Cerebral

We’d expect an app called “Cerebral” to be, uh, smarter about protecting your personal data. Especially because it handles protected health information covered by the US’s stronger health privacy law, HIPAA. So, being conscientious should be a no-brainer… Right? Cue the sad trumpet sound. The short answer is no.

Cerebral could go head-to-head with your doctor and your dog on the topic of intimate knowledge about you. Now, a lot of that information is given by you to get treatment, like your medical history, your Social Security number, and even your feelings – or “emotional characteristics” as their privacy policy puts it. And while it makes sense for them to have access to that in the context of care, handing it over means granting them a lot of trust. And considering earlier in 2023 Cerebral says they revealed that they shared the private mental health information of millions -- yes, millions, 3.1 million to be exact -- of their users, well, trust isn't something we'd say they are worthy of right now. As TechCrunch pointed out, according to a list put together by the U.S. Department of Health and Human Services, Cerebral's big data oopsy was the one of the largest breaches of Americans’ health data so far in 2023.

On top of what you tell them about yourself, Cerebral may collect information about how you use the services, like which products you’re using, when, and from what computer. Okay, if you must. But here’s where they may be getting a little greedy. Cerebral leaves the door open to collect information about you elsewhere, like social media sites and public sources, and combine it with what they already know about you. Plus, your lovely privacy researcher identified a heck of a lot of tracking going on, detecting 799 points of contact with different ad platforms during one minute of app activity. Why are you so obsessed with us, Cerebral?

They promise that the intimate knowledge will help them to “to better understand your interests and needs,” but it’s not clear whether that actually benefits you or not. They also mention “measuring the effectiveness of advertising and content we serve to you and others to deliver and customize relevant advertising and content to you” but that part definitely feels like that’s more like a benefiting-them-thing.

Here’s where we can share a little silver lining on an otherwise gray matter: they say that they “do not ‘sell’ your personal information and have not done so in the prior 12 months from the effective date of this Policy.” So your data’s not for sale! Not exactly cause for celebration, but we’ll take it.

Now scurrying back to the bad news. It’s worth mentioning that they’ve given themselves carte blanche to do what they want with your information so long as it’s de-identified or “no longer reasonably capable of being associated with you.” And we’ve got a two-pronged beef with that. The first is, studies have found “anonymized data” can be hard to make truly anonymous . But even if it was, most people probably don’t mean to agree to be a guinea pig when they click “accept” on a single checkbox as they’re signing up to seek help. Indeed, Cerebral says in their privacy policy that once they anonymize the data they can use it "for any purpose, including for research and marketing purposes, and we may also share such information for any purpose with any third parties, at our discretion." Uh..yikes.

So what if you change your mind and want to take back ownership of all that super-intimate information you shared with Cerebral? Well, it’s not clear whether all users have the right to have their data deleted. Indeed, if you don't live under stricter privacy laws like California's CCPA, you might be out of luck trying to get your data deleted according to Cerebral's privacy policy.

In Cerebral’s case, it’s not too tough to imagine what could go wrong when you share your most sensitive personal information with them -- it already happened when they admitted they shared millions of their customers personal information, including potentially some pretty sensitive mental health information, for their own marketing purposes without permission. Yup, that's bad.