Woebot

How good are AI chatbots -- like Woebot--that you share all sorts of personal and emotional information with at protecting privacy? That's a very good question. One of the biggest risks with AI chatbots is keeping the information you share with them during your conversations secure. That means making sure no one else can read the contents of the conversations you have with the bot. But AI algorithms need to learn to get better at chatting with you. So when Woebot (or any AI chatbot) says they are "keeping previous chats in mind to provide the most beneficial and timely therapeutic suggestions," what does that mean? According to Woebot, that means they review de-identified portions of conversations and compare the AI-suggested path to the path chosen by the user to retrain their algorithms. Here's hoping those de-identified conversations are truly de-identified.

We do know Woebot says all your communications are encrypted both in transit and at rest, which is good. Something we, and other experts, always worry about is racial, gender, and cultural bias making their way into AI algorithms. This would not be good for a therapy app. Does Woebot have a bias issue in their algorithm? We sure hope not. But we also can't tell. This isn't unique to Woebot though. We generally can't determine if there is bias in any proprietary AI algorithm. It's also good to remember that while your personal chats with a human therapist are covered by strict health privacy laws like HIPAA, your personal chats with an AI chatbot aren't always similarly protected. Woebot does say that they "treat all user data as Protected Health Information and adhere to all HIPAA and GDPR requirements."

How does Woebot's privacy policies look to us? We have a few concerns. Woebot says they can collect personal info like name, email, IP address, "inferences drawn from other personal information to create a profile about a consumer," and the information you give them in your conversations. They also say they can "obtain information about you from other sources, including through third party services and organizations to supplement information provided by you." So, Woebot can collect a good deal of personal information, add to the information you give them with even more information gathered from third parties. Then they say they can share some of this information with third parties, including insurance companies and a seemingly broad category they call "external advisors." They also say in their privacy policy they share some of your information, such as identifiers and network internet activity, with marketing partners for advertising purposes. We were a little confused by this because they also state in their privacy policy, "We never, ever sell or share your data with advertisers." Those two statements seem in conflict to us.

Finally, Woebot says they aggregate or de-identified your personal information, including location and device information, and share it with third parties. This is a pretty common practice but we also must remind you that it has been found to be pretty easy to de-anonymize such data, especially if location data is included.

What's the the worst that could happen with Woebot? Hopefully nothing. But, what if the previous chats they keep in mind to provide you more beneficial therapeutic suggestions end up not being completely de-identified because you mentioned your dog HuskerDoodle in them and no one else has a dog named HuskerDoodle and that chat conversation gets leaked and the world knows all about your relationship with HuskerDoodle? OK, so this isn't likely to happen. Still, it's a good reminder that anything you share on the internet isn't 100% secure, that chats that are de-identified could, potentially, be re-identified under some circumstances, and Woebot is a for-profit company as well as your helpful mental health friend. Their own privacy policy states, "Unfortunately, no system is 100% secure, and we cannot ensure or warrant the security of any personal data you provide to us. To the fullest extent permitted by applicable law, we do not accept liability for unintentional disclosure." That's a good reminder to be careful out there folks.