9 ms·

Top Mental Health and Prayer Apps Fail at Privacy, Security (2022)

159 points by TrisMcC 3y ago

lynx23 3y ago
[flagged]
- bell-cot 3y ago
  My reaction, too. OTOH, the article is pretty obviously aimed at an audience which might really benefit from some more "...and don't stick your finger in a light socket, either!"-level warnings.
  - robertlagrant 3y ago
    We all benefit from those warnings. Who isn't taught to not stick their fingers in light sockets?
    - bell-cot 3y ago
      A human can be old enough that hearing reminders about computer data generally consisting of 0's and 1's, or that spare diapers are handy when an infant is around, or the 'R' on the gearshift lever standing for 'Reverse', or {etc.} ...may no longer be a good use of the old human's time.
      - robertlagrant 3y ago
        I'm sure the old human will have also learned that the world's general warnings and advice can't be individually tailored to what the old human happens to know or not know.
- Forgeties79 3y ago
  Believe it or not, a lot of people are not aware this is a major problem for wellness/prayer apps specifically. I was one of those people and found this interesting. You’re being needlessly snarky and condescending.
  - lynx23 3y ago
    Sure, I am everything you'd like to hate. In a few years, every comment asking for personal accountability will be called "needlessly snarky and condescending". Until then, I don't give up pointing out the obvous, even if people like you feel caught and retaliate. This childish reaction doesn't touch me at all, kid.
daniel-cussen 3y ago
[dead]
hospitalJail 3y ago
>Mozilla’s Minimum Security Standards, like requiring strong passwords What if I don't want a strong password? What if I have 0 care for my account because I never wanted an account to being with but was strong armed into giving away my email, phone number, and now need a unique password because I'm worried someone is going to see that I 'prayed' 100 times. I loved that reddit didn't need an email, and I could use a generic password. If I lost my reddit account, no big deal at all. For my personal/PR reddit account, email and strong password, great.
- mehlmao 3y ago
  The information stored in therapy or prayer apps is much more sensitive than a disposable Reddit account.
- gjsman-1000 3y ago
  One very, very basic measurement / thought experiment for holiness in Christian circles to think about is the following: Imagine Christianity is illegal. Imagine the government decides to prosecute you, but hires the weakest, most incompetent, repeatedly-almost-disbarred prosecutor there is. You meanwhile get access to David Boies. Would the government have enough evidence for even the worst prosecutor to prove you are a Christian? Well, if not… it’s like Mozilla doesn’t realize that religious people don’t mind prayer being a fairly public act as long as people against them aren’t preying on them. Catholics have Mass every Sunday; Muslims have their five-times-daily prayers and often wear clothing that clearly identifies them as such; and so forth.
  - hospitalJail 3y ago
    Your thought problem isnt productive because it creates a fake scenario that creates validity to an otherwise invalid problem. Okay, if Christianity is illegal you'd want your Christian apps to be secure. If Christianity isnt illegal, you don't care. You'd want privacy if you were using the silk road, but you are probably okay with your alarm clock app collecting the number of times you hit snooze. You'd also be okay if the US/Chinese government knew that you hit snooze.
iinnPP 3y ago
Canada recently funded a mental health website which suffers from many of the same problems mentioned in the article. It's under review with OPC currently, but additional reports always help. This website is advertised by our PM to children. https://www.wellnesstogether.ca https://www.wellnesstogether.ca
hospitalJail 3y ago
iOS or Android, both get your data. What is the difference in privacy? Please use actual examples and not boogeymen 'Google is an ad company'. I personally have seen iphones(or at least iphone users) have far more intrusive and customized ads to the point where saying a word in a home puts you at risk of getting physical mail related to that word. (It was dog food, and a dog food ad.) I've come to the conclusion that privacy and security are mostly theater, and if I am being realistic, I need to assume everything I say/do is being recorded. I also treat my devices as compromised. Any thoughts that your device is private or secure is delusion.
- chrisallenlane 3y ago
  FWIW, I don't have any pets (and haven't for some time), but I receive physical mail regarding dog food, dog toys, etc, all the time. There's a chance you've been fooled by randomness here. That said, there's certainly no harm in treating your device as compromised. I do the same. "Better safe than sorry."
  - hospitalJail 3y ago
    Well, the specific name of the company that was mentioned showed up, and us getting 0 dog related stuff prior, and 0 dog stuff since, makes it sus.
NoZebra120vClip 3y ago
I was pleased to see that Hallow earned their seal of approval, or should I say it evaded their badge of shame? Hallow's a good app, professionally developed, and it's marketed tirelessly. I had my friend asking me if it was a good app to install. I don't know; I use other ones but not Hallow. I was also pleased to see that "BetterHelp" earned the badge of shame. BetterHelp is just on this side of an outright scam. They contract with legitimate counselors and therapists and then cram their appointment books full of Zoom sessions. They claim that you can just send a quick text message to your "therapist" and get helped. But people aren't getting helped, they're just getting taken for a ride. This aggregation of gig-working counselors in an app is a really bad way to conduct this kind of business. It may work for a ride-hailing service, but not for mental health care. If you're thinking of using "BetterHelp" or one of its analogs, please instead consider doing your homework, finding a legitimate clinic or therapist who's licensed in your state, and do an intake directly with their practice. Many of them are now amenable to televideo appointments, and they will work with or without your insurance or on a sliding scale. There are really good therapists out there who don't need to be found on a janky app.
- EatingWithForks 3y ago
  Of note one of the things not mentioned in "BetterHelp" is that the ability to not text your therapist at all hours of the day is actually very important for mental health. The therapist is a tool, not a crutch, and shouldn't be treated like a coping mechanism. A therapist is supposed to help teach and guide someone to develop healthier behavior patterns, and time away from the therapist to implement those patterns by onesself is very important.
- JohnMakin 3y ago
  While you're not wrong, in many many states in the US, if not a majority of them, finding a therapist that is both a) covered by your insurance and b) accepting new patients can be extraordinarily difficult if not impossible. At the same time, demand for mental health care is steadily rising. That's why these apps do so well.
  - deleted 3y ago
    [deleted]
bloopernova 3y ago
Nice to see that the app I use, Finch, is rated fairly well. I'm going to assume sharing an invite code would go badly, but if you want mine so you get a mini pet in the app, please email me at the address in my profile. The benefit I get is not monetary: if I get a few signups I get a mini pet myself. Finch is one of the few self help apps that really seems to help me. I was slipping further into deep depression but Finch has helped me to have a few good days, and I've showered and changed my clothes every day for 2 weeks. I recommend it!
dolmen 3y ago
About https://foundation.mozilla.org/fr/privacynotincluded/categories/mental-health-apps/ https://foundation.mozilla.org/fr/privacynotincluded/categor... Privacy not included there also: that Mozilla web site use Google Fonts and Google Tag Manager which are not GDPR compliant.
haswell 3y ago
Missing is the “Waking Up” meditation app which is a treasure trove of content and the first app that helped me “get” meditation. I submitted it on their form for review, but was a little surprised to see it missing from a “top” list. Seeing this report makes me really want to build privacy-respecting apps in this space. Of all categories, using traditional monetization and data selling practices seems particularly bad here. (Not affiliated in any way; just a happy customer hoping they aren’t abusing my data too badly…)
uejfiweun 3y ago
I wonder if this sort of thing has any relation to the revelations that the US Government is one of the largest buyers of private data from apps and such. Would certainly seem to make sense.
sudobash1 3y ago
It is disheartening (although not that surprising) to see how many companies are "double dipping" here. For example Pray.com seems particularly bad. It has a $7.99 a month subscription, but still track and sell your information just like a "free" app would. Ordinarily I feel much better about an app which has a clearly defined, above-board, method of funding itself. (The old "if you aren't paying for the product, you are the product" thing). But this is a good reminder that it is "if" not "if and only if".
adamwong246 3y ago
I hate to be the one who has to say the quiet part out loud but- what in the world are we doing to ourselves? Were these apps FOSS I might not be so alarmed but how do you think these companies are paying the bills? With good karma? No, YOUR DATA. And not just your GPS location or your favorite brand of ice cream, but your most vulnerable and intimate of thoughts. Now, shudder at the thought that not only can these apps leech your data, they can now poke back, manipulating the user to god know's what. And of course, your health insurance provider is now peering into your soul. They'll surely be happy to mandate that you can no longer attend "human" therapy.
- aio2 3y ago
  Some people are stupid.
- xctr94 3y ago
  You’re sadly right, but many of these apps have a freemium model. BetterHelp isn’t free at all, it’s actually fairly expensive; so one could argue they should not need to phone in your data to so many third-parties. I pay my therapist for their services, assuming there’s a high degree of confidentiality in our relationship. These apps, even paid ones, behave like any other app in terms of data sharing. And not to mention that some of this information might be covered by HIPAA?
anotheraccount9 3y ago
This is concerning. I'm using one of these services and if my mental health details were to be known, I would not only feel devastated, but this would negatively impact my career and social life (for a long time?). I need to know I can trust these folks, but what are other options? I can't find any psychologists or psychotherapists in my area who are available (many don't even answer my calls or emails). Do you know of any good and trustworthy online services for this?
- adamwong246 3y ago
  I believe that this problem is one of sheer personal responsibility. That is, I don't really trust therapists much more than these apps. Support groups and self-help books are better but in the end, only pure "shadow work" can really save you. You must learn to be your own therapist.
  - xctr94 3y ago
    As someone that did shadow work, this is disingenuous and unhelpful. People undergoing depression or PTSD can’t be told to “man up” and work on themselves alone. Therapists are usually very careful with confidentiality.

159 points by TrisMcC 3y ago

lynx23 3y ago

[flagged]

bell-cot 3y ago
My reaction, too. OTOH, the article is pretty obviously aimed at an audience which might really benefit from some more "...and don't stick your finger in a light socket, either!"-level warnings.
- robertlagrant 3y ago
  We all benefit from those warnings. Who isn't taught to not stick their fingers in light sockets?
  - bell-cot 3y ago
    A human can be old enough that hearing reminders about computer data generally consisting of 0's and 1's, or that spare diapers are handy when an infant is around, or the 'R' on the gearshift lever standing for 'Reverse', or {etc.} ...may no longer be a good use of the old human's time.
    - robertlagrant 3y ago
      I'm sure the old human will have also learned that the world's general warnings and advice can't be individually tailored to what the old human happens to know or not know.
Forgeties79 3y ago
Believe it or not, a lot of people are not aware this is a major problem for wellness/prayer apps specifically. I was one of those people and found this interesting. You’re being needlessly snarky and condescending.
- lynx23 3y ago
  Sure, I am everything you'd like to hate. In a few years, every comment asking for personal accountability will be called "needlessly snarky and condescending". Until then, I don't give up pointing out the obvous, even if people like you feel caught and retaliate. This childish reaction doesn't touch me at all, kid.

daniel-cussen 3y ago

[dead]

hospitalJail 3y ago

>Mozilla’s Minimum Security Standards, like requiring strong passwords What if I don't want a strong password? What if I have 0 care for my account because I never wanted an account to being with but was strong armed into giving away my email, phone number, and now need a unique password because I'm worried someone is going to see that I 'prayed' 100 times. I loved that reddit didn't need an email, and I could use a generic password. If I lost my reddit account, no big deal at all. For my personal/PR reddit account, email and strong password, great.

mehlmao 3y ago
The information stored in therapy or prayer apps is much more sensitive than a disposable Reddit account.
gjsman-1000 3y ago
One very, very basic measurement / thought experiment for holiness in Christian circles to think about is the following: Imagine Christianity is illegal. Imagine the government decides to prosecute you, but hires the weakest, most incompetent, repeatedly-almost-disbarred prosecutor there is. You meanwhile get access to David Boies. Would the government have enough evidence for even the worst prosecutor to prove you are a Christian? Well, if not… it’s like Mozilla doesn’t realize that religious people don’t mind prayer being a fairly public act as long as people against them aren’t preying on them. Catholics have Mass every Sunday; Muslims have their five-times-daily prayers and often wear clothing that clearly identifies them as such; and so forth.
- hospitalJail 3y ago
  Your thought problem isnt productive because it creates a fake scenario that creates validity to an otherwise invalid problem. Okay, if Christianity is illegal you'd want your Christian apps to be secure. If Christianity isnt illegal, you don't care. You'd want privacy if you were using the silk road, but you are probably okay with your alarm clock app collecting the number of times you hit snooze. You'd also be okay if the US/Chinese government knew that you hit snooze.

iinnPP 3y ago

Canada recently funded a mental health website which suffers from many of the same problems mentioned in the article. It's under review with OPC currently, but additional reports always help. This website is advertised by our PM to children. https://www.wellnesstogether.ca https://www.wellnesstogether.ca

hospitalJail 3y ago

iOS or Android, both get your data. What is the difference in privacy? Please use actual examples and not boogeymen 'Google is an ad company'. I personally have seen iphones(or at least iphone users) have far more intrusive and customized ads to the point where saying a word in a home puts you at risk of getting physical mail related to that word. (It was dog food, and a dog food ad.) I've come to the conclusion that privacy and security are mostly theater, and if I am being realistic, I need to assume everything I say/do is being recorded. I also treat my devices as compromised. Any thoughts that your device is private or secure is delusion.

chrisallenlane 3y ago
FWIW, I don't have any pets (and haven't for some time), but I receive physical mail regarding dog food, dog toys, etc, all the time. There's a chance you've been fooled by randomness here. That said, there's certainly no harm in treating your device as compromised. I do the same. "Better safe than sorry."
- hospitalJail 3y ago
  Well, the specific name of the company that was mentioned showed up, and us getting 0 dog related stuff prior, and 0 dog stuff since, makes it sus.

NoZebra120vClip 3y ago

I was pleased to see that Hallow earned their seal of approval, or should I say it evaded their badge of shame? Hallow's a good app, professionally developed, and it's marketed tirelessly. I had my friend asking me if it was a good app to install. I don't know; I use other ones but not Hallow. I was also pleased to see that "BetterHelp" earned the badge of shame. BetterHelp is just on this side of an outright scam. They contract with legitimate counselors and therapists and then cram their appointment books full of Zoom sessions. They claim that you can just send a quick text message to your "therapist" and get helped. But people aren't getting helped, they're just getting taken for a ride. This aggregation of gig-working counselors in an app is a really bad way to conduct this kind of business. It may work for a ride-hailing service, but not for mental health care. If you're thinking of using "BetterHelp" or one of its analogs, please instead consider doing your homework, finding a legitimate clinic or therapist who's licensed in your state, and do an intake directly with their practice. Many of them are now amenable to televideo appointments, and they will work with or without your insurance or on a sliding scale. There are really good therapists out there who don't need to be found on a janky app.

EatingWithForks 3y ago
Of note one of the things not mentioned in "BetterHelp" is that the ability to not text your therapist at all hours of the day is actually very important for mental health. The therapist is a tool, not a crutch, and shouldn't be treated like a coping mechanism. A therapist is supposed to help teach and guide someone to develop healthier behavior patterns, and time away from the therapist to implement those patterns by onesself is very important.
JohnMakin 3y ago
While you're not wrong, in many many states in the US, if not a majority of them, finding a therapist that is both a) covered by your insurance and b) accepting new patients can be extraordinarily difficult if not impossible. At the same time, demand for mental health care is steadily rising. That's why these apps do so well.
- deleted 3y ago
  [deleted]

bloopernova 3y ago

Nice to see that the app I use, Finch, is rated fairly well. I'm going to assume sharing an invite code would go badly, but if you want mine so you get a mini pet in the app, please email me at the address in my profile. The benefit I get is not monetary: if I get a few signups I get a mini pet myself. Finch is one of the few self help apps that really seems to help me. I was slipping further into deep depression but Finch has helped me to have a few good days, and I've showered and changed my clothes every day for 2 weeks. I recommend it!

dolmen 3y ago

About https://foundation.mozilla.org/fr/privacynotincluded/categories/mental-health-apps/ https://foundation.mozilla.org/fr/privacynotincluded/categor... Privacy not included there also: that Mozilla web site use Google Fonts and Google Tag Manager which are not GDPR compliant.

haswell 3y ago

Missing is the “Waking Up” meditation app which is a treasure trove of content and the first app that helped me “get” meditation. I submitted it on their form for review, but was a little surprised to see it missing from a “top” list. Seeing this report makes me really want to build privacy-respecting apps in this space. Of all categories, using traditional monetization and data selling practices seems particularly bad here. (Not affiliated in any way; just a happy customer hoping they aren’t abusing my data too badly…)

uejfiweun 3y ago

I wonder if this sort of thing has any relation to the revelations that the US Government is one of the largest buyers of private data from apps and such. Would certainly seem to make sense.

sudobash1 3y ago

It is disheartening (although not that surprising) to see how many companies are "double dipping" here. For example Pray.com seems particularly bad. It has a $7.99 a month subscription, but still track and sell your information just like a "free" app would. Ordinarily I feel much better about an app which has a clearly defined, above-board, method of funding itself. (The old "if you aren't paying for the product, you are the product" thing). But this is a good reminder that it is "if" not "if and only if".

adamwong246 3y ago

I hate to be the one who has to say the quiet part out loud but- what in the world are we doing to ourselves? Were these apps FOSS I might not be so alarmed but how do you think these companies are paying the bills? With good karma? No, YOUR DATA. And not just your GPS location or your favorite brand of ice cream, but your most vulnerable and intimate of thoughts. Now, shudder at the thought that not only can these apps leech your data, they can now poke back, manipulating the user to god know's what. And of course, your health insurance provider is now peering into your soul. They'll surely be happy to mandate that you can no longer attend "human" therapy.

aio2 3y ago
Some people are stupid.
xctr94 3y ago
You’re sadly right, but many of these apps have a freemium model. BetterHelp isn’t free at all, it’s actually fairly expensive; so one could argue they should not need to phone in your data to so many third-parties. I pay my therapist for their services, assuming there’s a high degree of confidentiality in our relationship. These apps, even paid ones, behave like any other app in terms of data sharing. And not to mention that some of this information might be covered by HIPAA?

anotheraccount9 3y ago

This is concerning. I'm using one of these services and if my mental health details were to be known, I would not only feel devastated, but this would negatively impact my career and social life (for a long time?). I need to know I can trust these folks, but what are other options? I can't find any psychologists or psychotherapists in my area who are available (many don't even answer my calls or emails). Do you know of any good and trustworthy online services for this?

adamwong246 3y ago
I believe that this problem is one of sheer personal responsibility. That is, I don't really trust therapists much more than these apps. Support groups and self-help books are better but in the end, only pure "shadow work" can really save you. You must learn to be your own therapist.
- xctr94 3y ago
  As someone that did shadow work, this is disingenuous and unhelpful. People undergoing depression or PTSD can’t be told to “man up” and work on themselves alone. Therapists are usually very careful with confidentiality.