This analysis describes what Headspace's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
The provision creates a dual privacy framework: HIPAA compliance applies when Care Providers are engaged, while state-specific consumer health data laws apply to other health data collected. This establishes different regulatory obligations and data handling standards depending on the user's interaction type.
This provision was replaced with more detailed 'Third-Party Advertising and Analytics Data Sharing' provision that explicitly characterizes the practice as potential CCPA/CPRA 'sale' or 'sharing'.
View full change record →Users may be subject to either HIPAA protections (when using Care Provider services) or state consumer health data privacy laws (for other health data), with Care Providers potentially issuing separate privacy notices during enrollment that users should review to understand which framework applies to their data.
How other platforms handle this
The types of third parties your information may be disclosed to include: our resellers and other sales and advertising partners, retailers, advertisers, ad agencies, advertising networks and platforms, information service providers, fraud monitoring and prevention providers, and publishers.
Protect us, our business, our users, and others, for example to enforce our terms of service, prevent spam or other unwanted communications, and investigate or protect against fraud
we may use, retain or share information with law enforcement or others in circumstances where a person's vital interests require protection, such as in the case of emergencies.
"Headspace is subject to HIPAA as our Care Providers' business associate. Our Care Providers may provide you an additional privacy notice during enrollment which we encourage you to review. Depending on how you interact with us, the following may also apply to you: Our Consumer Health Data Privacy Policy applies to certain consumer health data that is regulated under applicable state consumer health data laws.Excerpt from Headspace's Privacy Policy
ConductAtlas detected a major restructuring of Meta’s privacy policy that removed detailed consumer rights disclosures and relocated them to separate documents.
Your genetic data may be transferred to a new owner as a business asset. Here is what the Terms of Service actually say and what you can do right now.
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
The provision creates a dual privacy framework: HIPAA compliance applies when Care Providers are engaged, while state-specific consumer health data laws apply to other health data collected. This establishes different regulatory obligations and data handling standards depending on the user's interaction type.
Users may be subject to either HIPAA protections (when using Care Provider services) or state consumer health data privacy laws (for other health data), with Care Providers potentially issuing separate privacy notices during enrollment that users should review to understand which framework applies to their data.
ConductAtlas has identified this type of provision across 288 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Headspace.