AI-Powered Mental Health App Data Exposure Cases
Sensitive therapy disclosures leak repeatedly through preventable security failures.
AI-powered mental health apps are leaking some of the most sensitive disclosures a person can make, and the exposures are not accidents of bad luck. They follow a narrow, repeatable set of technical failures, compounded by a legal structure that leaves most users with none of the protections they assume a "therapy" product carries. The pattern is documented across dozens of incidents, and understanding it is the only real way to know what is at risk when someone confides in one of these tools.
What AI mental health apps collect
Mental health apps gather a category of personal information that few other products touch: mood logs and daily journals, full therapy session transcripts, records of anxiety patterns and personal triggers, medication information, crisis disclosures made in a person's lowest moments, and details about sexual behavior and relationships that many people withhold even from family. The data accumulates like a medical chart while the surrounding system treats it like any other app log.
The Chat & Ask AI breach shows you what that accumulation looks like once it is exposed. None of this is a hypothetical worst case constructed for the sake of argument. It is documented content from a real exposure, sitting in a database that anyone with the project URL could read.
A psychotherapy clinic breached years earlier, in another country, shows where that kind of exposure leads when it reaches the wrong hands. Suicides among the victims have been suspected. The consequences of this class of breach are not contained to embarrassment. They extend into employment decisions, insurance underwriting, custody and legal proceedings, and relationships, because mental health disclosures carry a kind of permanence and specificity that a leaked password or credit card number does not.
The legal gap that leaves most users without the protections they assume they have
Most people reasonably believe that anything resembling a "therapy" app operates under the same legal protections as a licensed therapist's office. The majority of AI mental health apps fall outside that boundary. The protections users assume a "therapy" product carries are legally unenforceable against most of the products that use the word.
This is the environment in which every technical failure described later in this piece occurs, largely without consequence, not an oversight that regulators simply haven't gotten around to closing. A licensed therapist who discloses patient information without authorization commits a serious ethical and legal violation, while an app with no HIPAA obligation can legally share, sell, or otherwise use sensitive user data unless it voluntarily adopts stricter policies of its own, an asymmetry the UC Irvine / UC Riverside analysis makes explicit. Nothing stops that same app from routing user data, including metadata, to advertising networks, AI providers, and social media platforms as part of its normal operation.
Cerebral did exactly that. The company sent sensitive information, including names, medical histories, and addresses, to LinkedIn, Snapchat, and TikTok through integrated tracking tools, and it later disclosed that it had been using invisible pixel trackers from Google, Meta, TikTok, and other companies since October 2019. The FTC fined BetterHelp millions of dollars for it.
GDPR offers EU users a stronger baseline, but the gap between GDPR's consent requirements and HIPAA's narrower scope creates a compliance patchwork that many companies resolve by meeting the minimum bar in each jurisdiction rather than applying the strictest standard everywhere. Transparency fares no better than enforcement. The UC Irvine / UC Riverside study looked at 25 apps and found that every one embeds at least one tracker SDK not named in its own privacy policy, and most apps fail to disclose at least half the trackers actually detected inside their code. A privacy policy, in this sector, describes what a company is willing to admit to, not necessarily what the app does.
The four technical failures that appear in breach after breach
Across at least 20 documented incidents between January 2025 and February 2026, the breaches that have hit AI mental health and adjacent apps trace back to four root causes, repeated with striking consistency: misconfigured Firebase databases, missing Supabase Row Level Security, hardcoded or default API keys, and exposed cloud backends generally.
Chat & Ask AI, built by the Turkish developer Codeway, left its Google Firebase Security Rules in a fully public configuration, effectively "allow read: if true," so that anyone with the project URL could read, modify, or delete the entire database without authenticating.
Supabase's Row Level Security has produced its own trail of incidents. The Lovable platform, tracked as CVE-2025-48757 and disclosed on May 30, 2025, exposed personally identifiable information, financial data, developer API keys, and admin tokens across hundreds of endpoints. Security firm Escape's analysis of so-called "vibe-coded" applications, built quickly with AI-assisted tools, found this same missing-RLS pattern across thousands of products, suggesting the failure is baked into how many of these apps get built in the first place rather than something that slips through on rare occasions.
Credentials compound the problem. A misconfigured permission rule, a security feature left switched off, and a password six characters long are not zero-day exploits; they are the kind of thing any basic security review would catch, which implies that no review of this kind is happening before these products reach the public.
The common thread running through all of it is not the AI itself. Chat & Ask AI is a wrapper that plugs into OpenAI's ChatGPT, Anthropic's Claude, and Google's Gemini, and the breach had nothing to do with how those underlying models process language. The vulnerability lived entirely in the infrastructure built around the models, the database rules, the access controls, the credential management, the parts of the stack that have nothing to do with artificial intelligence and everything to do with ordinary software engineering discipline. A 2025 review published through NCBI/PubMed Central found a parallel failure on the device side: a large majority of free mobile health and fitness apps store data locally without encryption. The failure to treat sensitive data as sensitive occurs at every layer, cloud and device alike.
What the disclosed data contained and who was harmed
The severity of a breach in this sector has little to do with how many records were exposed and everything to do with what those records say. The Chat & Ask AI exposure, reported by the Business and Human Rights Centre citing 404 Media, contained messages in which users asked how to painlessly kill themselves, asked the app to write suicide notes on their behalf, and sought instructions for manufacturing controlled substances. These disclosures sit alongside a larger dataset of mundane chat logs, yet they are the kind of disclosure a person makes only when they believe no one else is listening.
Vastaamo remains the clearest picture of where that trust, once broken, leads. The UC Irvine / UC Riverside study notes that the breach has been suspected to have contributed to suicides among the victims.
Who bears this risk most directly? The person most likely to be typing into an AI therapy chatbot at 2 a.m. is, by the nature of the product, someone for whom the consequences of exposure are highest. The content sitting inside those apps is the same category of material that Vastaamo's patients had extorted from them: notes, diagnoses, and disclosures that only make sense in the context of a person's most difficult period.
Expert and psychologist trust in these platforms
Clinical professionals track both what these apps promise and what the breach record shows, and they have landed, broadly, on skepticism. Most psychologists cite concerns about data breaches in how AI platforms handle sensitive patient information, and that concern is not a fringe position among a handful of cautious holdouts. It reflects mainstream clinical awareness of a disclosure risk that the breach record keeps confirming.
The UC Irvine / UC Riverside study argues for a substantially updated regulatory framework for therapy apps, one that moves closer to the professional and ethical standards that already bind licensed human therapists. The transparency findings from that same study deepen the problem: more than half the apps examined declare dangerous permissions, including camera or microphone access, without any corresponding explanation in their privacy policy, and nearly every app embeds trackers that appear nowhere in a document a user could actually read and evaluate.
None of this erases the genuine value these tools provide. A separate NCBI review documents that e-mental health tools reach rural and underserved populations who otherwise have no access to a licensed professional, and that they lower barriers tied to stigma that keep people from seeking help. A tool that reaches someone a licensed therapist cannot reach is also the tool whose failure leaves that same person with no fallback. A platform that is easy to access but insecure does not actually serve a user who holds back their real disclosure out of fear that it will end up somewhere else. Access and safety are not substitutes for each other, and a product that wins on one axis while failing on the other has not solved the underlying problem.
The state-level legislative wave of 2025–2026
Lawmakers have started to respond, and this wave of state legislation is the first time AI mental health tools face binding legal constraints at this level of government. The coverage, though, is incomplete, the definitions are contested, and none of the new statutes touch the configuration failures responsible for most of the documented breaches.
Illinois passed its WOPR Act, HB 1806, unanimously, and Governor Pritzker signed it into law in early August 2025. The law draws a clear architectural line: AI can handle administrative tasks around care, but a licensed human has to own the care itself. It requires patients to give informed, written, and revocable consent before AI can be used to record or transcribe a therapy session, and that tightens the consent standard well beyond anything HIPAA requires. Nevada's AB 406 followed, signed June 5, 2025, and effective July 1, 2025, carrying a financial penalty for violations. Maine signed its own version, LD 2082, in April 2026. By 2026, five additional states had restricted AI-delivered therapy beyond this initial wave, and a substantial number of chatbot bills remain pending across dozens of state legislatures, so the movement is accelerating but has not yet reached national scope.
What none of these laws do is mandate the technical safeguards that would have prevented the breaches detailed earlier: no requirement for Firebase configuration audits, no mandated Row Level Security review, no prohibition on hardcoded or default credentials. The FTC's actions against Cerebral and BetterHelp show that federal enforcement is possible under existing consumer protection authority, but both actions came only after the harm had already occurred, not as preventive technical standards applied before a product reaches users. The legislative wave addresses who controls care and whether data gets shared with advertisers. It leaves the engineering layer, the one actually responsible for most of the breaches in this record, untouched.
What a user can evaluate before trusting an AI mental health app
Regulatory protection is partial, technical failures keep recurring in predictable form, and privacy policy disclosures have proven systematically unreliable as a source of assurance. Given all three, the more useful approach for a prospective user is to ask architectural questions rather than read policy text as though it were a complete account of what an app does. The UC Irvine / UC Riverside study found that every app in its corpus embeds at least one tracker not named anywhere in its policy, so you cannot treat the document itself as the primary basis for trust.
A few questions get closer to the truth than a policy page does. Is the app a wrapper around a third-party large language model, and if so, who actually receives the transcript, and under what retention terms? Does the app show signs of processing data on-device, such as offline functionality or local storage, versus relying on a central cloud database? Has the app been independently audited, with results published for anyone to check? And is the app subject to HIPAA as a business associate of a covered entity, or does it operate entirely within the unregulated consumer category described earlier in this piece?
The breach record has also laid out a reliable set of warning signs. Chat & Ask AI claimed "enterprise-grade security" and GDPR compliance at the exact moment its Firebase rules were set to allow anyone to read the entire database, a reminder that a security claim without specifics is marketing copy, not evidence. A privacy policy that mentions "AI services" without naming the company processing the data is withholding the one detail a user actually needs. Permissions for camera or microphone access that go unexplained in the policy are a sign that the document was not written with the user's actual risk in mind.
What the breach record points toward, consistently, is privacy-by-design: an architecture where sensitive conversation data does not accumulate inside a centrally accessible cloud database that can later be left misconfigured, the exact failure mode behind Chat & Ask AI, Lovable, and Moltbook alike. That approach does not eliminate risk. The access-to-care trade-off remains genuine, and users in underserved areas may have no equivalent alternative to turn to regardless of the security posture of the one available to them. That constraint does not argue for dismissing the risk. It argues for being specific about what the risk actually is, who bears it, and which questions an app can and cannot answer honestly before a user decides what to disclose to it.
