Talkspace

First reviewed April 20, 2022. Review updated, April 25, 2023
We're sad to say, Talkspace has not improved their privacy practices since we reviewed them in 2022. If anything, we have more concerns about them this year than last. At least last year, it looked like all users, regardless of what privacy laws they lived under, could have their data deleted. This year, Talkspace has changed their privacy policy so that it now only mentions deletion rights for users in California, EU, EEA or UK. This means Talkspace now earns all three of our privacy dings. That's not good.

We will give Talkspace credit for reaching out and communicating with us about their privacy practices. And we have seen them work over the past year to try and clarify things in their privacy policy that raised concerns. We appreciate that, for sure. However, Talkspace does collect a good deal of personal information, and can share some personal information for targeted advertising purposes (but not any health related data after a user becomes a client, which is important and good). They also ask users straight away to take a questionnaire where pretty sensitive information is gather about things like a users' mental state, gender and gender identity, date of birth, and more. No privacy policy is presented before the answers to those questions are collected so you can understand how that information could be used. Indeed, Talkspace's Privacy Notice for California Users (which lays out more detailed privacy information than in their general privacy policy), states that Talkspace uses "inferences about your interests derived from your responses to surveys completed prior to becoming a subscriber" for marketing purposes, including for tailored advertisement. Uhg.

Talkspace has some flags on their track record for protecting and respecting their users' privacy that concern us as well. In 2022, three US Senators sent a letter to Talkspace expressing concerns about their use of patient's personal health data and requested more information about their data sharing and privacy practices. These Senators also sent a similar letter to BetterHelp (and good to note here that BetterHelp got in trouble with the US regulator agency the FTC, whereas no such judgement has been issued against Talkspace).

Unfortunately, we have to say that Talkspace's privacy practices seem no better to us in 2023, and maybe even seem a bit worse. They do make it clear in their privacy policy they take stronger measures to protect the privacy of users who pay up and become patients, but they still raise privacy concerns for us. Especially for saying they can collect things like gender identify and sexual orientation in the survey responses you provide before you become a subscriber and then using and sharing that for marketing purposes.

Read our review from 2022:

Talkspace comes with a fair amount of baggage when it comes to protecting and respecting their users' privacy and security. In 2020, the NY Times reported on allegations from former Talkspace employees about questionable marketing practices and questionable handling of private therapy chat logs. The founders of Talkspace disputed some of the claims made in the article. Consumer Reports reported in 2021 that Talkspace does collect data from Facebook for ads, although they said they only use information about a person before they start therapy. There's also this 2019 article from Mashable detailing more questionable marketing practices and CNBC reported in 2020 about privacy, transparency, and oversight concerns for therapy apps like Talkspace. All of this reporting leaves us concerned. And then there is Talkspace's own privacy policy, privacy notice, and additional privacy statements that leave us concerned. And sometimes scratching our head in confusion too.

Talkspace says they can collect a lot of personal information on users, including name, email, address, phone number, gender, relationship status, employer, geolocation information, chat transcripts and more. While Talkspace says in their privacy notice they will not sell your medical information to others, we could find no promise to not sell non-medical information in their privacy policy (except for residents of California and those in Europe and the UK living under GDPR privacy laws). This is something we like to see stated clearly. (Update: On June 14th, 2022, Talkspace updated their privacy policy to state, "Talkspace does not sell client information to third parties.")

They do say they can use your personal information for marketing, tailored advertising, and research purposes. And while your medical information is protected under HIPAA privacy laws -- which is good -- Talkspace also says "your written authorization will be required for uses and disclosures of psychotherapy notes and uses and disclosures of your protected health information for marketing." Which indicates that Talkspace could ask for your permission to use your health info and therapy notes for marketing purposes. Which feels like bad form to us. (Update: On June 14, 2022, Talkspace updated their privacy policy to remove any mention of "psychotherapy notes." They use the term "chat data" to refer to data you provide when you use the service. They say they can use this data "To conduct clinical and other academic research, internally and with approved research partners and identify summary trends or insights for use in external communications (where direct identifiers such as name and contact details have been removed, or pursuant to explicit patient authorization)."

We did reach out multiple times to try to get answers to our privacy and security related questions to the email address Talkspace lists in their privacy policy for privacy related questions. Unfortunately, they never responded to our questions. After we published our review of Talkspace, they did respond to our questions and confirm they take all the security steps necessary to meet our Minimum Security Standards, including a way for people to report security vulnerabilities. However, we did find a report from Techcrunch in 2020 where one security researcher found a bug in Talkspace, tried to report it to them, and in response Talkspace threatened to sue the researcher. Which feels like even more bad form to us.

So when Talkspace says in their privacy policy, "If you do not want us to share personal data or feel uncomfortable with the ways we use information in order to deliver our Services, please do not use the Services" we think that's pretty good advice.