Liberate

Like many of the mental health apps we reviewed, Liberate raises a number of privacy questions and concerns for us. Take this line from their privacy policy, "We do not sell or rent your personally identifiable information to third parties for their marketing purposes without your prior consent." We take this to mean they may sell or rent your personal information to third parties if you consent.

The consent question is always a big one for us. How clearly does Liberate ask for consent when they want to sell or rent your personal information? People often rapidly click through terms of service and privacy policy agreement asks when signing up for an app. If you don't read Liberate's privacy policy closely you won't know they say, "By accepting the Policy during registration, you expressly consent to our collection, storage, use and disclosure of your personal information as described in this Policy." Does that mean you consent to have your personal information (but not health data) sold, rented, and shared with a number of third parties for purposes such as personalization, advertising, marketing, and more when you accept their policy during registration? It sure seems so but we can't tell for sure. Giving your consent should never be this confusing. And this is probably way beyond what most people expect will happen with their personal information when rapidly clicking through the registration process during sign up. that worries us a great deal.

Liberate says they can collect a fair amount of personal information, including name, email address, photograph, geolocation, IP address, device identifiers, and Facebook profile information if you opt to sign into their services through Facebook (which you should never do). They then go on to say they may combine your information with information they collect from other sources. So much personal information, so many questions about if they're selling it to others. It's good they say they won't share your personal data with third parties in order for that third party to provide direct marketing communications to you.

We have too many questions to feel good about Liberate's privacy practices. And we can't determine if they meet our Minimum Security Standards in part because they never responded to our email with privacy and security related questions sent to contact listed in their privacy policy.

What's the worst that could happen? Well, we worry you could download the app, speed through the sign-up and registration process and click "agree" to their privacy policy without realizing that by doing so you may have just given Liberate consent to sell or rent your data to who knows who. Maybe that's not so terrible, maybe it is. Regardless, we would like to see a meditation app designed to help with your mental wellbeing do better at being a safe space for your privacy.