You tell a mental health app things you might tell very few people. How you slept, what you are afraid of, who you are angry with, what happened years ago. It is worth knowing where those words go before you type them.
This guide is a practical privacy checklist for AI mental health apps, and for any wellbeing app you are thinking of trusting. It covers why this kind of data needs more care, what has gone wrong before, ten questions to ask, and how to check the answers in about ten minutes.
Why privacy matters more here
Information about your mental health is some of the most sensitive data there is. If it leaks or is passed on, it can affect how people see you, and in some places your work or insurance. Even when nothing dramatic happens, being tracked and targeted on the basis of how you feel is not what most people signed up for.
The law does not always protect it the way people assume. In the United States, the health privacy law HIPAA mostly covers doctors, hospitals and insurers, not consumer apps you download yourself. In the European Union and the UK, data about health is a special category under the GDPR, with stricter rules on when it can be used at all. Where an app's company is based, and where it says your data is handled, matters.
What has gone wrong before
This is not a theoretical worry.
In 2022, Mozilla's Privacy Not Included team reviewed 32 popular mental health and prayer apps and gave 28 of them its privacy warning label, calling the category worse than any other it had reviewed. When it looked again in 2023, 19 of the 32 apps still carried the label. Some had improved, about a third of them, but others had become worse.
In 2023, the US Federal Trade Commission finalised an order against the online counselling company BetterHelp. The FTC said BetterHelp had shared people's email addresses, IP addresses and answers from its health questionnaire with platforms including Facebook and Snapchat for advertising, despite promising to use it only for limited purposes. The order required $7.8 million for refunds and banned it from sharing health data for advertising. BetterHelp disputed the FTC's account.
None of this means every app is careless. Some came out of those reviews well. It means you cannot assume, and it is reasonable to check.
A privacy checklist: ten questions to ask
1. Does it need to know who you are?
Some apps ask for your name, email, phone number or access to your contacts. Ask whether the service actually needs them. The less an app knows about your identity, the less can be linked back to you if something goes wrong.
2. Is what you write encrypted?
Look for encryption both on the way, between your phone and the company, and at rest, where your words are stored. "We take security seriously" is not an answer. A clear statement of what is encrypted is.
3. Is your data sold or shared for advertising?
Search the privacy policy for "sell", "share", "advertising", "partners" and "third parties". Red flags are vague phrases like "we may share information with trusted partners" with no list of who they are, or any mention of advertising networks.
4. Are your words used to train AI models?
With AI apps, this is a newer question. Some services use conversations to improve or train their models, sometimes by default. Look for a plain statement either way, and for whether you can opt out.
5. Which companies are behind it?
Almost every app relies on other companies for hosting, AI models, email or analytics. A trustworthy privacy policy names them and says what each one does. If it only says "service providers", you do not know who holds your data.
6. Can you see what it has learned about you?
AI apps increasingly remember things about you to personalise their answers. That can be genuinely useful. It is also worth being able to see what is remembered, correct it when it is wrong and remove what you do not want kept.
7. Can you take a copy and delete everything?
Look for a way to export your data and a way to delete your account from inside the app, without having to email someone and wait. Check what the policy says about how long backup copies are kept after you delete.
8. Are analytics optional?
Many apps measure how people use them. That is not sinister in itself, but it should not include what you write, and ideally it should be something you can turn off.
9. Does any person read your messages?
Some services have staff or contractors who review conversations, for safety or quality. That can be legitimate, but you should know when it happens and why.
10. Is it honest about what it is not?
A safe app is clear about its limits: that it is not therapy, not a medical device and not a crisis service, and that it points you to real help when you need more than it can give. Be wary of any app that promises to treat or diagnose.
How to read a privacy policy in ten minutes
You do not need to read every word. Open the policy and search for a handful of terms:
- "sell" and "advertis", for whether your data can be sold or used for ads.
- "share" and "third part", for who else receives it.
- "train" and "improve", for whether your words feed AI models.
- "retain" and "delete", for how long data is kept and what happens when you leave.
- "de-identified" or "aggregate", which sometimes hide sharing behind reassuring words.
Then check two things at the top or bottom: when the policy was last updated, and which company and country it belongs to. A policy that has not been updated in years, or that does not name the company, is a reason for caution.
Beyond privacy: is what it says safe?
Privacy is one half of safety. The other half is what the app tells you. AI can sound confident and still be wrong, and no app should be your only support when things are serious. Our guides on how AI mental health apps work and on whether it is healthy to vent to AI go into that side. If you are in danger, our help page lists services that answer day and night.
How Chirpi answers this checklist
We would rather you check us than trust us, so here is how Chirpi answers the questions above.
- Who you are: Chirpi never learns who you are. You sign in with Apple or Google, and only a scrambled version of that sign-in is kept, which cannot be reversed. No name, no email and no phone number are stored.
- Encryption: what you write is encrypted on the way and at rest.
- What it learns: you can read everything Chirpi has learned about you, put any of it right, remove it, or keep it but ask Chirpi never to bring it up.
- Leaving: you can take a copy of everything, your words included, and delete your account from Settings at any time.
- Analytics: usage analytics never include your words and stay off until you turn them on.
- People: no person reads your messages. Before a message is answered, an automatic check looks for signs that you may be in danger, so Chirpi can show you where to find help.
- What it is not: Chirpi is not therapy and not a crisis service, and it says so plainly.
The details, including which companies help us run Chirpi, are on our privacy page.
Chirpi is coming to iPhone and Android. The first seven days are free, with no card.
Are AI mental health apps safe to use?
Some are and some are not. Independent reviews have found serious privacy problems in many mental health apps, and some do much better. Check what the app knows about you, whether your words are encrypted, whether data is shared for advertising, and whether you can delete everything.
Do mental health apps sell your data?
Some have shared sensitive information for advertising. In 2023, the US Federal Trade Commission ordered BetterHelp to pay $7.8 million and stop sharing health data for ads. Search an app's privacy policy for "sell", "share" and "advertising" before you use it.
Does HIPAA protect my mental health app data?
Often not. In the United States, HIPAA mainly covers doctors, hospitals and insurers, not most consumer apps you download yourself. Rely on the app's own privacy policy, and on stronger laws like the GDPR if the company is covered by them.
Can AI mental health apps read my messages?
The AI has to read what you write in order to answer you. The questions that matter are whether people at the company read it too, whether it is shared with other companies, and whether it is used to train models. A good privacy policy answers all three.
How do I delete my data from a mental health app?
Look in the app's settings for a delete-account option first. If there is none, the privacy policy should explain how to request deletion and how long backup copies are kept. Taking an export first lets you keep your own copy.
General wellbeing information, not medical advice. If you're struggling, here's where to find help.
Brice founded Chirpi after going through low times himself and watching his family go through them too. He learned that people mostly want to be heard, and to have somewhere to go. Chirpi is built on both.
Sources
- Mozilla Foundation (2022). Top mental health and prayer apps fail spectacularly at privacy, security. Privacy Not Included.
- Mozilla Foundation (2023). Shady mental health apps inch toward privacy and security improvements, but many still siphon personal data. Privacy Not Included.
- US Federal Trade Commission (2023). FTC gives final approval to order banning BetterHelp from sharing sensitive health data for advertising, requiring it to pay $7.8 million.
