3 ms·

disclosure: I hold an equity position in an end to end encrypted, trust on first use communications app, not really relevant to this conversation so no value in

disclosure: I hold an equity position in an end to end encrypted, trust on first use communications app, not really relevant to this conversation so no value in naming them. I'm not terribly surprised at the number of services that have popped up in the last few years, but considering the sensitivity of the data (in many cases, info that most would consider to be some of our deepest feelings on a topic that we wouldn't want just anyone to hear about), I'm surprised at the lack of ventures working to distance themselves from the content of the conversations. It just feels like in this specific niche, protection of data would be a much bigger selling point than most others. I'd imagine any suitably well-funded chat service with end to end encryption could fund a subsidiary venture to build out a therapy-focused implementation of such, and especially in the world of therapy, hand-written notes would probably be preferred anyway, so there shouldn't be much in the way of storage of data aside from directory data for individual users of the service and probably card transaction pointers to a third party processor, plus a handful of other bits that still shouldn't be anywhere near as compromising as actual contents of conversation. Open to discussion on the topic. There's probably an angle I'm not seeing.

rbartelme 5y ago
I think it might depend on whether or not U.S. insurance companies are involved. If so HIPAA is a real liability as a company. For example, a former colleague worked at a high profile private research facility that had their HIPAA firewall breached and their entire department was fired. Assuming that chat logs on these apps could fall into that same class of data in the U.S., that's a huge amount of risk/liability as a company.
ChrisMarshallNY 5y ago
Folks may remember this little nightmare: https://www.politico.eu/article/cybercriminal-extorts-finnish-therapy-patients-in-shocking-attack-ransomware-blackmail-vastaamo/ https://www.politico.eu/article/cybercriminal-extorts-finnis... Sometimes, it's a good idea to keep things off computers, unless you can be sure of the quality and security (which is a challenge. Everyone says they are "secure," but we keep having clusterf**ks like this).
DarylZero 5y ago
> It just feels like in this specific niche, protection of data would be a much bigger selling point than most others As a matter of sales tactics, if you even remind them of the concept of privacy, they're less likely to buy. You want the buyer to imagine an idealized future in which their desires are realized. Very hard to sell on the vague promise that you're less untrustworthy than all the others in this very untrustworthy industry.
jimkleiber 5y ago
> I'm surprised at the lack of ventures working to distance themselves from the content of the conversations. Me too. I struggle to understand why most communication platforms don't try to do end-to-end encryption. From what I've seen, it can one, be a lot more complicated technically and two, hard to make a user experience that people enjoy. However, I don't know if people starting companies think enough about the ramifications of knowing (and storing) what people are saying to each other, legally and emotionally. I've been wanting to do more work online, especially over the pandemic, helping people express emotions and I've often balked at platforms because they don't have e2ee or they say they do and then are found out to not have it (ie Zoom). Most people may not desire this, but as someone who wants to run classes and have conversations about deep emotions, I strongly want almost all of the platforms to be e2ee. I would love gather.town, Discourse, Discord, Guilded, Clubhouse, and many other communication platforms to have e2ee as default. I want this for personal conversations but I strongly want/need this for professional conversations, and because it hasn't really been there on many of these platforms, I've just not had those conversations.
umarniz 5y ago
There are certain regulations that make it much harder to implement E2E. The data in a therapy app can be considered part of a clients medical file and the medical file has various compliance regulations affecting it e.g the data has to be accessible for the organisation for 15+ years. This has created a structure making E2E almost illegal in some healthcare domains as the policy ensures that the client data can be accessible to future therapists and accessible to the organisation under catastrophic scenarios. Only the app being E2E enabled is half the picture, the regulation has to either change or the compliance to the regulation by the mental health organisation has to be creatively done to ensure a complaint E2E implementation. This makes it a bigger, costlier problem than making therapy more effective and hence a ton of hesitation as unfortunately you don't 'need' to do it.

rbartelme 5y ago

I think it might depend on whether or not U.S. insurance companies are involved. If so HIPAA is a real liability as a company. For example, a former colleague worked at a high profile private research facility that had their HIPAA firewall breached and their entire department was fired. Assuming that chat logs on these apps could fall into that same class of data in the U.S., that's a huge amount of risk/liability as a company.

ChrisMarshallNY 5y ago

Folks may remember this little nightmare: https://www.politico.eu/article/cybercriminal-extorts-finnish-therapy-patients-in-shocking-attack-ransomware-blackmail-vastaamo/ https://www.politico.eu/article/cybercriminal-extorts-finnis... Sometimes, it's a good idea to keep things off computers, unless you can be sure of the quality and security (which is a challenge. Everyone says they are "secure," but we keep having clusterf**ks like this).

DarylZero 5y ago

> It just feels like in this specific niche, protection of data would be a much bigger selling point than most others As a matter of sales tactics, if you even remind them of the concept of privacy, they're less likely to buy. You want the buyer to imagine an idealized future in which their desires are realized. Very hard to sell on the vague promise that you're less untrustworthy than all the others in this very untrustworthy industry.

jimkleiber 5y ago

> I'm surprised at the lack of ventures working to distance themselves from the content of the conversations. Me too. I struggle to understand why most communication platforms don't try to do end-to-end encryption. From what I've seen, it can one, be a lot more complicated technically and two, hard to make a user experience that people enjoy. However, I don't know if people starting companies think enough about the ramifications of knowing (and storing) what people are saying to each other, legally and emotionally. I've been wanting to do more work online, especially over the pandemic, helping people express emotions and I've often balked at platforms because they don't have e2ee or they say they do and then are found out to not have it (ie Zoom). Most people may not desire this, but as someone who wants to run classes and have conversations about deep emotions, I strongly want almost all of the platforms to be e2ee. I would love gather.town, Discourse, Discord, Guilded, Clubhouse, and many other communication platforms to have e2ee as default. I want this for personal conversations but I strongly want/need this for professional conversations, and because it hasn't really been there on many of these platforms, I've just not had those conversations.

umarniz 5y ago

There are certain regulations that make it much harder to implement E2E. The data in a therapy app can be considered part of a clients medical file and the medical file has various compliance regulations affecting it e.g the data has to be accessible for the organisation for 15+ years. This has created a structure making E2E almost illegal in some healthcare domains as the policy ensures that the client data can be accessible to future therapists and accessible to the organisation under catastrophic scenarios. Only the app being E2E enabled is half the picture, the regulation has to either change or the compliance to the regulation by the mental health organisation has to be creatively done to ensure a complaint E2E implementation. This makes it a bigger, costlier problem than making therapy more effective and hence a ton of hesitation as unfortunately you don't 'need' to do it.