Mental Health Data Ownership: Who Should Own Your Therapy Data?

Quick answer: Your therapy data should belong to you. Right now, it mostly does not. Between January 2022 and May 2025, states introduced 793 bills about AI in health care. Only 28 even mentioned mental health, and not one protects the transcript an AI makes of a therapy-like conversation, per JMIR Mental Health (October 2025).

Twenty-eight out of 793. That is how many state AI health bills said the words “mental health” at all, in a 50-state review published in JMIR Mental Health (October 2025). Of the 143 bills the researchers judged relevant, just 20 became law, across 11 states. And zero bills, none, protect what an AI writes down when you tell it something painful.

I’m a licensed clinical social worker. My whole trade runs on one promise: what you say in the room stays in the room. So let’s walk through who can touch your therapy data today, what happened when a big platform got caught with it, and why my answer to the title question is short. You should own it. The long part is making that true.

What happens to your words after a session?

Start with what “therapy data” even means. It is your diagnosis. It is the notes your therapist writes. It is the intake form where you checked boxes about sleep, panic, and medication. If you use an app, it can include every word you typed into a chat window at 2 a.m.

Three kinds of hands can end up holding it.

First, you and your therapist. That is the original deal, and it is guarded by the oldest promise in this field: confidentiality.

Second, your insurer. To pay a claim, a commercial insurance company receives your diagnosis code and your visit dates. During reviews, a plan can ask for more of the record. And the line between “the company that pays” and “the company that treats” is blurring fast, because some large insurers now own therapy providers outright. I wrote about that in Your Insurer Is Becoming Your Therapist. When one company pays for your care, delivers your care, and holds your record, your data is working three jobs at once.

Third, platforms and apps. Here is the part most people miss. HIPAA, the federal health privacy law, covers therapists, hospitals, insurers, and companies working for them. Many mental health apps you download on your own sit outside HIPAA. For those apps, the real privacy rule is the terms of service. A document almost nobody reads, written by the company, and changeable by the company.

Which brings us to the platform that showed exactly what that document was worth.

What did BetterHelp do with therapy data?

It sent it to advertisers. In July 2023, the Federal Trade Commission finalized an order requiring BetterHelp, an online therapy platform, to pay $7.8 million (FTC, July 2023). The FTC found the company had shared users’ email addresses, IP addresses, and answers from its intake health questionnaire with Facebook, Snapchat, Criteo, and Pinterest, after promising to keep that information private. The order banned BetterHelp from sharing health data for advertising. It was also a first. The FTC had never before returned money to people whose health data was exposed this way.

Read that list slowly. Intake answers. Those are the questions about your mental health that you fill out before you ever meet a counselor. Questions about how bad things have gotten. Those answers went to ad platforms.

Yes, the case dates to July 2023, and it covered sharing from 2017 through 2020. I’m dating it on purpose, because the rule here is numbers with sources, never adjectives. Refund notices kept reaching users into 2024 and 2025, and the case is still the clearest public record of what “the platform holds your therapy data” can turn into.

One more plain definition, since it sits in this article’s title. “VC-backed” means funded by venture capital. Venture capital is money investors give a young company so it can grow very fast. Those investors need the company’s value to multiply, and user data often gets counted as part of that value. That is not an accusation against any one company. It is just the math a mental health platform lives inside. I’ve written before about why AI mental health apps keep failing the people who use them. This is the money layer underneath.

The money is sprinting, the rules are walking

Look at both tracks side by side.

The money track first. US digital health startups raised $14.2 billion in venture funding in 2025, up 35% from $10.5 billion in 2024, per Rock Health (January 2026). AI-enabled companies captured 54% of all those dollars, up from 37% a year earlier, and their deals ran about 19% larger than deals for companies without AI. The money is not waiting for the rules.

Now the rules track. 793 bills screened. 28 that even mention mental health. 20 passed, in 11 states (JMIR Mental Health, October 2025). The review’s authors put it flatly: “Despite the uniquely sensitive nature of mental health data, few states propose tailored privacy protections” for mental health AI systems. And they found no bill anywhere that protects AI-generated content, meaning the therapy-like transcripts and emotional disclosures these tools collect.

Hold on to that last one. A chatbot conversation about your worst night produces a transcript. As of that review, not one state bill protected it.

One state has at least drawn a bright line on behavior. On August 4, 2025, Illinois became the first state to prohibit AI from providing therapy or making therapy decisions, with fines up to $10,000 per violation (IDFPR, August 2025). AI can still help with office work, like preparing notes, under a licensed professional’s oversight. That is real progress, and I covered the broader wave in States Just Drew the Line on AI Therapy. But notice what Illinois regulates: what AI may do. It still does not settle who owns what the AI heard.

So here is the gap in one sentence. Billions of dollars are flowing toward collecting this data, and almost no law governs keeping it.

Most people already sense the problem

The public is not confused about this. In a national survey of 2,039 US adults published in JAMA Network Open in February 2025 (the survey itself was fielded in mid-2023), 65.8% reported low trust in their health care system to use AI responsibly. And 57.7% reported low trust that their health system would make sure an AI tool did not harm them.

People also want to be told when AI is in the room. In a separate JAMA Network Open survey of 2,021 adults (December 2024), 62.7% said it was “very true” that they want to be notified when AI is used in their care. Only 4.8% said notice was unimportant.

Put those two findings together. Most people do not trust the system to run AI responsibly, and nearly everyone wants to know when it is being used. The industry’s standard answer to both is a checkbox buried in the terms of service. A buried checkbox does not count as telling people. It mostly protects the company.

Here is what is at stake from my chair. Therapy works because a person says the unsayable out loud, and people only do that when they believe the words are safe. Every data scandal teaches the public to hold a little back. A client who holds back heals slower. The data economy is spending down the exact trust that care runs on.

So who should own your therapy data?

You should, and not just as a slogan. Here is what owning your mental health data should mean, in plain terms:

1. You can see it. Every note, every transcript, every label a system attached to you.
2. You can take it. A full, readable copy, without a fee or a fight.
3. You can delete it. When you leave a platform, your words leave with you.
4. Nobody sells it. Not to advertisers, and not to data brokers, meaning companies that buy and resell personal information.
5. You are told about AI. Before it listens, not after.

Now grade the three candidates from the title.

You and your clinician come closest. You already hold a legal right to see and copy your records, and your therapist is bound by license and law to protect them.

Your insurer fails the list. A commercial insurer’s interest in your record is the claim, and its record on mental health coverage is already a matter of public fines, which I walked through in The Business of Being Unwell. The more insurers merge with providers, the more your record works double duty: care file one day, cost file the next.

A VC-backed platform has to fight its own funding math to pass. Some may manage it. But the FTC has already shown us what happens when the incentives win, and no state law today stops a platform from treating your transcripts as inventory.

That is why the ownership question is the whole game, and it is part of why we built VibeCheck at Mental Wealth Solutions with one rule written before the first feature: the person’s words belong to the person. If you are a clinician, the same question lives inside your note tools, and there is a working guide on consent and whose note it is when an AI scribe joins a session that goes deeper.

And if you are simply a person with an app on your phone, do three things this week. Open the app’s privacy policy and search for the word “advertising.” If your employer offers a mental health app, ask the vendor in writing who can see usage data. And before you type anything raw into a chatbot, ask the question this whole article boils down to: who ends up owning these words?

The 28-out-of-793 number is not permanent. Laws move when enough people get loud. The BetterHelp order happened because users complained, regulators dug, and the paper trail held. Your words paid for this industry’s growth. The least the law can do is hand them back.

FAQ

Who legally owns your therapy records? Usually, the clinician or clinic keeps the record itself, and you hold a legal right to see it and get copies. App data is different. When you type into a mental health app, the company’s terms of service usually control what happens next. A 50-state review found no state bill protecting AI-generated therapy transcripts (JMIR Mental Health, October 2025).

Are mental health apps covered by HIPAA? Often, no. HIPAA covers therapists, doctors, hospitals, insurers, and companies working for them. Many apps you download on your own sit outside it. That gap is how BetterHelp’s intake answers reached Facebook, Snapchat, Criteo, and Pinterest, conduct that led to a $7.8 million FTC order (FTC, July 2023).

Can my insurance company see my therapy information? Part of it, yes. To pay a claim, a commercial insurer receives your diagnosis code and your visit dates, and plans can ask for more of the record during reviews. Some large insurers now own therapy providers too, which places treatment data and payment data under one corporate roof.

Do any states regulate AI in mental health care? A few, and thinly. Of 793 state AI health bills screened from 2022 to mid-2025, only 28 explicitly addressed mental health, and just 20 relevant bills passed, across 11 states (JMIR Mental Health, October 2025). Illinois went furthest. It banned AI from providing therapy on August 4, 2025, with fines up to $10,000 per violation (IDFPR, August 2025).

Sources

1. JMIR Mental Health, Governing AI in Mental Health: 50-State Legislative Review, October 2025. mental.jmir.org
2. Rock Health, 2025 Year-End Digital Health Funding Report, January 2026. rockhealth.com
3. JAMA Network Open, Patients’ Trust in Health Systems to Use Artificial Intelligence, February 2025 (survey fielded June to July 2023). pmc.ncbi.nlm.nih.gov
4. JAMA Network Open, Public Attitudes Toward Notification of Use of Artificial Intelligence in Health Care, December 2024. pmc.ncbi.nlm.nih.gov
5. Federal Trade Commission, final order banning BetterHelp from sharing sensitive health data for advertising, July 2023. ftc.gov
6. Illinois Department of Financial and Professional Regulation, Wellness and Oversight for Psychological Resources Act (HB 1806) signing, August 2025. idfpr.illinois.gov

Figures current as of July 2026.

Disclaimer

This article is for educational and informational purposes only. It does not constitute medical, clinical, legal, or therapeutic advice, and reading it does not create a therapist-client relationship with Matthew Sexton, LCSW or Mental Wealth Solutions, Inc. Although the author is a licensed clinical social worker, the content in this article is not clinical assessment, diagnosis, or treatment.

Privacy laws, state AI rules, and platform data practices vary by state and by company, change over time, and may change after this article is published. The cases and studies described here reflect specific companies, states, and survey samples, and may not match your app, your health plan, or your state. Nothing here is a substitute for reading a specific product’s privacy policy or for advice from a qualified attorney or privacy professional about your specific circumstances.

If you are in immediate emotional crisis, you can reach the 988 Suicide & Crisis Lifeline by calling or texting 988 (US). If you are experiencing domestic violence or are in physical danger, contact the National Domestic Violence Hotline at 1-800-799-7233 or visit thehotline.org. In a life-threatening emergency, call 911.