Headspace collects health and mental wellness information about you that is considered sensitive under multiple laws, including GDPR in Europe and state consumer health data laws in the US.
Mental health data is among the most sensitive personal information and misuse or breach of this data can have serious consequences for users' employment, insurance, and personal lives.
The collection of GDPR 'special category' health data and US state 'consumer health data' creates overlapping compliance obligations including consent requirements, data minimisation, breach notification, and consumer rights to access/deletion under GDPR, CCPA/CPRA, Washington MHMDA, Connecticut DPA, and Nevada SB 370; a DPIA may be required for EU processing.
Compliance intelligence locked
Regulatory citations, enforcement risk, and due diligence action items.
Watcher: regulatory citations. Professional: full compliance memo.
Headspace collects sensitive mental health and wellness data and processes it under multiple privacy regimes including GDPR and US state consumer health data laws. Users are bound by mandatory arbitration and waive class-action rights, limiting legal recourse if something goes wrong. You can opt out of arbitration by sending written notice to Headspace within 30 days of first agreeing to these Terms.