Headspace is a meditation and mental-health app that merged with Ginger in 2021 to form Headspace Health (renamed Headspace in 2023), adding coaching, therapy, and psychiatry services. Its privacy policy (effective 2026-03-30) describes collection of self-reported mental and physical health status, wellness goals, and usage data, and states its cross-context behavioral advertising may fall under "selling" and/or "sharing" under the CCPA. Employer benefit sponsors receive enrollment and last-use dates; therapy details are excluded. US care services operate under HIPAA, with a Notice of Privacy Practices committing not to sell PHI. Headspace holds SOC 2 Type II, HITRUST, and UK Cyber Essentials Plus certifications and honors Global Privacy Control; Mozilla's 2023 review applied its warning label over ad-related sharing while noting no known security incidents in three years.
TIMELINE
NO ENTRIES ON FILE YET.
TOOLS WE RECOMMEND
PLUS
RECEIPTS
19 ON FILE
[2020-06-24] · COLLECTION
As assessed by PrivacySpy on 2020-06-24 (see PrivacySpy's rubric entry for this product for the per-claim citation): Does the service allow you to permanently delete your personal data? — Yes, by contacting someone.
Headspace's Consumer Health Data Privacy Policy (last updated September 30, 2025), covering Washington's My Health My Data Act and similar state laws, states that collected information can fall under consumer health data categories including individual health conditions, treatment, diseases, or diagnosis, and psychological and behavioral interventions.
Headspace's Privacy Policy (effective March 30, 2026) states that it collects health information users provide through the products, including survey responses about current mental or physical health status, alongside usage data such as pages visited, links clicked, and approximate location.
As assessed by PrivacySpy on 2020-06-24 (see PrivacySpy's rubric entry for this product for the per-claim citation): Does the policy outline the service's general security practices? — Somewhat.
TechCrunch reported on August 25, 2021 that Headspace and on-demand mental-health provider Ginger agreed to merge to form Headspace Health, a privately held combined organization with a reported value of $3 billion and more than 800 employees.
The Headspace Medical Joint Notice of Privacy Practices (effective March 30, 2026) documents the corporate structure of Headspace's US care services: Headspace Medical Group (CA) P.C. and its affiliated providers collectively form an Organized Health Care Arrangement (OHCA), whose US members are classified as HIPAA covered entities.
As assessed by PrivacySpy on 2020-06-24 (see PrivacySpy's rubric entry for this product for the per-claim citation): Does the policy allow personally-targeted or behavioral marketing? — Yes, but you may opt-out.
Headspace's Consumer Health Data Privacy Policy (last updated September 30, 2025) states that consumer health data is shared with service providers hosting its infrastructure, with affiliated companies and subsidiaries including its Care Providers such as Headspace Medical Group (CA), with user-chosen integrations, and with government agencies upon lawful request.
The Headspace Medical Joint Notice of Privacy Practices (effective March 30, 2026) commits that Headspace Medical will not sell protected health information, disclose PHI for marketing purposes, or disclose psychotherapy notes without written authorization, and applies stricter 42 CFR Part 2 protections to substance use disorder records.
Headspace's Privacy Policy (effective March 30, 2026) concedes that its cross-context behavioral and targeted advertising activity may constitute "selling" and/or "sharing" of personal information under the CCPA. The same policy states that employer Benefit Sponsors may receive a member's name, email address, registration date, and date of last platform use, while restricting sharing of in-app activity details such as therapy, and that Headspace honors Global Privacy Control opt-out signals for sale/sharing.
Headspace's enterprise security page states the company is certified in SOC 2 Type II, HITRUST, and UK Cyber Essentials Plus, and that it uses automated vulnerability scanning, periodic penetration testing, and a third-party bug bounty program.
Mozilla's *Privacy Not Included review of Headspace (April 25, 2023) rated the company's track record of protecting user data as 'Average', finding no known privacy or security incidents in the three years preceding the review, and found the app meets Mozilla's Minimum Security Standards.
Mozilla's *Privacy Not Included review of Headspace (April 25, 2023) applied its warning label to the app, quoting Headspace's disclosure that cookie and pixel data gathered on its websites is shared with third parties to enable tailored digital advertisements.
Headspace's Privacy Policy (effective March 30, 2026) discloses that it works with third-party advertising platforms that provide analytics and advertising services, including serving advertisements on Headspace's behalf.