This is Headspace's privacy policy explaining how the mental health and meditation app collects and uses your personal data, including sensitive information about your mental health, meditation habits, therapy sessions, and health history. Most importantly, Headspace shares your data — including usage patterns and inferred health interests — with advertising partners, analytics providers, and third-party business partners, and your mental health data may be used to personalise marketing unless you opt out. You can exercise data rights including deletion and opt-out of data sharing by contacting privacy@headspace.com or visiting the privacy settings in your account.
This document is Headspace's Privacy Policy (effective March 30, 2026), governing the collection, use, and sharing of personal information across its wellness, coaching, therapy, and psychiatry platform, with legal bases including consent, contractual necessity, and legitimate interests varying by jurisdiction. The policy obligates Headspace to provide data access, deletion, correction, and portability rights to users, and requires users to consent to broad data collection including health information, usage behavior, device data, and inferred interests. A notable provision is Headspace's explicit acknowledgment that it operates under HIPAA as a business associate to its Care Provider entities, and that it also maintains a separate Consumer Health Data Privacy Policy and HIPAA Notice of Privacy Practices — creating a multi-layered, context-dependent privacy framework that may confuse users about which protections apply to which data. The policy engages GDPR (EU/UK), CCPA/CPRA (California), HIPAA, Washington My Health MY Data Act, and COPPA, with enforcement exposure spanning the FTC, HHS OCR, state attorneys general, and EU/UK data protection authorities. Material compliance considerations include the breadth of sensitive mental health data collected, the use of that data for advertising and analytics purposes, and the cross-border transfer of health-adjacent data to third-party partners.
🔒 Institutional analysis locked
Regulatory exposure by statute, material risk assessment, vendor due diligence action items, and enforcement precedent. Available on Professional.
Upgrade to Professional — $149/mo2 changes analyzed since monitoring began.
New explicit provision acknowledging Headspace's collection of sensitive mental health information, establishing foundational transparency for health data practices.
Addition of dedicated GDPR compliance provision indicates expanded privacy protections for European users beyond previous international data transfer language.
New provision establishes user notification requirements when privacy policy changes, strengthening transparency and user consent management.
Removal of standalone consumer health data privacy provision may indicate consolidation into more specific mental health data handling sections rather than elimination of protections.
Removal of this standalone provision suggests privacy rights may now be addressed within jurisdiction-specific sections (CPRA, GDPR) rather than as universal user rights.
Removal of employer/B2B access provision may indicate policy changes to how Headspace handles workplace subscription programs or business customer data access.
Previous version referenced basic HIPAA Business Associate relationship; current version explicitly addresses dual-track data regime implications for HIPAA-covered vs. non-covered uses.
Provision was renamed from generic 'Data Sharing with Advertising and Analytics Partners' to explicitly specify mental health data sharing, emphasizing the sensitive nature of disclosed information.
Previous provision addressed general CCPA/CPRA rights; current version specifically targets CPRA's sensitive personal information category and corresponding opt-out mechanisms.
Provision name and severity level remained consistent between versions with no apparent textual changes.
Provision was renamed from 'Cookies and Tracking Technologies' to emphasize disclosure obligations, suggesting stronger transparency requirements in current version.
3 provisions unchanged.
View full change record →Cross-platform context
See how other platforms handle California CPRA Sensitive Personal Information and Opt-Out Rights and similar clauses.
Compare across platforms →