Men's-Health Telehealth Data Privacy
How Sensitive ED/TRT/Mental-Health Data Is Collected and Shared
Evidence grade 5 of 5, Settled. Read how the Atlas grades evidence.
The written rationale for this grade is still being prepared.
- FDA
- Not Applicable (regulated by FTC/state law, not FDA)
Reference only. Not medical advice.
What can go wrong
The harm is not abstract. Sensitive sexual-health, fertility, and mental-health data shared with advertising and data-broker ecosystems can fuel targeted advertising, be combined into consumer profiles, and in worst cases surface in contexts the user never intended (employment background products, insurance underwriting inputs, or simply ads that reveal a condition to others sharing a device). Once data leaves a platform to a third party, the original company often cannot fully retrieve or delete it.
This is something to take to a clinician. The Atlas can tell you what is known about men's-health telehealth data privacy in general. It cannot tell you what is happening in your body, and the difference matters most for exactly the symptoms that bring people to this page.
Direct-to-consumer men's-health platforms collect some of the most sensitive data a person can disclose: erectile-dysfunction history, testosterone levels, antidepressant use, fertility status, and sexual behavior. Much of this data sits in a regulatory gap. The common assumption that 'health data is HIPAA-protected' is frequently wrong: HIPAA only binds 'covered entities' (most providers, health plans, clearinghouses) and their business associates. Data a consumer types into an app, or that an app shares with advertisers, often falls outside HIPAA entirely. Between 2023 and 2024 the U.S. Federal Trade Commission brought a series of enforcement actions (GoodRx, BetterHelp, Cerebral, Premom, Monument) establishing that sharing identifiable health data with advertising platforms can be an unfair or deceptive practice and, separately, a violation of the FTC's Health Breach Notification Rule. This entry is descriptive of documented enforcement and policy; it is not legal advice.
Your erectile-dysfunction intake form is also a marketing asset.
What people take it for
What it is taken for. Approval, where it exists, covers only some of these.
How it works
The data pipeline works like this: a consumer fills out an intake questionnaire (symptoms, medications, sexual history). The platform stores this and, historically, many platforms also embedded third-party advertising and analytics technologies (the Meta Pixel, Google Analytics, TikTok, Bing) that transmitted identifiers and event data to those companies. Even when names were not sent, persistent identifiers (advertising IDs, hashed emails, cookies, IP addresses) let third parties re-associate the activity with a real person. The FTC's theory in these cases is that consumers were promised privacy or HIPAA-like protection that did not match the actual data flows, and/or that disclosing identifiable health information for advertising without authorization is itself an unfair practice.
The HIPAA halo the marketing relies on
Platforms often display a 'HIPAA-compliant' badge or lock icon. HIPAA can apply to the clinical relationship with a prescribing physician, but it does NOT automatically cover the marketing, analytics, and advertising layers of the same app, and it does NOT cover data a company collects in its capacity as a vendor rather than a covered entity. The FTC has repeatedly stated that an entity can be subject to FTC authority even where HIPAA does not reach it. In the BetterHelp matter the FTC alleged the company shared consumers' email addresses, IP addresses, and health-questionnaire responses with Facebook, Snapchat, Criteo, and Pinterest for advertising after promising to keep such data private. The lesson: a HIPAA logo is not a guarantee that your data stays inside a clinical firewall.
What people get wrong
Often saidIf it is a health app, my data is HIPAA-protected
ActuallyHIPAA binds covered entities and their business associates. A direct-to-consumer wellness or telehealth app frequently is not a covered entity for the data it collects directly from you, and the advertising/analytics layer is almost never HIPAA-covered. The FTC, the FDA, and state privacy laws are the relevant authorities in that gap.
Often saidThey told me the data is confidential, so it stays private
ActuallyThe FTC's GoodRx and BetterHelp cases were built precisely on companies that made confidentiality promises while transmitting identifiable data to advertising platforms. A promise is enforceable, but it is not the same as a technical guarantee that the data is not flowing out.
Often saidRemoving my name makes the data anonymous
ActuallyPersistent identifiers (advertising IDs, hashed emails, IP addresses, device fingerprints) routinely allow re-identification. Regulators and researchers treat 'de-identified' advertising data as identifiable when it can be linked back to a person.
Who profits, and who pushes back
Authority-scope skeptics
Argue the FTC stretched the Health Breach Notification Rule beyond its original breach-focused intent to reach ordinary ad-tracking, raising questions about fair notice to companies.
Patient-advocacy critics
Contend the penalties are too small relative to revenue to deter data sharing, and that enforcement comes only after millions of records are already exposed.
Legislative-gap commentators
Note that case-by-case FTC actions cannot substitute for a comprehensive federal privacy statute, leaving most DTC health apps in a HIPAA gap.
Set against the alternatives
Compared with HIPAA enforcement (HHS Office for Civil Rights against covered entities), these are FTC actions reaching DTC apps that HIPAA does not bind, using the FTC Act's unfair/deceptive standard and the Health Breach Notification Rule as a backstop. GoodRx was the first-ever HBNR enforcement; BetterHelp was the first to return funds to affected consumers; Premom extended the theory to fertility-app SDK disclosures; and Cerebral combined health-data-sharing claims with deceptive-cancellation charges and the largest consumer redress of the group. Together they signal that ad-tracker data flows, not just classic breaches, can trigger liability even where HIPAA never applied.
| Action | Year | Core issue | Penalty / remedy |
|---|---|---|---|
| GoodRx | 2023 | Ad-tracker health-data sharing | ~$1.5M civil penalty (first HBNR case) |
| BetterHelp | 2023 | Mental-health data to ad platforms | ~$7.8M consumer refunds |
| Premom | 2023 | SDK health-data disclosure | ~$100K FTC penalty (+$100K states) |
| Cerebral | 2024 | Tracker sharing + cancellation | ~$7M total (~$5.1M refunds, $2M penalty) |
What we do not know
- Will a federal comprehensive privacy law ever close the DTC-app gap, or will enforcement remain patchwork FTC plus state laws (Washington's My Health My Data Act, California's CMIA/CCPA)?
- How will AI-driven intake and chatbots, which generate even richer behavioral data, be regulated?
- Can consumers ever meaningfully verify what a 'HIPAA-compliant' badge actually covers?
What could change
HBNR expansionFinalized 2024 rule changes explicitly broaden coverage to health-app and tracker disclosures.State health-privacy lawsWashington's My Health My Data Act and similar statutes add consent and private-action exposure.Pixel litigationGrowing class-action and AG activity over Meta Pixel and analytics trackers on health sites.Consent-and-disclosure shiftsPlatforms moving to affirmative consent and server-side controls to limit third-party data leakage.
At a glance
- Key regulator
- U.S. FTC (not FDA, often not HHS/OCR)
- GoodRx FTC order
- Feb 2023 (~$1.5M penalty)
- BetterHelp FTC order
- 2023 (~$7.8M consumer refunds)
- Core gap
- HIPAA does not cover most DTC apps
- Backstop rule
- FTC Health Breach Notification Rule
What this entry does not yet cover
What follows is unfinished work on our side, not a finding about Men's-Health Telehealth Data Privacy. A short entry is not a safe entry.
- Cost and market. We have not documented what it sells for or who sells it.
- Supply chain. We have not mapped where it is made.
- Who uses it. We have not documented the user groups.
- Children and teenagers. We have not checked what is known about younger people.
Sources
The studies below are named and described, but not linked. You cannot open them from here and check our reading against them, which means this page is our summary of the literature rather than a document you can verify. Weigh it accordingly until the links exist.
The studies that matter
FTC v. GoodRx Holdings (stipulated order)2023
First-ever enforcement of the FTC Health Breach Notification Rule; alleged GoodRx shared user prescription/health data with Meta, Google, Criteo and others; order includes a permanent ban on sharing health data for advertising and a $1.5M civil penalty
FTC v. BetterHelp (Online Intelligence Inc.)2023
FTC alleged BetterHelp shared consumers' mental-health intake data and email/IP with advertisers despite privacy promises; settlement required ~$7.8M in consumer refunds and barred sharing health data for ad targeting
FTC v. Cerebral2024
FTC alleged the telehealth mental-health company disclosed consumers' sensitive data to third parties for advertising and used restrictive cancellation practices; proposed order included a $7M penalty and limits on data use
FTC v. Easy Healthcare (Premom)2023
Fertility-tracking app alleged to have shared sensitive reproductive data with third parties including analytics firms; $100,000 penalty and Health Breach Notification Rule findings