Headspace

You are agreeing to have your personal identifiers shared with third-party advertising platforms for cross-context behavioral targeting.

“For that purpose, we may disclose limited personal information to third parties for our cross-context behavioral and targeted advertising purposes and this activity may fall under broader concepts of “selling” and/or “sharing” under the CCPA.”

What that means: Your personal identifiers and browsing history may be exchanged with advertisers in exchange for monetary value or platform benefits.

The California section explicitly states that sharing data for targeted advertising falls under the legal definitions of selling or sharing. This includes identifiers like email and IP addresses.

You are agreeing to the collection and potential sharing of your mental health, therapy, and wellness survey results with affiliated medical providers and sponsors.

“We will collect the information you provide about your health and wellness as you use our Products or engage with the Services... We understand that this information is very sensitive so we handle it with care, including treating this health information as protected health information under HIPAA where applicable.”

What that means: Your most private medical and wellness details are collected and may be shared with affiliated medical entities or your employer’s benefit provider.

The document confirms the collection of highly sensitive mental and physical health data, including therapy sessions and survey responses. While treated as PHI where applicable, it is still shared with affiliates like Headspace Medical and potentially Benefit Sponsors.

You are agreeing to provide and store sensitive demographic and medical history data, including race and sexual orientation, in your profile.

“Through your account in our Product, you may have the opportunity to provide additional information about yourself, such as your age, race and ethnicity, sexual orientation, preferred pronouns, gender or gender identity, sex at birth, marital status, and details about your health and medical history.”

What that means: You must provide highly personal demographic and health data to access certain profile features, which the company then retains and processes.

The policy requires or encourages the provision of sensitive demographic and biographical data, including sexual orientation, gender identity, and race, beyond what is strictly necessary for basic app functionality.

You are agreeing to indefinite data retention based on the company's assessment of legal needs and ongoing relationships.

“We will keep your personal information for as long as needed to perform our obligations to you, or for as long as legally permitted. The criteria used to determine our retention periods include: (i) the length of time we have an ongoing relationship with you...”

What that means: Your data may be stored for an unpredictable, potentially indefinite duration at the company's sole discretion.

Data retention is based on vague 'legitimate interests' and 'ongoing relationships' rather than a fixed timeline. This gives the company discretion to keep data indefinitely if they deem it necessary for their legal position or service delivery.

You are agreeing to the automatic tracking of your device data, usage patterns, and approximate location while using the products.

“Our Products and Websites may collect information from you automatically during your use which may include: Browser and device data... Usage data, such as time spent on the Products and Websites including pages visited... approximate location...”

What that means: Your app usage habits, page views, and general location are tracked automatically without continuous active interaction.

The policy allows for automatic collection of detailed usage patterns, browser data, and approximate location tracking to monitor user behavior and improve services.

You are agreeing that the company can modify this privacy policy at any time, with notice provided only for significant changes.

“We may update this Privacy Policy from time to time... When we may make a significant change... we will notify you within the Platform or through another channel such as the email you supplied during account registration, in addition to posting the revised version on our Website.”

What that means: Your privacy rights and data handling practices may change without your explicit renewed consent.

The company can update the policy at any time. While they promise notification for 'significant' changes, the definition of significant is subjective, and continued use likely constitutes acceptance.

You are agreeing that the platform may collect data from children aged 6-12 if they are referred for in-person care services.

“Our Platform is not intended for individuals below 13 years old or the equivalent age in your jurisdiction... There is a limited exception if you are a parent under a supported employee assistance program (EAP), you may refer your child of at least 6 years old to our Care Providers for in-person care but cannot create an app account for them.”

What that means: Children as young as 6 may have their personal information collected if referred for care by a parent or guardian.

While the platform claims not to target under-13s, it explicitly acknowledges children aged 6-12 can receive 'in-person care' via referrals, meaning some data collection from minors occurs under specific circumstances.