Protection for an email address at therapy signup takes the form of one alias per therapy platform, with the address on the clinical record left permanent. Session notes, intake answers and payment details sit behind the signup address, which ties those records to one named person. The Federal Trade Commission ordered BetterHelp to pay $7.8 million after it passed email addresses and health questionnaire answers to advertising platforms, and Cerebral reported 3,179,835 people affected when tracking pixels sent similar information to the same kind of recipient.
What a therapy account contains#
The address supplied at signup acts as the identifier for the whole therapy record. Account confirmation, session reminders, messages from the therapist, billing receipts and password resets all run through it. The record behind it is a clinical record, and the address connects that record to one named person.
At signup the form takes a name, an email address, a date of birth and payment details, and the intake questionnaire asks about mental health history, current symptoms, medication and past treatment. In the BetterHelp case the Federal Trade Commission recorded that the company asked whether users had experienced depression or suicidal thoughts and whether they were taking any medications, together with the name, email address and birth date. Each session adds to the record: session notes, messages with the therapist, diagnosis information and the treatment plan. Therapy is an ongoing relationship rather than a single booking, so the record keeps growing for months or years, unlike the one-off booking covered in how to protect your email when booking medical care.
Email addresses and health information#
An email address on its own is ordinary contact detail. Once it is joined to a therapy platform name, a session time and an intake answer, it becomes an identifier tied to mental health care. The HHS bulletin on tracking technologies states that individually identifiable health information collected on a regulated entity's website or mobile app generally is protected health information, and it lists an email address among the information that counts. A breach of a therapy platform therefore exposes an address already joined to a health fact.
Have I Been Pwned counts 1,051 pwned websites and 17,858,196,501 pwned addresses. The method for checking whether an address has appeared in a known breach is set out in how to check if your email was leaked.
The Cerebral pixel disclosure#
Cerebral, a telehealth platform providing online therapy and medication management, reported to the HHS Office for Civil Rights breach portal that 3,179,835 people had their information exposed by tracking pixels from Google, Meta (Facebook) and TikTok, which had run on its platforms from 12 October 2019. On 3 January 2023 Cerebral determined that it had disclosed information that may be regulated as protected health information under HIPAA to third-party platforms and some subcontractors without HIPAA-required assurances. The figures are reported in the Fierce Healthcare account of the Cerebral disclosure and the TechTarget account.
The disclosed data included an account holder's name, phone number, email address, date of birth, IP address and client ID number, assessment responses for anyone who completed the mental health self-assessment, and appointment dates, treatment and insurance information for subscribers. Cerebral stated that no Social Security numbers, credit card information or bank account information were disclosed.
Cerebral's own notice was not directly readable during research for this article, as its PDF returned an error when fetched. The figures in this section therefore come from the HHS portal reporting and the two independent reports quoted above.
The BetterHelp order#
The enforcement action concerns BetterHelp. On 2 March 2023 the Federal Trade Commission announced a proposed order banning BetterHelp from sharing consumers' health data, including sensitive information about mental health challenges, for advertising, and requiring the company to pay $7.8 million to consumers. The order was reported as finalised in July 2023.
According to the FTC press release, BetterHelp revealed consumers' email addresses, IP addresses and health questionnaire information to Facebook, Snapchat, Criteo and Pinterest for advertising, after promising to keep such data private. The address itself was the mechanism. BetterHelp used consumers' email addresses and the fact that they had previously been in therapy to instruct Facebook to identify similar consumers and target them with advertisements.
The complaint states that between 2017 and 2018 BetterHelp uploaded lists of over 7 million visitors' and users' email addresses to Facebook, which matched over 4 million of them to Facebook user accounts. In January 2019 the company disclosed IP addresses and email addresses of approximately 5.6 million visitors to Snapchat. The full terms are set out in the FTC consent order.
The $7.8 million funds partial refunds to consumers who signed up for and paid for BetterHelp's services between 1 August 2017 and 31 December 2020. The order also bans BetterHelp from disclosing health information for advertising. BetterHelp settled without admitting wrongdoing and stated that the practices were industry-standard and had stopped in 2020. In each of the two cases the address gave the advertising platform a match key to an account it already held, and the health information arrived attached to it.
How the address leaves the therapy platform#
The address given at signup does not stay inside the therapy platform by default: it moves under the platform's privacy policy, which differs between the health care side and the consumer side of the same company. The current Talkspace privacy policy, last updated 17 July 2025, states that an email address is collected when an account is created. Talkspace may also disclose personal data to service providers for advertising, marketing and analytics. Disclosure to business partners covers personalised advertising, including advertising technology vendors and social media platforms. Its US state privacy notice states that once a person becomes a patient and uses the portal, Talkspace does not engage in sales, sharing or targeted advertising.
BetterHelp's own Notice of Privacy Practices draws a similar line. Protected health information is collected at signup and payment, according to the notice, and written authorisation is required before use or disclosure of PHI for marketing or sale of PHI. The notice applies to the provider group delivering therapy, while a separate privacy policy covers the subscription offering.
On 1 December 2022 the HHS Office for Civil Rights issued a bulletin stating that regulated entities must not use tracking technologies in ways that result in impermissible disclosures of protected health information, and that disclosures of PHI to tracking technology vendors for marketing purposes, without HIPAA-compliant authorisations, are impermissible disclosures. The TechTarget account of the bulletin records that the bulletin followed reports of patient data reaching Facebook through tracking technology on hospital websites and inside password-protected patient portals.
A separate alias for each platform#
Each therapy platform receives a distinct alias, created in advance and labelled with the platform name. The guide to setting up an email alias and the explanation of what an email alias is describe the setup. Session reminders, billing mail and follow-up mail for that platform arrive through the alias and forward to the real inbox, so nothing about the care itself changes. When marketing mail starts on the same alias, the source is visible in the address itself. When the care relationship ends, the alias can be closed without touching mail from any other platform.
The therapy case adds duration. Session reminders, billing mail and clinical messages keep arriving for as long as care continues, so the alias has to stay alive for months or years. The same preparation applies to protecting an email address when signing up for an online pharmacy, where the address links to prescription records. The wider enforcement record for health apps is set out in whether to use a separate email for health and fitness apps.
The alias during care#
The alias stays alive for the life of the care relationship. Session reminders, billing mail and messages from the therapist may still arrive on it months after signup, and a missed session reminder or a missed billing message is a care problem, not only an inbox problem. The alias therefore stays in place until the care relationship ends and the account is closed properly.
The alias is the account address, not anonymity from the therapist. The therapist still knows who the patient is, because the patient gives a name, a date of birth and payment details at signup, and the clinical record holds those details whatever address was used. The clinical record keeps its own permanent address for the medical record, account recovery, identity checks and clinical communication, and the alias must never replace that address.
In this arrangement the alias keeps the address out of the advertising and analytics systems around the therapy platform, and keeps the therapy mail stream separate from the address used for banking, work and personal mail. The recovery position is set out in whether an email alias can be used for account recovery.
Forged mail after a therapy data exposure#
A therapy data exposure can be followed by forged mail, because the disclosure leaves the address and the platform name known. The forged message knows the platform name, the timing of the real notice and the kind of mail the person expects, so reading the message does not expose the forgery. The mechanism is set out in how phishing uses a leaked email: after a leak, the mail stops guessing, and the To line becomes the test. A message claiming to be from the therapy platform, arriving on the alias given to that platform, is plausible. The same message arriving on any other alias is forged by definition, because the therapy platform never held that address.
The check that exposes most forgeries is set out in how to check if an email is phishing: a character-by-character reading of the sender domain, hovering over every link to see where it really points, and questioning the ask. The order of operations after a breach is set out in what to do when your email is in a data breach.
What an alias does not do#
An alias does not stop a therapy platform collecting health data. The platform still receives the intake answers, session notes and payment details entered at signup and during care. It does not make the person anonymous to the platform, it does not remove data already shared or sold, and it does not encrypt the mail. An alias controls the handover of the address, nothing else. The mechanism is described in how email aliases actually work: the alias is a forwarding address under the person's control, not a separate inbox, and replies route back through the alias so the destination address stays out of the platform's records.
No verified count of therapy platforms that reject alias addresses at signup was found for this article. Some platforms may refuse an alias domain. The gap is stated here rather than filled with a guess. An alias also does not replace checking what was already exposed. An address used for therapy signups for years stays in past mail, and a breach check establishes what already happened before the alias system limits what happens next.
AliasFleet in therapy signup#
AliasFleet provides email aliases that forward to a verified destination inbox. A distinct alias is created for each therapy platform, labelled with the platform name and given at signup, and session reminders, billing mail and follow-up mail arrive through it, with replies routing back through it. The alias can be paused or closed when the care relationship ends, without changing the destination inbox address. The free tier includes 10 active aliases, 1 verified destination inbox and 3 managed subdomains. Monthly forwarding bandwidth is 100 MB, as listed on the AliasFleet pricing page. AliasFleet does not hold the clinical record, and it does not replace the therapy platform: the permanent address on the clinical record stays in place, and the alias covers signup, session and billing mail only.
