Working draft. Consistent with CONTEXT.md. Living document — review at least quarterly and on
any material change. Scoring: Likelihood (L) and Impact (I) each 1–5; Rating = L×I
(1–8 Low · 9–14 Medium · 15–25 High). Owners are roles, not named individuals yet.
Last updated: [PLACEHOLDER: date]
How to use
Each risk has an ID, category, description, L, I, Rating, mitigation(s), and owner. Re-score after
mitigations land (residual risk). ⚠️ flags cross-link to the policy/skill that addresses it.
A. Regulatory & legal
| ID |
Risk |
L |
I |
Rating |
Mitigation |
Owner |
| R-01 |
Fee-splitting / CPOM: the 15% is recharacterised as an unlawful split of clinical fees in some US states |
4 |
5 |
20 High |
Frame 15% as technology/marketing platform fee; MSO/friendly-PC where required; per-state counsel sign-off (see legal skill) ⚠️ COUNSEL |
Founder/Legal |
| R-02 |
Operating without authority in a US state (entity not qualified / not registered) |
3 |
5 |
15 High |
State-by-state qualification + registered agent before enabling bookings; state on/off switches gated by legal status |
Legal/Ops |
| R-03 |
Clinician licensure gap — client served by therapist not licensed in client's state |
3 |
5 |
15 High |
Hard product rule: licensure-by-client-location; compact handling; ongoing licence monitoring |
Product/Clinical |
| R-04 |
Telehealth consent / modality non-compliance per state |
3 |
4 |
12 Med |
Per-state informed consent capture; counsel review ⚠️ COUNSEL |
Legal/Product |
| R-05 |
Healthcare advertising rules breached (claims, testimonials) |
2 |
3 |
6 Low |
Marketing/legal review of claims; review controls |
Marketing/Legal |
| R-06 |
Regulatory change (telehealth policy, state laws) outpaces compliance |
3 |
3 |
9 Med |
Monitoring cadence; counsel relationship; agile state controls |
Legal |
| R-29 |
Corridor-choice / founder-convenience bias — first expat corridor steered by where the founder lives (Tokyo/Japan) rather than the legally cleanest market; Japan's posture is conservative/unsettled and the UAE is hostile (criminal exposure for unlicensed practice), risking a legal dead-end and wasted spend |
4 |
4 |
16 High |
Choose the legally cleanest corridor first (e.g. Ireland / English-speaking EEA); gate corridor entry on a local legal memo ⚠️ COUNSEL (see cross-border-legal-gate.md) |
Founder/Legal |
B. Clinical & safety
| ID |
Risk |
L |
I |
Rating |
Mitigation |
Owner |
| R-07 |
Client harm / crisis (suicide, self-harm) where platform/therapist response is inadequate |
2 |
5 |
15 High |
Crisis & Safeguarding Policy; screening/exclusion; persistent signposting (988/999); therapist training ⚠️ CLINICAL |
Clinical Lead |
| R-08 |
Unsuitable presentation taken on by cash-pay telehealth (high-acuity) |
3 |
4 |
12 Med |
Defined exclusion criteria & triage at intake (clinical governance) ⚠️ CLINICAL |
Clinical Lead |
| R-09 |
Poor quality of care / practitioner competence issues |
2 |
4 |
8 Low |
Credentialing, scope-of-practice limits, outcome monitoring, complaints route |
Clinical Lead |
| R-10 |
Duty-to-warn / mandatory reporting mishandled (state-variable) |
2 |
5 |
10 Med |
Per-state matrix of triggers/recipients/timeframes; therapist training ⚠️ COUNSEL/CLINICAL |
Clinical/Legal |
| R-11 |
Safeguarding of minors/vulnerable adults fails |
2 |
5 |
10 Med |
Safeguarding leads, reporting workflow, adults-only scope decision ⚠️ |
Clinical Lead |
C. Data, privacy & security
| ID |
Risk |
L |
I |
Rating |
Mitigation |
Owner |
| R-12 |
Data breach of special-category/PHI mental-health data |
3 |
5 |
15 High |
Security & DP Policy; encryption, RBAC, MFA, logging; pen testing; incident response |
Security Lead/DPO |
| R-13 |
No BAA / sub-processor gap — PHI flows to a vendor without a BAA |
3 |
4 |
12 Med |
BAA inventory; block PHI to non-BAA vendors ⚠️ COUNSEL/SECURITY |
Security/Legal |
| R-14 |
Unlawful international transfer (UK/EU → US) |
3 |
3 |
9 Med |
SCCs/UK IDTA; transfer risk assessment; residency controls ⚠️ COUNSEL |
DPO/Legal |
| R-15 |
Trackers/analytics on a health site trigger HIPAA/MHMDA exposure |
3 |
4 |
12 Med |
No health-data trackers; consent management; privacy review ⚠️ COUNSEL |
Product/DPO |
| R-16 |
Breach-notification timelines missed (ICO 72h / HIPAA / state AG) |
2 |
4 |
8 Low |
Incident-response runbook with jurisdiction matrix |
Security Lead/DPO |
D. Financial & commercial
| ID |
Risk |
L |
I |
Rating |
Mitigation |
Owner |
| R-17 |
CAC exceeds LTV — cash-pay acquisition uneconomic |
4 |
4 |
16 High |
Track CAC payback; lean spend; retention/sessions-per-client focus; organic channels (financial model) |
Founder/Growth |
| R-18 |
Take-rate pressure — 15% too low to cover costs, or undercut by rivals |
3 |
3 |
9 Med |
Validate vs benchmarks; premium/B2B revenue options; cost discipline |
Founder |
| R-19 |
Compliance cost overrun (50-state legal/registration) as bootstrapped |
4 |
3 |
12 Med |
Phase states; fixed-fee scoping; bundled registered-agent; approval gate on spend |
Founder/Legal |
| R-20 |
Payment failures / chargebacks / fraud |
2 |
3 |
6 Low |
Reputable processor; fraud controls; clear refund/no-show terms |
Ops/Finance |
| R-21 |
Runway risk (bootstrapped) |
3 |
4 |
12 Med |
Tight burn; contribution-margin-positive growth; milestone gating |
Founder |
E. Market & operational
| ID |
Risk |
L |
I |
Rating |
Mitigation |
Owner |
| R-22 |
Two-sided cold-start — can't balance supply & demand in a market |
4 |
4 |
16 High |
Seed supply first per market; narrow launch geography; tight liquidity loops |
Founder/Growth |
| R-23 |
Incumbent competition (BetterHelp, Talkspace, Headway et al.) |
4 |
3 |
12 Med |
Differentiation (fit, trust, therapist economics); niche/geographic focus |
Founder |
| R-24 |
Therapist churn / disintermediation (clients & therapists go off-platform) |
3 |
3 |
9 Med |
Non-circumvention terms; ongoing platform value (payments, admin, leads) |
Product/Ops |
| R-25 |
Key-person / capacity risk (lean bootstrapped team) |
3 |
3 |
9 Med |
Documentation; prioritisation; selective outsourcing |
Founder |
| R-26 |
Vendor dependency (video, payments, hosting outage) |
2 |
3 |
6 Low |
Reputable vendors; monitoring; contingency options |
Engineering |
| R-30 |
GTM funnel volume shortfall — 100 paying clients implies ~16,700 targeted visitors (~90/day) from a brand-new domain in the planned window; SEO + anti-self-promo expat communities can't deliver that in 6 months, so Stage 0 likely misses on demand volume |
4 |
4 |
16 High |
Re-sequenced GTM (therapist-led referral + paid validation); rebased timeline 9–12 months; funnel instrumented from day 1 |
Founder/Growth |
| R-31 |
Founder single-point-of-failure / bandwidth — solo bootstrapped founder must run supply + demand + product + per-corridor compliance + clinical simultaneously; predictable degradation of sales/retention work; key-person concentration (re-scores R-25 Higher) |
4 |
4 |
16 High |
Ruthless 60-day focus on clients + founding-therapist retention; line up clinical lead / fractional compliance; concentrate not over-seed |
Founder |
F. Reputational
| ID |
Risk |
L |
I |
Rating |
Mitigation |
Owner |
| R-27 |
Safety incident or breach → trust collapse in a trust-dependent category |
2 |
5 |
10 Med |
Strong safety/privacy posture; transparent comms; incident playbook |
Founder/Comms |
| R-28 |
Negative reviews / poor matches erode brand |
3 |
3 |
9 Med |
Quality matching, feedback loops, responsive support |
Product/Support |
| R-32 |
Trust-at-zero (no reviews/brand at launch) — "trust is the product" but the first ~30 clients must convert with zero reviews, zero brand and no track record in a high-stakes mental-health purchase |
3 |
4 |
12 Med |
Founder-as-guarantee; money-back first session; therapist credentials/testimonials front-loaded; verified badges + intro videos |
Founder/Growth |
Top risks to watch (rating ≥ 15)
- R-01 fee-splitting/CPOM · R-29 corridor-choice bias · R-17 CAC>LTV · R-30 GTM funnel
volume shortfall · R-31 founder single-point-of-failure · R-22 cold-start ·
R-16/R-12 data breach · R-02 operating authority · R-03 licensure gap · R-07 client crisis.
These map directly to the legal skill (R-01/02/03/29), the security & crisis policies (R-12/R-07), and
the financial model / GTM sections of the business plan (R-17/R-22/R-30/R-31). Corridor-choice (R-29)
also cross-links to
cross-border-legal-gate.md. Re-score quarterly.