What to Know About Privacy Before You Use a Mental Health App

Mood trackers, meditation apps, and AI chat support have become familiar companions to therapy. Plenty of people use them between sessions to journal, check in with how they are feeling, or build a daily mindfulness habit. If that sounds like part of your routine, you are not doing anything unusual, and these tools can offer day-to-day support. They can also collect more information than most people realize, so it helps to know what you are agreeing to before you open the app.

Why Mental Health Apps Are Not Covered the Way Therapy Is

When you work with a licensed therapist, your records are protected under the Health Insurance Portability and Accountability Act (HIPAA), the federal law that governs how healthcare providers handle health information. Most consumer mental health apps do not carry that same protection. HIPAA applies to healthcare providers, insurers, and the business partners who support them directly. It does not apply to independent apps like mood trackers or wellness chatbots.

This distinction matters more than it might seem. A platform that connects someone with a licensed clinician for care may have some HIPAA-covered pieces tied to that clinical relationship, while still collecting separate data through app usage tracking, marketing analytics, or account activity that falls outside those protections. In practice, this means a journal entry written at 11 p.m. or a mood logged in a tracker may not carry the same confidentiality someone would expect from a therapy session, even on a platform that also offers licensed clinical services.

There is also no single federal privacy law in the United States that closes this gap. The Federal Trade Commission can step in after something goes wrong, such as a data breach or a company breaking its own privacy promises, but there is no proactive standard requiring these apps to limit what they collect from the start.

What Independent Research Has Found

The Mozilla Foundation, a nonprofit known for its work on internet privacy and the Firefox browser, runs an ongoing research project called *Privacy Not Included that reviews the privacy and security practices of popular apps and connected devices. Mental health apps are one of the categories Mozilla has studied closely.

Among the apps Mozilla has reviewed in this category, most were flagged for privacy concerns. Issues ranged from vague or hard-to-read privacy policies to weak password requirements and data sharing with outside advertisers. Two apps stood out as exceptions: PTSD Coach, developed by the U.S. Department of Veterans Affairs, and Wysa, an AI-based support app. Mozilla recognized both for clearer policies and stronger privacy practices than most of the category.

This research lines up with action taken by federal regulators. The Federal Trade Commission reached settlements with BetterHelp and Cerebral after both companies shared people’s sensitive mental health information with advertising platforms including Facebook and Snapchat, despite telling users that information would stay private. BetterHelp agreed to pay 7.8 million dollars and was permanently barred from sharing health data for advertising. Cerebral’s settlement followed similar allegations, including the disclosure of sensitive information belonging to roughly 3.2 million people to platforms such as LinkedIn, Snapchat, and TikTok. In both cases, people who had shared personal struggles through these apps later found that information being used for targeted ads they never agreed to.

What This Can Look Like in Everyday Terms

Privacy concerns like this can feel abstract until they show up somewhere familiar. It might look like an ad appearing for something only ever mentioned in a journal entry or chat. It might mean information stays stored somewhere long after an account is deleted, because a company’s retention policy allows it. Or it might simply mean a privacy policy changes one day with little notice, and the protections someone thought they had look different than they did at signup.

None of this means these tools are unsafe to use. It means knowing, going in, what is being shared and where it might go.

A Few Questions Before Downloading an App

Before signing up for a new mental health app, a little research goes a long way. Does the app explain, in plain language, what it does with personal information, or is that buried in dense legal text? Can data be deleted after the fact, and does the policy say how long the company keeps it either way? Does the app ask to link other accounts, like Google or Facebook, and is that required for it to work? Is there a clear, working way to opt out of tracking and personalized ads? And does the company have a track record, good or concerning, that shows up in independent reviews?

Apps Can Support Care Without Replacing It

Used with some awareness of these tradeoffs, digital tools can add something useful alongside therapy. They are not a substitute for the relationship and continuity built with a therapist, and they should not be treated as equally private. Taking a few minutes to understand how an app handles personal information puts someone in a stronger position either way, whether they are using it to track mood between sessions or simply exploring what is out there.

At Montgomery Counseling Group, our team works with individuals, children, adolescents, and families across North Carolina, in person in Charlotte and by telehealth statewide. If you are weighing how digital tools fit alongside therapy, reaching out is a good next step.