Ginger

At first glance, the Ginger app seems alright privacy-wise. According to their many privacy policies, they don’t sell your data, they don't share your data widely with third parties for advertising purposes, they practice good cybersecurity hygiene, and they say they’ll delete your personal information upon request. All this looks pretty good to us. Good work Ginger.

We do want to call out one thing about Ginger -- and many other mental health apps -- that raises a concern for us. And it's those text-based chats you have with "coaches." Many people expect their personal conversations through online therapy sites to be private, or to be covered by stricter privacy laws protecting health care data, like HIPAA in the United States. But conversations with unlicensed coaches are often not required to be covered by these stricter privacy laws. What does that mean? Pretty much it means, beware what you share in text-based chat communications with online mental health apps unless you have been 100% guaranteed they are covered by strict health privacy laws like HIPAA. Otherwise, they could be used for things like improving the app, advertising or marketing, or turned in to "anonymized" data to be used for many purposes.

Yes, we have overarching concerns about online chat transcripts with all mental health apps. But what is actually going on with Ginger? Much of what happens inside the Ginger app is text-based coaching that’s available 24/7. A promotional video describes those chats as providing “guidance through tough emotional challenges.” Another part of the website suggests your coach can help you through some pretty tough stuff, like if you’re struggling with depression.

But what you should know, before your thumbs set that tiny digital keypad ablaze, is that all of those DMs back and forth become “Care” or “Coaching Data” that’s stored by Ginger. And though the services are marketed together with Headspace as “Mental healthcare,” coaching isn’t therapy. That’s because the coaches aren’t required to be licensed therapists, but it also means that those conversations aren’t necessarily covered by stricter health privacy laws.

For example, according to Ginger's FAQ, multiple coaches can be assigned to help you at different times, depending on availability and other factors, forming a “care team.” And all those coaches can talk to each other about what you’ve been talking to them about, “so they’ll know what you’ve been working on with another coach and where you left off.”

Ginger also mentions that “[their] unique platform analyzes chat transcripts and other data points to help coaches provide effective support for each member in their care.” And in their International Coaching Privacy Statement they say they can use that Coaching Data to “evaluate the quality and progress of our coaching program, and optimize [their] coaching services.”

So between the paper trail, the inter-coach-conferring, the technological analysis, and the somewhat ambiguous description of evaluating how you’re progressing and optimizing the services, those transcripts are being shared and used it lots of ways... which means they aren't what you might expect to call "private." Plus, it’s possible that they're part of the personal information that Ginger is allowed to share in an anonymized and aggregate form. In the US version of the Privacy Policy, they mention that that could include your (de-identified) health information too.

Given that Ginger is offered through employers, and that access to licensed therapists is available, but at a higher cost and sometimes only if your employer sponsors that, it seems most Ginger users will rely on these text-based "emotional coach" conversations. So remember, those conversations are likely not nearly as private as the video-based conversations you can sometime get through Ginger with a license therapist (those cost a lot more and sometimes require your employer to sponsor that feature). As one Ginger user pointed out, "When a patient has no way of knowing who at a healthcare practice knows the details of their mental health concerns, it means there are an undisclosed collection of people wandering around the world with knowledge of and access to that patient’s most private struggles, habits, and thoughts. This also means confidentiality — and any subsequent breach thereof — is nearly impossible to track."

What's the worst that could happen with Ginger? Well, the idea that your "emotional coaching" chat transcripts exist is enough to give us the privacy heebie jeebies. Knowing they could be shared around internally at Ginger and then having to trust an employer-sponsored app to keep everything private, well, we're glad Ginger has a decent privacy policy. We're still wary of such a model for mental health care and suggest you think this through before signing up and sharing that you really hate your boss with that emotional coach you're chatting with at 2am.