Mental health apps are collecting more than emotional conversations
Mental health apps are collecting more than emotional conversations
https://www.helpnetsecurity.com/2026/05/08/android-mental-health-apps-privacy-risks/
Publish Date: 2026-05-08 01:30:00
Source Domain: www.helpnetsecurity.com
People use mental health apps to talk about depression, trauma and suicidal thoughts in moments they may not share with anyone else. Many users likely assume those conversations carry protections similar to therapy sessions. In reality, mental health apps operate without the same confidentiality and privacy standards that govern licensed therapists.
A new academic study examining 25 popular Android mental health and therapy apps found that every app contained at least one undisclosed tracker absent from its privacy policy.
The study found that 68% of the apps failed to disclose at least half of the trackers detected inside their software. Runtime testing of the 20 apps the team was able to instrument showed that each contacted at least one third-party tracking or analytics domain not named in its privacy policy.
These trackers can collect information about how people interact with apps and may send behavioral or usage data to outside firms. The researchers warned that companies could infer sensitive details about users through behavioral signals tied to app activity.
Usage frequency, interaction timing, feature engagement, and session patterns may indicate that someone is seeking help for depression, anxiety, trauma, addiction, or loneliness, even without access to conversation contents.
One app embedded 20 trackers while naming none of them in its privacy policy.
Personal conversations used for AI systems
AI-provider disclosures formed another concern. Researchers found that 48% of the apps referenced third-party AI providers in their privacy policies. Some policies identified companies such as OpenAI, Anthropic, and Groq directly, while others used broad phrases like “AI services” or “large language models” without identifying where information was processed.
The conclusions about AI providers were based on privacy-policy disclosures rather than direct verification of backend data transfers. The authors noted they could not confirm which…
