Consumer Reports finds unclear, questionable privacy practices and policies among popular mental health apps

by

Men­tal Health Apps Aren’t All As Pri­vate As You May Think (Con­sumer Reports):

Type “men­tal health” or a con­di­tion such as anx­i­ety or depres­sion into an app store search bar, and you can end up scrolling through end­less screens of options. As a recent Con­sumer Reports inves­ti­ga­tion has found, these apps take wide­ly var­ied approach­es to help­ing peo­ple han­dle psy­cho­log­i­cal challenges—and they are just as var­ied in how they han­dle the pri­va­cy of their users.

… Researchers in Con­sumer Reports’ Dig­i­tal Lab eval­u­at­ed sev­en of the most pop­u­lar options, rep­re­sent­ing a range of approach­es, to gain more insight into what hap­pens to your per­son­al infor­ma­tion when you start using a men­tal health app.

The apps we chose were 7 Cups, Bet­ter­Help, Mind­Doc (for­mer­ly known as Mood­path), San­i­ty & Self, Talk­space, Wysa, and Youper. We left out pop­u­lar alter­na­tives such as Head­space, which is pitched as a med­i­ta­tion app, although the lines between many apps peo­ple turn to for sup­port can be blur­ry … In gen­er­al, these men­tal health ser­vices act­ed like many oth­er apps you might down­load. For instance, we spot­ted apps shar­ing unique IDs asso­ci­at­ed with indi­vid­ual smart­phones that tech com­pa­nies often use to track what peo­ple do across lots of apps. The infor­ma­tion can be com­bined with oth­er data for tar­get­ed adver­tis­ing. Many apps do that, but should men­tal health apps act the same way? At a min­i­mum, Con­sumer Reports’ pri­va­cy experts think, users should be giv­en a clear­er expla­na­tion of what’s going on.

About the Report:

Peace of Mind: Eval­u­at­ing the pri­va­cy prac­tices of men­tal health apps (25-pages; opens PDF).

Con­clu­sion: Men­tal health apps show many of the same pat­terns we see else­where in data-col­lect­ing apps. How­ev­er, the sen­si­tiv­i­ty of the data they col­lect means the pri­va­cy prac­tices and poli­cies are even more important—especially dur­ing a pan­dem­ic where peo­ple are rely­ing on these ser­vices in greater num­bers for the first time. Our eval­u­a­tion shows how there are mul­ti­ple ways to eval­u­ate how thought­ful­ly men­tal health apps han­dle user data col­lec­tion, man­age­ment, and shar­ing to third parties.

We call for all apps to improve on the rec­om­men­da­tions high­light­ed in Sec­tion 5—adhere to plat­form guide­lines, insti­tute clear expla­na­tions of de-iden­ti­fi­ca­tion of data used for research, increase pri­va­cy aware­ness in the main user expe­ri­ence and be trans­par­ent about the ser­vice providers that receive user data. Some apps may out­ward­ly men­tion the third par­ty com­pa­nies they share in their pri­va­cy poli­cies while oth­ers may not men­tion any. Some apps may cre­ate clear ways to delete one’s data through the mobile app, while oth­ers may lim­it this user right to Cal­i­for­nia res­i­dents based on CCPA. Some apps over col­lect data such as geolo­ca­tion which is not nec­es­sar­i­ly for the app to func­tion. Con­sumer Reports rec­og­nizes there are many nuanced design and data gov­er­nance deci­sions that fac­tor into offer­ing high-qual­i­ty and pri­vate-by-design ser­vice. By com­par­a­tive­ly eval­u­at­ing pop­u­lar apps, we can clar­i­fy how com­pa­nies can con­tin­ue to raise the stan­dard in this emerg­ing cat­e­go­ry, ensure that con­sumers con­sent to the col­lec­tion and shar­ing of sen­si­tive men­tal health data, and ensure that con­sumers can trust in these ser­vices to be good stew­ards of their data.

News in context: