For users in states with consumer health data laws (like Washington's My Health MY Data Act), Headspace has a separate Consumer Health Data Privacy Policy that provides additional protections for your health-related personal information beyond what standard privacy laws require.
State consumer health data laws give you stronger rights over sensitive health information collected outside traditional medical settings — including wellness apps — so this provision expands your protections significantly.
Compliance with Washington's My Health MY Data Act (MHMDA) and analogous state laws requires Headspace to obtain consent for collection of consumer health data, provide deletion rights, and restrict sharing without authorization — obligations that extend beyond HIPAA to app-based wellness data, creating meaningful compliance risk for any entity offering digital mental health services.
Compliance intelligence locked
Regulatory citations, enforcement risk, and due diligence action items.
Watcher: regulatory citations. Professional: full compliance memo.
Headspace collects highly sensitive personal data including mental health information, therapy session details, and behavioral data from your use of their app, and may share this with advertising partners and third-party service providers. Users in therapy or psychiatry programs are subject to HIPAA protections, but general app users should be aware their meditation habits and wellness data may be used for targeted advertising. You can request deletion of your personal data or opt out of certain data sharing by visiting Headspace's privacy rights portal or emailing privacy@headspace.com.