Mental health apps & your privacy
What you share about your mind deserves care. A few checks help you stay in control of your story.
By the numbers
What studies and regulators have found.
These findings come from researchers, a consumer privacy group and the U.S. Federal Trade Commission (FTC). Apps change over time, so they describe patterns, not today’s version of any one app.
Research
Data for sale
Enforcement
Why mental health data is extra sensitive
Moods, diagnoses and journal entries can say a lot about you.
Mental health apps can hold some of the most personal things you ever write down: moods, worries, sleep, relationships, therapy history. Researchers note that privacy matters even more here because of stigma and the harm an accidental disclosure can cause.
Most people never read the fine print, and that’s understandable. This guide aims to make the key checks quick and doable.
Read more
FTC cases have involved names, email addresses, birthdates, IP addresses, insurance details, health histories and answers to health questionnaires.
Read more
A 2023 Duke University report found some data brokers openly marketing lists tied to conditions like depression and anxiety, sometimes alongside details like age, ZIP code and income.
Read more
Many good tools respect your privacy. Some public tools, like the VA’s National Center for PTSD apps, say no data that could identify you is sent to the VA or third parties.
Does HIPAA protect what I type into an app?
Often not. Here is why, and what does apply.
HIPAA is the U.S. law that protects health information held by doctors, clinics, hospitals and health insurers. Many apps you download yourself are not covered by it.
The FTC warns that, unlike your doctor, health apps may not be covered by health privacy laws like HIPAA. Researchers also note that most health apps fall outside government health regulation.
Read more
The VA explains for its PTSD Coach app that self-monitoring data belongs to you, so HIPAA does not apply while you store it or share it yourself.
Read more
Once you share app data with a health care provider, the provider must follow HIPAA rules for that information.
Read more
The FTC brings cases against companies that mislead people about how they handle health data.
In 2024 the FTC updated its Health Breach Notification Rule to make clear it applies to health apps not covered by HIPAA. Covered companies must tell people when their health data is breached or shared without permission.
Where app data can go
Advertisers, trackers, analytics and data brokers.
Read more
The FTC said one online counseling service shared emails, IP addresses and health questionnaire answers with social media and ad companies, and used them to target ads, despite promising privacy.
Read more
In a 2019 study, most data sharing from depression and quit-smoking apps went to just two big tech companies, often with details that could link back to the user.
Read more
A Duke University researcher found 11 data brokers willing to sell data on people’s mental health conditions in 2023.
Read more
Some apps use data only to run the service. Others also use it for research or share it with partners. A good policy says which.
For example, the VA says anonymous usage data from its apps is used only for research and improving the app, and you can switch it off in settings.
Read more
The FTC said tracking tools on one mental health company’s website and apps exposed sensitive information of nearly 3.2 million people to third parties.
What has gone wrong before
Two U.S. cases that show why checking matters.
These cases are examples from public FTC records. They show common problems, not every app or company.
Read more
The FTC said BetterHelp shared people’s emails, IP addresses and health questionnaire information with Facebook, Snapchat and other companies for advertising, after promising to keep it private.
The money went to partial refunds for customers. The FTC called it its first action returning money to people whose health data was compromised.
Read more
The FTC said Cerebral shared sensitive information of nearly 3.2 million people with third parties through tracking tools, and mailed postcards without envelopes that hinted at diagnoses to over 6,000 patients.
The company agreed to pay more than $7 million, including refunds linked to a hard-to-use cancellation process.
Reading a privacy policy without a law degree
Five questions to look for.
The FTC suggests comparing privacy notices when choosing between similar apps. Look for one that explains, in simple terms, what health information it collects and why.
Search the policy for these
- What does it collect? Look for words like “health information”, “mood” or “journal”.
- Who does it share with? Search for “third parties”, “partners” and “advertising”.
- Does it sell data? Search for “sell” and “sale”.
- Does it limit what others can do with your data?
- Can you delete your data and account? Search for “delete” and “request”.
A policy is a good start, but it isn’t the whole story. A 2019 study found many apps shared data with big tech companies without clearly saying so.
Privacy steps on your phone
Small settings that make a real difference.
Quick wins
- Check each app’s settings for what it collects and shares, and pick the more private options
- Keep the app and your phone’s system updated
- Set a passcode or face or fingerprint lock on your phone
- Switch off anonymous usage data in apps that offer it, if you prefer
- Turn off location access for apps that don’t need it
- Use a nickname and a separate email if you don’t need to use your real name
Default settings often favour sharing. The FTC suggests changing them to protect your information.
Data on your phone is only as safe as the phone itself. The VA reminds users of its apps to use their device’s security features.
Therapy platforms vs wellness apps
Talking to a real therapist doesn’t mean the company is private.
Some apps connect you with licensed therapists. Others are self-help tools with no clinician. The rules and risks can differ, so it helps to know which you are using.
Questions to ask a therapy platform
- Can I delete my account and records, and how long are records kept?
- Does the company use my information for advertising?
- Is my therapist licensed where I live?
- Who can see my messages and session notes?
Privacy at home and on shared devices
Keeping your space private from people around you.
Privacy isn’t only about companies. You may also want to keep mental health apps private from family, roommates or a partner.
Ideas
- Hide message previews on your lock screen
- Log out of apps on shared tablets or computers
- Move private apps into a folder with a plain name
- Use app-level locks where an app offers them
For teens, it can help for families to agree together on what stays private and when a parent needs to know.
If you think your data was misused
Steps you can take.
What you can do
- Write down what happened and when, and keep screenshots.
- Change your password, and turn off sharing in the app’s settings.
- Ask the company to delete your data, using the steps in its privacy policy.
- Delete the app and your account if you no longer trust it.
- Report it to the U.S. Federal Trade Commission (FTC).
The FTC encourages people to report apps that don’t keep their privacy promises. Reports help it spot problems and bring cases.
When and where to get help
Privacy worries shouldn’t stand between you and support.
People who call, text or chat 988 don’t have to give any personal information to get support, and don’t need insurance or payment details.
Read more
Call or text 988, or chat at 988lifeline.org. Spanish is available. Standard text and data rates from your phone carrier may apply.
Read more
Text HOME to 741741 in the U.S. It is free and confidential.
Read more
Find A Helpline lists free, confidential helplines around the world.
📝 Worksheets for this guide
Fill these in privately in the app. Your answers stay on your phone.
Sources
- JAMA Network Open (peer-reviewed, via PubMed Central) (2019). Assessment of the Data Sharing and Privacy Practices of Smartphone Apps for Depression and Smoking Cessation (Huckvale, Torous & Larsen, JAMA Network Open 2(4): e192542)
- Mozilla Foundation (*Privacy Not Included) (2023). Shady Mental Health Apps Inch Toward Privacy and Security Improvements, But Many Still Siphon Personal Data
- Duke University Sanford School of Public Policy, Tech Policy Lab (2023). Data Brokers and the Sale of Americans’ Mental Health Data (Joanne Kim)
- U.S. Federal Trade Commission (FTC) (2023). FTC to Ban BetterHelp from Revealing Consumers’ Data, Including Sensitive Mental Health Information, to Facebook and Others for Targeted Advertising
- U.S. Federal Trade Commission (FTC) (2024). Proposed FTC Order Will Prohibit Telehealth Firm Cerebral from Using or Disclosing Sensitive Data for Most Advertising Purposes
- U.S. Federal Trade Commission (FTC), Consumer Advice (2021). Does your health app protect your sensitive info?
- U.S. Federal Trade Commission (FTC) (2024). FTC Finalizes Changes to the Health Breach Notification Rule
- U.S. Department of Veterans Affairs, National Center for PTSD. Mobile Apps
- U.S. Department of Veterans Affairs, National Center for PTSD. PTSD Coach (mobile app)
- American Psychiatric Association (APA). The App Evaluation Model
- National Institute of Mental Health (NIMH). Technology and the Future of Mental Health Treatment
- 988 Suicide & Crisis Lifeline. 988 Suicide & Crisis Lifeline
- Substance Abuse and Mental Health Services Administration (SAMHSA). 988 Frequently Asked Questions
- Crisis Text Line. Text us
- Substance Abuse and Mental Health Services Administration (SAMHSA). Crisis Text Line (resource listing)
- ThroughLine (Find A Helpline). Find A Helpline
This guide is for education and self-care. It is not a diagnosis or a substitute for professional care. Please talk to a counselor or clinical provider about your health. Reviewed October 2026.
