Healing at a Price: The Hidden Data Economy Inside Mental Health Apps
When a person opens a mental health app at two in the morning to log a panic attack or record suicidal ideation in a mood journal, they are, in their mind, doing something private. They are seeking relief. What they are also doing, in many cases, is generating a data record of extraordinary commercial value—one that the app's privacy policy, buried under dozens of screens of legalese, quietly authorizes the company to share, license, or sell.
The mental health app market in the United States has grown into a multi-billion-dollar industry. Platforms offering guided meditation, cognitive behavioral therapy exercises, peer support forums, and direct video sessions with licensed therapists have attracted tens of millions of users, accelerated in large part by the isolation and anxiety of the COVID-19 pandemic. That growth has attracted venture capital, advertising revenue models, and the same data-monetization infrastructure that underpins every other corner of the consumer app economy—with one critical difference. The data being collected is not search history or shopping preferences. It is, by almost any definition, among the most sensitive information a human being can disclose.
What These Apps Actually Collect
The scope of data collection across mental health platforms is broader than most users appreciate. At the surface level, apps record what users explicitly enter: symptom check-ins, mood ratings, journal entries describing traumatic experiences, medication names and dosage schedules, and responses to standardized clinical assessments for depression and anxiety. Beneath that layer, behavioral metadata accumulates silently. Session frequency, time of use, how long a user lingers on a particular exercise, whether they abandon a journaling prompt mid-entry—all of it is logged.
Location data, device identifiers, and third-party advertising trackers are frequently embedded in the same applications people download specifically for relief from stress. A 2022 study published in JAMA Network Open examined 578 mental health apps available in the US App Store and Google Play and found that the majority shared user data with third parties, including advertising networks, while only a small fraction disclosed this practice in plain, accessible language.
Some platforms go further still. Apps that offer human-assisted therapy or coaching collect transcripts of text conversations and, in some cases, audio or video sessions. The question of whether these records are protected under traditional patient-confidentiality frameworks—specifically HIPAA, the Health Insurance Portability and Accountability Act—is where the regulatory picture becomes deeply troubling.
The HIPAA Gap That Leaves Users Exposed
Most Americans reasonably assume that anything shared with a health-related service is protected under HIPAA. That assumption is wrong for the majority of mental health apps. HIPAA applies to covered entities—hospitals, licensed healthcare providers, health insurance plans—and their direct business associates. A consumer wellness app that is not affiliated with a covered entity, even one that explicitly markets itself as a mental health tool, falls outside HIPAA's jurisdiction.
This gap is not accidental. It is the product of a regulatory framework designed before the smartphone era, one that has not kept pace with the commercialization of intimate health data. The Federal Trade Commission has authority over deceptive trade practices and has taken action against a handful of health-data companies in recent years, but its enforcement reach is limited and its penalties are rarely proportionate to the scale of the violations.
Several states have moved to fill the void. California's Confidentiality of Medical Information Act extends some protections to app-based health data, and Washington State's My Health MY Data Act, which took effect in 2024, represents one of the most aggressive state-level attempts to regulate consumer health data outside of HIPAA. But for the majority of US residents, enforceable protections remain thin.
From Therapy Session to Targeting Profile
The commercial chain that mental health data enters once it leaves an app is rarely visible to the user who generated it. Aggregated behavioral profiles—constructed from mood patterns, crisis frequencies, and disclosed diagnoses—are attractive to a range of buyers. Advertising networks use inferred psychological states to serve targeted content. Data brokers package and resell health-adjacent profiles to employers conducting background research or to insurers seeking to refine risk assessments.
The legal permissibility of these flows depends largely on how data is technically categorized. Raw journal text disclosing a diagnosis is sensitive. A behavioral score derived from that text—a number representing "elevated depression risk"—may be treated as a proprietary analytical product rather than health information, placing it outside the narrow protections that do exist.
In 2023, the FTC reached a settlement with BetterHelp, one of the largest online therapy platforms in the country, after finding that the company had shared users' email addresses and mental health intake information with Facebook and Snapchat for advertising purposes. BetterHelp had explicitly assured users their personal health information would never be used for advertising. The settlement required a $7.8 million redress fund—a figure critics noted was modest relative to the company's revenues and the intimacy of the data involved.
That case was notable precisely because it was the exception. For every platform that attracts regulatory attention, dozens more operate under the same data-sharing architecture without scrutiny.
What Users Should Know Before They Disclose
The solution is not to avoid seeking mental health support—the public health cost of that choice would be severe. It is to approach app-based mental health tools with the same skepticism applied to any data-hungry platform, and to understand which tools offer meaningfully stronger protections.
Several practical steps can reduce exposure. Before downloading any mental health app, users should search the platform's name alongside the terms "privacy policy," "data sharing," and "third parties," and read critically rather than scroll past. Apps affiliated with licensed clinical providers and covered under HIPAA—such as those accessed through an employer's Employee Assistance Program or a health insurer's portal—offer substantially stronger legal protections than standalone consumer apps.
For journaling or mood tracking, local-only apps that store data exclusively on the device and do not require account creation eliminate the server-side data trail entirely. Open-source applications audited by independent security researchers provide an additional layer of accountability that proprietary commercial apps rarely match.
Users should also audit app permissions. A meditation app has no functional need for access to a contact list, precise location, or microphone beyond active use. Permissions granted at installation can typically be revoked through device settings without disabling core features.
A Regulatory Reckoning That Has Not Yet Arrived
The broader policy question—whether intimate psychological data should be permitted to flow through commercial advertising infrastructure at all—remains unresolved in the United States. Proposed federal privacy legislation has stalled repeatedly in Congress, and the sector-specific approach that governs American data law was not designed for an environment in which a single app can simultaneously function as a therapy tool, a behavioral data harvester, and an advertising platform.
Until that reckoning arrives, the burden falls disproportionately on the individual. Millions of people are making decisions about psychological disclosure under the reasonable but frequently incorrect assumption that what they share in a moment of vulnerability will stay between themselves and the service they trusted. Closing that gap between expectation and reality is not merely a privacy issue. It is a matter of basic informed consent—and right now, the infrastructure of consent is badly broken.
