Cerebral is a privately held online mental-health telehealth company (Cerebral, Inc.) offering medication management and therapy on a subscription, negative-option basis; its Platform is operated by Cerebral while care is delivered by affiliated, independently licensed Medical Groups. Cerebral's own privacy policy (last revised September 17, 2025) collects detailed health-related information - medical history, conditions, treatment options, prescriptions, lab results - and discloses it to vendors including ad platforms, and to an unnamed 'ultimate holding company and its subsidiaries.' In April 2024 the FTC and DOJ announced a proposed order requiring Cerebral to pay more than $7 million and permanently barring it from using or disclosing consumers' health information for most advertising purposes, after finding the company had used tracking tools to send sensitive data on nearly 3.2 million consumers to LinkedIn, Snapchat, and TikTok while also engaging in careless marketing and insecure data-handling practices, and deceiving consumers about how to cancel. Cerebral's current App Store privacy label still discloses that Identifiers are used to track users across apps and websites owned by other companies.
TRACK RECORD
1 ENFORCEMENT ACTION
[2024-04-15]
The FTC/DOJ's April 15, 2024 proposed order requires Cerebral to pay nearly $5.1 million in consumer refunds plus a $10 million civil penalty (suspended to $2 million for inability to pay), and will 'permanently ban Cerebral from using or disclosing consumers' personal and health information to third parties for most marketing or advertising purposes,' following findings that included insecure single sign-on exposing patient records, unenveloped promotional postcards revealing diagnoses to over 6,000 patients, and deceptive multi-step cancellation practices.
The FTC's April 15, 2024 press release states consumers who sign up 'provide detailed personal data including their home and email addresses, birthdates, medical and prescription histories, payment account or driver license numbers, as well as information about their treatment plans, pharmacy and health insurance plans, and other personal data, such as their religious or political beliefs, or sexual orientation.'
Cerebral's Privacy Policy (last revised September 17, 2025) lists collected categories including identity verification information and 'health-related information, such as information about your medical history, medical conditions, treatment options, physician referrals, prescriptions, lab results, lifestyle and personal preferences, and health insurance information,' plus Social Security Number for identity verification.
Cerebral, Inc. is a privately held company; its own Privacy Policy discloses that personal information may be shared 'among our subsidiaries and affiliates, including our ultimate holding company and its subsidiaries, for business purposes' without ever naming that holding company or its ownership chain anywhere in the document.
The FTC found that Cerebral 'failed to clearly disclose that it would be sharing consumers' sensitive data with third parties for advertising and buried disclaimers about its data sharing practices in dense privacy policies,' and that 'the company claimed in many instances that it would not share users' data for marketing purposes without obtaining consumers' consent' - a promise the complaint alleges was broken.
Cerebral's Privacy Policy states it discloses personal information 'to our vendors that provide services to enable us to promote and advertise the Services and the products and/or services offered via the Services, such as ad platforms services,' in addition to disclosures 'among our subsidiaries and affiliates, including our ultimate holding company and its subsidiaries.'
The FTC/DOJ's April 15, 2024 proposed order requires Cerebral to pay nearly $5.1 million in consumer refunds plus a $10 million civil penalty (suspended to $2 million for inability to pay), and will 'permanently ban Cerebral from using or disclosing consumers' personal and health information to third parties for most marketing or advertising purposes,' following findings that included insecure single sign-on exposing patient records, unenveloped promotional postcards revealing diagnoses to over 6,000 patients, and deceptive multi-step cancellation practices.
Cerebral's current Apple App Store privacy label discloses that 'Identifiers' data 'may be used to track you across apps and websites owned by other companies,' and separately lists Sensitive Info and Health & Fitness data as 'Data Linked to You' used for Analytics and Product Personalization purposes.
The FTC complaint charges that Cerebral 'provided sensitive information of nearly 3.2 million consumers to third parties such as LinkedIn, Snapchat and TikTok by using or integrating tracking tools on its website or apps,' which sent names, medical and prescription histories, addresses, phone numbers, birthdates, demographic data, IP addresses, and pharmacy/insurance information to those third parties.