It’s 11 pm. You open the app, select your therapist, and start typing about the panic attack you had at work. You describe it in detail — the chest tightness, the embarrassment, the fear that it will happen again. The app feels like a private space. The interface is calm. There’s no one else around.
What you don’t see is the code running in the background: the advertising SDKs, the analytics packages, the third-party trackers loading alongside your session. You are not in a private space. You are in a product.
The BetterHelp case: a company that explicitly broke a promise
In March 2023, the Federal Trade Commission fined BetterHelp $7.8 million for sharing mental health data with Facebook, Snapchat, Criteo, and Pinterest — for advertising purposes.
This was not a data breach. BetterHelp made a deliberate business decision.
The FTC’s complaint was specific. BetterHelp collected data through intake forms, including whether users had previously been in therapy, their email addresses, and the mental health struggles they disclosed when signing up. The company then uploaded that data to Facebook to build advertising audiences. It used it to run targeted ads. It did this while explicitly telling users, in its privacy policy and in marketing materials, that their personal health data would not be used for advertising.
The settlement required BetterHelp to pay the $7.8 million directly back to affected users — a full refund, distributed automatically. It also prohibited BetterHelp from sharing user health data for advertising in the future.
Read that last sentence again. The prohibition was on future behavior. This happened, it ran for years, and a federal enforcement action was required to stop it.
What these apps actually collect
Mental health apps sit on top of one of the richest possible datasets about a human being.
Intake questionnaires include clinical-grade instruments — the PHQ-9 depression scale, the GAD-7 anxiety measure. These are tools designed to surface serious symptoms. When you answer honestly, which you’re supposed to, you are disclosing exactly the kind of information that insurance companies, employers, and data brokers would pay for.
In-app messaging with therapists is captured verbatim. Session frequency and duration are logged separately — even if the content were protected, the metadata tells a story. Someone who starts using a mental health app three times a week after a particular date is communicating something. That data exists whether the messages do or not.
If you’ve connected a wearable such as a smartwatch or fitness tracker, some apps pull in biometric data: heart rate, sleep patterns, stress indicators. That’s another layer.
Payment and subscription status are logged. So is the moment you cancel.
The employer problem
Talkspace sells enterprise wellness packages to employers. The data that flows back under these contracts is aggregate — individual session content does not go to HR. But aggregate data has limits as a protection. Knowing that usage in a particular team spiked after a round of layoffs, or that an employee’s usage pattern changed sharply before a performance review, is information. Patterns narrow quickly in small departments.
More directly: knowing that a specific employee uses a mental health app at all — even without seeing content — is information some HR departments would file away. Whether they should act on it is a separate question from whether they do.
The system that’s supposed to help you requires disclosures to an infrastructure that serves your employer’s interests, not yours.
The Indian picture
India’s mental health app market is growing fast. The demand is real — access to qualified therapists is genuinely limited outside major cities, and the stigma around seeking help in person remains significant for many people. Apps look like a solution.
iCall, run by the Tata Institute of Social Sciences (TISS), is meaningfully different from the commercial platforms. As an academic and social-welfare institution, TISS operates under different incentives. iCall is not running advertising, does not have enterprise contracts, and its data governance follows an academic ethics framework rather than a growth-stage startup’s. It is not a perfect system, but the commercial pressure that drove BetterHelp’s choices simply doesn’t apply.
YourDost, Wysa, and Amaha (formerly InnerHour) are the larger commercial Indian players. Wysa, a UK-India startup, positions its AI chatbot as a wellness tool rather than a therapy replacement. Amaha offers matched therapy and psychiatric care. None have been the subject of confirmed data misuse incidents — though that reflects the current state of enforcement more than it confirms the behavior of the platforms.
The Digital Personal Data Protection Act applies one unified personal data framework. Mental health data is personal data under the DPDPA. Heightened obligations apply to Significant Data Fiduciaries designated by the central government, rather than being tiered by data category. The act does impose consent requirements and data fiduciary accountability across the board. Enforcement is still developing, but the legal framework is stronger than most users assume.
What India does not have is anything equivalent to HIPAA. In the US, HIPAA creates specific protections for health information held by healthcare providers. In India, therapy session notes are not automatically “medical records” under existing law. That gap matters: the burden falls harder on the user to evaluate the platform, not on the platform to meet a mandatory standard.
What actually makes a mental health app trustworthy
The question is not whether an app has a privacy policy. Every app has a privacy policy. The question is what the policy actually commits to.
End-to-end encrypted messaging between you and your therapist is the bar. Very few apps meet it. If message content can be accessed by the company’s servers — which it can be on most platforms — it can, in principle, be shared. Encryption the platform can defeat is not encryption. It is a user interface choice.
The revenue model is the clearest signal. If an app is free and not grant-funded, your data is paying for it somehow — advertising, aggregate licensing, or selling insights to insurers. “Free therapy app” should trigger a question, not reassurance.
An explicit prohibition on sharing data for advertising matters. BetterHelp’s privacy policy said the right things. The FTC found the company violated it anyway. Policy text and enforcement are different things.
For Indian users: data stored in India limits exposure to foreign government requests and simplifies exercising DPDPA rights.
What you can do
Check the privacy policy of any mental health app you use for references to advertising SDKs, third-party analytics, or data sharing with “partners.” Those words are doing real work. If you see them in the context of your health data, that’s your answer.
Use DPDPA Section 12 to request erasure from Indian mental health platforms after you finish a course of therapy. Don’t leave session data sitting in an app you’ve stopped using. Active users can make decisions about their data. Dormant accounts mostly just accumulate.
Consider the alternative that doesn’t involve an app at all. End-to-end encrypted messaging — Signal, for instance — used with a private therapist you’ve hired directly gives you stronger privacy guarantees than most mental health platforms. There’s no app company in the middle. There’s no enterprise contract. There’s no advertising SDK. The therapist’s notes are governed by their professional obligations, not by a startup’s growth targets.
If you’re in a low-resource situation where iCall is the realistic option, that’s a better choice than a commercial platform operating on advertising-funded free tiers. The data incentives are genuinely different.
What you can do right now
Want to see what data brokers expose about you? See what a scan finds → shows an example report: the kinds of sites that list your name, phone, and address. Once KnytX Shield launches it will find and remove these automatically. Join the waitlist to get in early.