Data on millions of patients was shared with advertisers by the telehealth startup Cerebral

Cerebral has admitted that it gave advertising and social media juggernauts like Facebook, Google, and TikTok access to the private health data of more than 3.1 million patients in the US, including assessments of their mental state.

The telehealth startup revealed the security lapse in a filing with the federal government, saying that it shared patients’ personal and health information who used the app to search for therapy or other mental health care services. The telehealth startup, which exploded in popularity during the COVID-19 pandemic after rolling lockdowns and a surge in online-only virtual health services, disclosed the security lapse.

In addition to the data obtained from Cerebral’s online mental health self-assessment, which may also have included the services that the patient chose, assessment responses, and other related health information, Cerebral claimed that it also collected and shared names, phone numbers, email addresses, dates of birth, IP addresses, and other demographic data.

Here is the complete disclosure:

Name, phone number, email address, date of birth, IP address, Cerebral client ID number, and other demographic data may have been leaked if a person opened a Cerebral account. The exposed information could have also included the person’s choice of service, their answers to the assessment, and some health information if they also had a Cerebral account and did any part of the company’s online mental health self-assessment.

The information disclosed may also have included the type of subscription plan, appointment dates and other booking information, treatment and other clinical information, health insurance and pharmacy benefit information (for example, plan name and group or member numbers), and insurance co-pay amount if an individual created a Cerebral account and completed Cerebral’s online mental health self-assessment in addition to buying a subscription plan from Cerebral.