This is Headspace's privacy policy explaining how the mental health and meditation app collects and uses your personal data, including sensitive information about your mental health, meditation habits, therapy sessions, and health history. Most importantly, Headspace shares your data — including usage patterns and inferred health interests — with advertising partners, analytics providers, and third-party business partners, and your mental health data may be used to personalise marketing unless you opt out. You can exercise data rights including deletion and opt-out of data sharing by contacting privacy@headspace.com or visiting the privacy settings in your account.
This document is Headspace's Privacy Policy (effective March 30, 2026), governing the collection, use, and sharing of personal information across its wellness, coaching, therapy, and psychiatry platform, with legal bases including consent, contractual necessity, and legitimate interests varying by jurisdiction. The policy obligates Headspace to provide data access, deletion, correction, and portability rights to users, and requires users to consent to broad data collection including health information, usage behavior, device data, and inferred interests. A notable provision is Headspace's explicit acknowledgment that it operates under HIPAA as a business associate to its Care Provider entities, and that it also maintains a separate Consumer Health Data Privacy Policy and HIPAA Notice of Privacy Practices — creating a multi-layered, context-dependent privacy framework that may confuse users about which protections apply to which data. The policy engages GDPR (EU/UK), CCPA/CPRA (California), HIPAA, Washington My Health MY Data Act, and COPPA, with enforcement exposure spanning the FTC, HHS OCR, state attorneys general, and EU/UK data protection authorities. Material compliance considerations include the breadth of sensitive mental health data collected, the use of that data for advertising and analytics purposes, and the cross-border transfer of health-adjacent data to third-party partners.
(1) REGULATORY EXPOSURE: This policy engages HIPAA (45 CFR Parts 160 and 164) due to Headspace's role as a business associate to its Care Provider entities, with HHS OCR as primary enforcer; CCPA/CPR…
(1) REGULATORY EXPOSURE: This policy engages HIPAA (45 CFR Parts 160 and 164) due to Headspace's role as a business associate to its Care Provider entities, with HHS OCR as primary enforcer; CCPA/CPRA (Cal. Civ. Code §§1798.100–1798.199) for California residents with California AG and California Pr…
Compliance intelligence locked
Regulatory exposure, material risk, and due diligence action items.
1 change analyzed since monitoring began.