The intake quiz asked whether you had thought about hurting yourself. You answered before you had a therapist, before you had a contract, before anyone had told you who would read it. For years the honest answer to "where does that go" was: wherever the company's privacy policy said. In California, since 2023, there is a statute.
The short answer: what your therapist knows has always been protected. What the app collects has not, and that is what changed. Since 1 January 2023, "any business that offers a mental health digital service to a consumer for the purpose of allowing the individual to manage the individual's information, or for the diagnosis, treatment, or management of a medical condition of the individual, shall be deemed to be a provider of health care" under the Confidentiality of Medical Information Act.¹ A "mental health digital service" is "a mobile-based application or internet website that collects mental health application information from a consumer, markets itself as facilitating mental health services to a consumer, and uses the information to facilitate mental health services to a consumer," and "mental health application information" — "information related to a consumer's inferred or diagnosed mental health or substance use disorder" collected by such a service — is now "medical information."² Such a business "shall maintain the same standards of confidentiality required of a provider of health care" and is "subject to the penalties for improper use and disclosure."¹ A negligent release gives you a claim for "nominal damages of one thousand dollars ($1,000)" without proof of harm, plus actual damages — except against a HIPAA-covered entity that proves the Act's affirmative defence.³ The defining case concerned conduct from before the statute: in March 2023 the Federal Trade Commission announced a proposed order requiring BetterHelp to pay $7.8 million, for consumer refunds, over sharing users' email addresses and intake answers with advertising platforms after promising privacy.⁴
Three layers, three sets of rules
The clinician. A licensed therapist you see through an app is bound by the same confidentiality law and the same privilege as one you see in an office; the platform does not change that. Is therapy confidential? →
The platform, as a business handling health information. The Act already treated a business offering an app "designed to maintain medical information" as a provider; AB 2089 extended that to a defined "mental health digital service," which is the layer most therapy apps now sit in. If the app "markets itself as facilitating mental health services" and collects information about your "inferred or diagnosed mental health or substance use disorder," it is a provider of health care for the purposes of the Act — which means the Act's rules on use and disclosure, its consent requirements, and its penalties apply to the business, not only to the therapist behind it.¹ ² The word inferred matters: an app that guesses at your condition from what you type has collected mental health application information whether or not you were ever diagnosed.
The platform, as a business generally. Data that is not mental health application information — device identifiers, usage patterns, the fact that you installed the app — falls to general privacy law, the terms you accepted, and the FTC's authority over unfair and deceptive practices. BetterHelp's case ran under that federal authority, over health-questionnaire answers and identifiers alike, before the state definition existed.⁴
What the statute does not do
It does not stop an app from collecting the information; it governs what the business may do with it once collected. It does not reach a business that avoids the definition — one that does not market itself as facilitating mental health services, or does not use the information to facilitate them. A meditation app that never claims to treat anything is outside it. And the classification is confined to the Act: the section "shall not be construed to make a business ... a provider of health care for purposes of any law other than this part."¹
The penalties, which are the point
A person or entity that negligently releases medical information in violation of the Act is liable to the individual for "nominal damages of one thousand dollars ($1,000)" — "it is not necessary that the plaintiff suffered or was threatened with actual damages" — plus actual damages.³ Administrative fines run from $2,500 per negligent violation to $25,000 for a knowing or wilful one, and higher where the disclosure was for financial gain.³ Those numbers, multiplied by a user base, are what changed the calculation for app companies after 2023.
What to check before you type
- Search the privacy policy for "advertising," "third parties," and "affiliates." The BetterHelp order turned on exactly those disclosures.⁴
- Find the sentence about mental health application information. A platform that knows it is inside AB 2089 says so, usually near "CMIA" or "California residents."
- Ask whether the platform records or transcribes sessions. A recording is a separate question with its own statute. Can I record my therapy session? →
- Prefer the therapist's own portal to the app's intake. Anything you tell a licensed clinician directly is in the first layer, whatever the platform does with the second.
This site's own rule is short and public: no ads, no data sold, aggregate measurement only. The pledge →
Q&A
Q: Does HIPAA cover therapy apps? A: Federal HIPAA covers providers, plans and their business associates; an app that is none of those can fall outside it. California's Act now reaches the app itself where it meets the definition.¹ ²
Q: I never got a diagnosis. Does the law still apply to what the app collected? A: Yes, where the information relates to an "inferred or diagnosed" condition; inference is enough.²
Q: Can I sue if an app shared my intake answers? A: The Act gives an individual a claim for nominal damages of $1,000 plus actual damages for a negligent release; the facts of who shared what, and whether the business meets the definition, decide it.³
Q: What did BetterHelp actually do? A: According to the FTC, it "used and revealed consumers' email addresses, IP addresses, and health questionnaire information to Facebook, Snapchat, Criteo, and Pinterest for advertising purposes," after promising at signup that it would not disclose personal health data except for limited purposes such as providing counselling.⁴
Our therapist directory: See its current status →
Sources
- Cal. Civil Code §56.06(d) — "Any business that offers a mental health digital service to a consumer for the purpose of allowing the individual to manage the individual's information, or for the diagnosis, treatment, or management of a medical condition of the individual, shall be deemed to be a provider of health care subject to the requirements of this part"; the duty to "maintain the same standards of confidentiality required of a provider of health care" and exposure to "the penalties for improper use and disclosure of medical information"; the limitation that it "shall not be construed to make a business ... a provider of health care for purposes of any law other than this part" — california.public.law. Added by AB 2089, Chapter 690, Statutes of 2022, approved 28 September 2022 — legiscan.com.
- Cal. Civil Code §56.05 — "mental health digital service" and "mental health application information" as defined, and the inclusion of mental health application information in "medical information" — california.public.law.
- Cal. Civil Code §56.36 — the individual's action for negligent release, "nominal damages of one thousand dollars ($1,000)" where "it is not necessary that the plaintiff suffered or was threatened with actual damages," plus actual damages, subject to the affirmative defence in subdivision (e); administrative fines and civil penalties from $2,500 per negligent violation to $25,000 for knowing or wilful violations, and higher for financial gain — california.public.law.
- Federal Trade Commission, FTC to Ban BetterHelp from Revealing Consumers' Data, Including Sensitive Mental Health Information, to Facebook and Others for Targeted Advertising (2 March 2023) — the proposed order and the $7.8 million for consumer refunds — ftc.gov.
Paid for by participating therapists. Inclusion is computed from availability data — never purchased. No ads, no data sold.