Headspace Privacy Policy

This document is Headspace's global Privacy Policy (effective March 30, 2026) governing the collection, use, and sharing of personal information across its websites, mobile applications, coaching, psychotherapy, and psychiatry services, with stated legal bases including consent, legitimate interests, and contractual necessity depending on jurisdiction. The policy states that Headspace collects a broad range of data including name, contact details, payment information, health and mental health information, device and usage data, and inferred characteristics; the terms authorize use of this data for service delivery, personalization, analytics, marketing, and product improvement, including sharing with affiliated Care Providers, third-party service providers, advertising partners, and analytics vendors. Notably, the policy explicitly acknowledges HIPAA applicability because Headspace's Care Providers are classified as covered entities and Headspace operates as their business associate, creating a layered regulatory structure where both this policy and a separate HIPAA Notice of Privacy Practices may govern the same user's data depending on service context; the policy also maintains a separate Consumer Health Data Privacy Policy, suggesting collection of health data outside HIPAA-covered contexts that may fall under state-level consumer health data laws such as Washington's My Health MY Data Act. The policy engages GDPR and UK GDPR for European and UK users respectively, CCPA and CPRA for California residents, PIPEDA for Canadian users, and HIPAA for users of clinical services; supplemental notices address these jurisdictions with specific rights disclosures. Material compliance considerations include the dual-track health data governance structure (HIPAA-covered clinical data alongside non-HIPAA consumer health data), the breadth of third-party advertising and analytics data sharing relative to the sensitivity of mental health context, and the policy's assertion that the English version prevails in case of conflict with translated versions, which may create compliance tension under GDPR's transparency requirements in non-English-speaking EU member states.