Sanvello

First reviewed April 20, 2022. Review updated, April 25, 2023

Hmmm...in 2023 Sanvello presents us with an interesting conundrum. When reviewing their privacy policy, we notice they say it is a "Web And Mobile Privacy Policy." Which, OK, that's fine. They then go on to say "Our Privacy Policy explains how we handle information collected from Sanvello.com or in the course of receiving Services. Additional privacy policies (such as our notice of privacy practices) may apply depending on the specific product or service and outline how we handle information collected in other ways." All of those words make it seems like their privacy policy could cover their mobile app as well as their website and mobile site. But it's not 100% clear to us that this privacy policy does cover their app as it is not explicitly stated. Note to anyone reading this, you should absolutely be able to tell if the privacy policy you are reading specifically covers the app, website, device, or services you are using. There should be zero question here. Unfortunately, we have questions.

So, assuming their privacy policy does cover the app (which is an assumption we have to make because we aren't 100% clear), how does it look? Well, the good news is, they have both a privacy policy for information collected when using their website, and they have a separate notice of privacy practices that covers how they handle the privacy and disclosure of medical information specifically. This is good. The bad news is, both their privacy policy and their notice of privacy practices for medical information outline a whole lot of ways they could share your personal information if you use their services. They outline enough information sharing or have enough confusing or vaguely worded statements in their privacy policy that we have concerns. And because they never responded to questions emailed to them at the email address listed on their website, we were unable to get the clarification needed to do anything but assume the worst with Sanvello. In 2023, they still receive our *Privacy Not Included warning label.

Read our 2022 review:

Sanvello says they can collect a lot of personal information, including name, email, gender, location, birth date, mood, health and biometric data, thought records, messages with your coach, and more. And they say the may combine all this personal data with information they get from other sources, such as potentially data brokers and advertising companies. And they say they may use and disclose de-identified and aggregated data for any purpose (here's where we remind you such de-identified data has been found to be relatively easy re-identify, especially if location data is included.) Red flags for us.

How do they say they can use all this data they collect on you? Sanvello says they can share your personal information with third party researcher partners for health or behavioral research purposes. They can share information about your use of Sanvello with health insurers or health plan administrators to evaluate your care (they say they won't share your thought records with health insurers). And Sanvello says they can use your personal information for advertising and promotional purposes. Finally, Sanvello adds that they can use your personal information "as otherwise necessary or useful for us to conduct our business, so long as such use is permitted by law or for any other purpose with your consent." That last part feels kinda broad and vague to us. Guess what, more red flags. 🚩 🚩 🚩

One last red flag with Savello. We emailed them multiple times as the email listed in their privacy policy for privacy-related questions and Savello didn't respond with answers to our privacy and security questions. So, we can't confirm if Sanvello meets our Minimum Security Standards.

What's the worst that could happen with Sanvello? Well, we suppose it's possible you could think it normal for a mental health app (or any app, but especially one that collects so much personal information) to collect and share so much of your personal information and get used to that as the norm in the world and completely give up on having any privacy at all. That's sounds terrible. Let's never let that happen.