used for anything but identity verification" is a statement about use. It is not a statement about who holds the data, how long they hold it, where it is stored, or what a future policy revision could permit. Those are the questions a biometric actually raises, and they are the ones the sentence steps around.
Who it reaches, and why "prescribers first" doesn't stay there
The requirement already applies to every provider on the platform. For clients, it is rolling out in waves through spring and summer 2026, starting with patients of prescribers — people getting medication management — per 404 Media and Behavioral Health Business (both May 28, 2026). If a client only sees a talk therapist, verification is not required of them yet.
There is a real regulatory reason to start with prescribers. Telehealth prescribing of controlled substances carries a federal identity-verification obligation under the Ryan Haight Act. So the medication-management piece has a defensible legal anchor. The problem is that Headway is not stopping there. The mandate covers all providers and is expanding toward all clients, which is a long way past what the controlled-substance rule requires. A narrow legal duty is being used as the on-ramp for a platform-wide biometric gate.
This matters because of who Headway is. It is not a small operation experimenting at the edges. Headway raised a $100M Series D in 2024 that roughly doubled its valuation to about $2.3 billion, and the company says it powers more than 600,000 therapy appointments a month across 70-plus insurance plans (FierceHealthcare, 2024). When an intermediary at that scale sets a term, it becomes the default for tens of thousands of clinicians and their caseloads at once.
"No opt-out" is the part that should bother you
Headway's own biometric data policy says the company will inform users how to opt out of biometric data collection. When 404 Media asked directly whether users could opt out, Headway said no (404 Media, May 28, 2026). The only exit is to leave the platform.
Sit with what that means on both sides of the video window. Your client, who may have spent months building enough trust to show up at all, is told to hand a government ID and a face scan to a vendor they have never heard of or lose access to their care. You, the clinician, are told the same about your own license and identity. Neither of you was part of the decision. The company in the middle made it, and the cost of refusing falls on the two people doing the actual clinical work.
For some clients the calculus is not abstract. A person with a stalking history, a client whose immigration status makes any ID request feel dangerous, a trans client whose government ID does not match who they are in the room — for them, "just verify your identity" is not a formality. It is a reason to disappear from treatment. And a client who drops out over a platform requirement does not experience it as Headway's decision. They experience it as something that happened in their therapy.
There is a legal frame worth knowing here, though it is not legal advice. Illinois' Biometric Information Privacy Act treats a scan of face geometry as protected biometric data, requires informed consent before collection, and gives individuals a private right of action with statutory damages of $1,000 per negligent violation and $5,000 per intentional one (ACLU of Illinois). State biometric law is uneven, and most states have nothing like BIPA. But the existence of that statute tells you the category: a face scan is not the same kind of data as a copay, and consent that amounts to "comply or lose care" is a thin version of the informed consent the strictest biometric laws contemplate.
The middleman is charging the relationship for its own risk
Strip away the specifics and here is the shape of it. An aggregator sits between the clinician and the payer. It exists to make credentialing and billing easier, which is a real service that a lot of tired solo practitioners are glad to rent. Then the aggregator picks up a fraud-and-deepfake problem that is genuinely its own — bad actors, synthetic identities, payment integrity across a huge network — and it solves that problem by collecting biometrics from the two parties who did not create it. The provider and the client absorb the surveillance so the platform can lower its risk.
That is the pattern to name, and it is not about anyone at Headway being a villain. It is about what the middle of the stack does when it gets large enough. The intermediary's incentives and the clinician's incentives stop pointing the same direction. The platform optimizes for network-wide fraud control; the clinician is trying to protect one fragile working alliance. When those collide, the clinician does not get a vote, and the client definitely does not.
You saw a smaller version of this with note-taker add-ons and data-retention terms that changed after clinicians had already built their workflows on them. The biometric mandate is the same move at a higher stakes level. The terms of the therapeutic frame keep getting rewritten upstream, by companies whose relationship to your client is a row in a database.
What a NY/NJ/CT clinician can actually do now
You do not control Headway's policy. You do control how exposed your practice is to it.
- Read Headway's biometric data policy and identity-verification pages yourself, not the summary. Know what is collected, who processes it, and the stated retention before you field a single client question. Headway's own help-center page is the place to start.
- Get ahead of the client conversation. Clients in medication management are being verified first. If yours are, they will ask you why, and "the platform requires it" is a weaker answer than a clear, calm explanation of what it is and what it is not. Prepare it before the question arrives.
- Know your state's biometric and privacy rules, and where your liability sits when a third party collects your clients' data through your service relationship. This is a question for your own counsel or compliance support, not for a vendor FAQ.
- Reduce single-platform dependence. The deeper risk is not this one requirement. It is that when your intake, scheduling, and identity all live inside one intermediary, that intermediary can change the terms of your practice unilaterally and your only leverage is to leave. Every piece of infrastructure you own instead of rent is a term someone else cannot rewrite on you.
That last point is the whole argument for keeping the connective tissue of your practice under your own roof. Owning your intake and practice infrastructure — instead of renting your identity, your schedule, and your client relationships to an aggregator — is exactly the problem VibeCheck.luxury is built by a clinician to solve. You can run the front door of your practice without handing the keys to the company in the middle.
Aggregators are not going away, and for plenty of clinicians the billing convenience is worth it. But a platform that can require a face scan with no opt-out is a platform that can require the next thing too. The move is to notice that now, while it is still a policy email and not yet the only way you can see your clients.
FAQ
What exactly does Headway's identity verification require?
A photo of a valid government-issued ID plus a live facial scan taken with your device camera, where you move your head side to side to prove you are a real person and not a deepfake. The scan is processed by a third-party vendor, Persona (404 Media, May 28, 2026).
Does it apply to therapists or only clients?
Both. Every provider on Headway is required to complete it. Client verification is rolling out in waves through 2026, starting with patients who receive medication management; talk-therapy-only clients are not required yet (Behavioral Health Business, May 28, 2026).
Can a therapist or client opt out of the facial scan?
No. Headway confirmed to 404 Media that there is no opt-out; the only alternative is to leave the platform and lose access to care through it (404 Media, May 28, 2026).
Is collecting a client's face scan legal?
It depends on your state. Illinois' Biometric Information Privacy Act sets strict consent rules and statutory damages for face-geometry data, but most states have no equivalent, and federal telehealth rules require identity checks for controlled-substance prescribing. Confirm your own obligations with qualified counsel rather than a vendor FAQ.