Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesiTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Do not decide that a therapy messaging app is private because it displays a “HIPAA compliant” badge. A sound assessment starts by identifying who operates the service and who provides care, then tracing what information the app collects, why it is used, who receives it, how long it is retained, what deletion and access rights you have, and which technical safeguards are documented. You must also protect the phone, account, notifications, and physical space you use for messaging.
HIPAA may apply when a covered health-care provider or its business associate handles protected health information (PHI), but many consumer apps fall outside HIPAA. The Federal Trade Commission (FTC) and state privacy laws can still regulate misleading or unfair health-data practices. The steps below give you a U.S.-focused way to investigate an app before sending sensitive information.
What you need to establish before trusting an app
A privacy decision is stronger when you can answer six questions with the app’s current privacy notice, terms, and answers from the provider:
Recommended Free Tools
- Who operates it? Identify the legal company, the therapy provider, and any contractor that stores or processes messages.
- What relationship exists? Determine whether a HIPAA-covered provider offers the app or whether the vendor acts as that provider’s business associate.
- What is collected? Separate message content from account identifiers, device data, location, usage records, billing data, and inferences.
- Why and with whom is it shared? Look for care delivery, operations, analytics, advertising, research, affiliates, service providers, and data brokers.
- What control do you have? Check retention, backups, account closure, deletion, access, correction, export, and consent choices.
- How is it protected? Look for encryption, authentication, access controls, incident response, and breach notifications, while also securing your own device and surroundings.
If a policy cannot answer these questions in plain language, treat that lack of transparency as a risk rather than filling the gaps with marketing claims.
#1 Best Overall
- Unmatched Security: The MC02 isn't just a smartphone; it's your digital guardian. Unlike other smartphones that sell your data, ours protects your privacy. Enjoy an intentional mobile experience where your personal information stays yours—never tracked, sold, or compromised
- Your Digital Sanctuary: An ecosystem of secure communications, access essentials such as Email, Calendar, Contacts, Notes and Storage without advertising-based data infiltration. The built-in VPN allows you to protect your connectivity and privacy, even on public networks
- Intuitive Design: Experience the MC02's seamless blend of sleek design and user-friendly interface, complemented by an IPS display. Capture stunning moments with 64MP/24MP cameras, shoot in 4K video, all while enjoying ample storage with 128GB memory and a long-lasting battery
- Privacy at Your Fingertips: Regain control and true consent of your digital and mobile use, with real-time insights from the groundbreaking Data & Carbon Ledger. Empower yourself with real-time data to view the safety risk and environmental imprint of individual apps
- Apostrophy OS: The MC02 includes a 12-month Apostrophy Services subscription, designed to protect your digital sovereignty beyond a standard OS. Threema comes pre-installed—a Swiss messenger known for rigorous data protection—so you can communicate with added peace of mind from a smartphone that values your privacy as much as you do.
HIPAA is conditional, not a universal privacy label
When HIPAA can apply
HIPAA’s Privacy and Security Rules protect PHI when it is created, received, maintained, or transmitted by a covered entity or a business associate. A clinic, hospital, or other covered provider may use a messaging vendor under a business-associate relationship. In that situation, messages and associated health or billing information can be PHI subject to HIPAA requirements. The U.S. Department of Health and Human Services (HHS) explains the covered-entity and business-associate framework in its guidance on cell phones and HIPAA.
When HIPAA usually does not apply
In most cases, HIPAA does not protect information that a person enters into an app for personal use unless the app is provided by, or on behalf of, a regulated entity. The sensitivity of a message, the presence of a licensed therapist, or the app’s use of the word “health” does not establish HIPAA coverage. Ask the provider to identify the covered entity and explain whether the app vendor is its business associate; do not infer the answer from an icon or a slogan.
Other rules may still matter
An app outside HIPAA can still face obligations under the FTC Act, including rules against deceptive or unfair collection, use, retention, or sharing of health information. Some non-HIPAA health apps may also fall under the FTC Health Breach Notification Rule. The FTC’s Mobile Health App Interactive Tool helps organizations analyze which rules may apply based on an app’s function, data, and services. State privacy laws can impose additional duties, and the result depends on the app’s activities, organizational relationships, data flows, and your location. HHS summarizes this interaction in its HIPAA and FTC Act guidance and its telehealth privacy-law guidance.
Step 1: Identify the service and its legal role
Start at the sign-up page, consent forms, privacy notice, terms of service, and any paperwork from your therapist. Write down the exact legal names, not only the product name.
- Identify the app operator. Find the company named in the privacy notice, terms, billing receipt, and app-store listing. Check whether different companies handle hosting, messaging, payments, or customer support.
- Identify the care provider. Determine whether your therapist, clinic, or telehealth organization is the party contracting for the service. An independently licensed clinician using a consumer app is not automatically evidence of a HIPAA relationship.
- Ask about business-associate status. Ask, in writing, whether the app vendor receives PHI for a covered provider and whether a business-associate agreement governs that data. Request the scope of information covered, not merely a yes-or-no marketing answer.
- Check geography and jurisdiction. Confirm where the provider and vendor operate, where your data is stored, and which state privacy rules the policy says apply. A U.S.-focused assessment cannot assume that another country’s rules or protections follow your account.
- Record role changes. Save the policy date and the company names. A service can change owners, vendors, or its care model, which may change the data flows you originally accepted.
HHS notes that the applicable protections depend on the relationship and the information flow, not simply on the fact that a phone contains health information. Keep that distinction in your notes.
Step 2: Map every category of data
Read the privacy notice and terms line by line. Build a list that distinguishes content from metadata; an app may give them different uses and retention periods.
Rank #2
- You Must Purchase A Cellular Plan From Secure Phone, You Cannot Use Your Own Plan.
- SIM Card Included - 4G GPS Tracker Phone
- No Internet - No Games - No Apps - No Spam Calls
- Calling Control - Calls & Texts ONLY To And From Numbers Programmed By Parents
- Touch Screen - Real Time Tracking - & So Much More..
| Data category | What to look for | Questions to ask |
|---|---|---|
| Message and care content | Texts, attachments, voice notes, assessments, diagnoses, treatment plans, and therapist notes | Is content end-to-end encrypted? Can staff, contractors, or automated systems access it? Is it used for service improvement, research, or model training? |
| Account identifiers | Name, email, phone number, username, age, profile details, and authentication records | Are identifiers combined with therapy content or advertising profiles? Can you use a pseudonym where lawful and clinically workable? |
| Device and location data | IP address, device identifiers, operating system, approximate or precise location, and network information | Are these required for messaging, or collected for analytics, fraud prevention, or advertising? |
| Usage and metadata | Login times, message timestamps, session length, clicks, searches, and feature use | Can metadata reveal therapy participation even when message text is protected? Which vendors receive it? |
| Billing information | Payment details, insurance information, invoices, and transaction history | Who processes payments, how long are records kept, and are billing records linked to clinical activity? |
| Inferences | Interests, risk scores, treatment categories, or predictions derived from your activity | Does the policy describe automated profiling, its purpose, and your ability to object or correct an error? |
The FTC tool emphasizes that an app’s function, services, and data determine the relevant analysis. If the policy lists broad categories such as “information from your device” without examples, ask the provider for a complete inventory.
Step 3: Trace purposes, recipients, and tracking
Separate essential operations from optional uses
Mark each stated purpose as one of the following: delivering therapy, scheduling and billing, security and fraud prevention, analytics, product improvement, advertising, research, or another secondary use. A purpose that is optional in theory may become mandatory if refusing consent prevents you from using the service. Note whether the app offers a meaningful opt-out.
List every recipient category
Look for disclosures to hosting and messaging providers, payment processors, analytics companies, advertising platforms, affiliates, contractors, researchers, data brokers, and government or legal authorities. “Service providers” is a recipient category, not an explanation; find out what each category can access and whether it may reuse the data.
Investigate trackers
Web pages and mobile apps can send identifiers or event data to analytics and advertising systems. HHS warns that information from devices and apps may be viewed or collected by other entities, used to target advertisements, or sold to data brokers. For covered entities, disclosures of PHI through tracking technologies are subject to HIPAA requirements; HHS explains this in its tracking-technology guidance and its personal-device guidance.
Check the app’s cookie notice, permissions, software-development-kit disclosures, and any consent banner. Determine whether tracking is limited to a login page, occurs inside message screens, or continues after you reject optional cookies. Ask whether the app sends message text, search terms, appointment details, or only a random identifier.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteStep 4: Examine retention, deletion, and your control
There is no universal retention period for therapy messaging apps. The policy should instead tell you what is retained, why, and when it is removed.
- Messages: Find the normal retention period, archive rules, and whether a therapist or clinic must keep records for clinical or legal reasons.
- Backups: Ask whether deleted content remains in disaster-recovery copies, how long backups persist, and when they are overwritten.
- Account closure: Determine what happens when you stop paying, leave a provider, or delete the app without closing the account.
- Third-party copies: Ask whether deletion requests reach analytics, advertising, cloud-storage, and contractor systems, and what exceptions apply.
- Access and correction: Check how to obtain a copy, correct an error, export records, or challenge an inference.
- Secondary uses: Look for research, product development, automated-model training, or de-identified-data clauses. Determine whether consent is required and whether it can be withdrawn.
- Legal holds: Read exceptions for fraud investigations, disputes, safety events, and recordkeeping duties.
Save a copy of the policy when you enroll. Policies can change, and a later version may apply to new data while older records remain under earlier terms. If deletion language says only that the company will “commercially reasonable” efforts, ask what that means for backups and vendor copies.
Rank #3
- 【Premium & Safe】Anti-theft phone tether that protects against theft, drops & loss. This premium phone tether anti theft solution acts like a secure phone strap, keeping your device safe wherever you go. Ideal for festivals, concerts, and crowded spaces where losing or dropping your phone is common.
- 【Universal Compatibility】The universal Anchor works with all phones and most cases. For the safest installation, stick the 3M anchor directly to your phone and cover with a sturdy phone case. This makes ClutchLoop a reliable phone lanyard or even a compact keychain-style solution you can attach to bags, belts, or purses for hands-free security.
- 【Retractable Steel】30" Steel Retractable Line with a protective coating that offers just the right amount of tension to hold up any phone and still allow comfort while fully extended. Works like a heavy-duty badge reel but designed specifically for phones – perfect for daily use or an anti phone theft festival accessory.
- 【Patented】As innovators in the phone tether space, ClutchLoop was designed by a team who got their phones stolen and decided no one else should ever go through that again. This anti theft phone tether is the result – strong, stylish, and built for worry-free adventures, a travel essential.
- 【Multifunctional】Whether you're dancing at a music festival, exploring a new city, riding public transport, or hiking, ClutchLoop ensures your phone stays safely with you at all times. Say goodbye to lost, stolen, or dropped phones with this retractable anti theft phone strap.
Step 5: Evaluate security and protect your own devices
Vendor safeguards to look for
| Safeguard | Evidence worth finding | Limits of the claim |
|---|---|---|
| Encryption in transit | Use of encrypted connections for app-to-server and service-to-service transfers | It does not show who can read messages on the server or on an unlocked device. |
| Encryption at rest | Protection for databases, file stores, and backups | Ask whether administrators, support staff, or key-management systems can decrypt content. |
| Authentication | Multi-factor authentication (MFA), strong password rules, session timeout, and login alerts | MFA protects account access; it does not limit a vendor’s authorized internal access. |
| Access controls | Role-based permissions, least-privilege access, logging, and staff training | A general “secure” statement is not a description of these controls. |
| Incident response | Breach detection, investigation, notification procedures, and a contact channel | Do not assume that a promise of security prevents incidents or guarantees a particular notice date. |
Ask for a plain-language explanation if the policy says only “industry standard security.” Security certifications or audits, if offered, should identify their scope, date, and whether they cover the messaging environment rather than an unrelated corporate system.
Reduce exposure on your side
HHS telehealth privacy guidance recommends practical patient precautions in its telehealth privacy and security tips:
- Use a private room and check who can hear you before sending or reading a message.
- Use headphones when appropriate, and position the screen so other people cannot read notifications.
- Turn on device encryption, a strong passcode, automatic locking, and operating-system updates.
- Enable MFA in the therapy app and on the email account used for recovery, if available.
- Review notification settings so message previews do not appear on a lock screen or shared wearable.
- Avoid shared or public devices and unsecured networks when discussing highly sensitive information.
- Remove downloaded health information, screenshots, exported files, and old backups from devices when they are no longer needed.
These steps reduce exposure from your phone and surroundings; they are not a substitute for evaluating the vendor’s collection, sharing, retention, and access practices.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Step 6: Test privacy claims against disclosures and behavior
Read a “HIPAA compliant,” “private,” or “confidential” statement as a claim with a limited scope. It does not tell you which legal entity is covered, which data qualifies as PHI, whether advertising trackers operate, who can access content, or how long records and backups remain.
Compare the headline claim with the privacy notice, cookie notice, terms, app permissions, and actual screens. Look for contradictions such as an advertising opt-out that requires sharing data first, a “no sale” statement that permits targeted advertising, or a deletion promise that excludes backups without a time frame.
The FTC’s consumer guidance describes enforcement actions involving Cerebral and Monument in which sensitive information was disclosed for advertising despite privacy promises. Those cases show why promises must be checked against practices; they do not prove that every therapy messaging app behaves the same way. Read the FTC’s account at “When companies share your personal information without your permission”.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Rank #4
- Phone lanyard tether: 1x Carabiner, 4x Pads and 2x Spring phone tether. The anti theft phone strap allows for easy attachment to backpacks, belts, or wrists, providing convenient access to your phone while keeping it close at hand
- Anti-theft phone strap: Ensure the safety of your phone with the Drop Stop cell phone tether. The phone anti theft keeps your iPhone, Android any or phone with a case securely tethered to your belt loop, work vest, or harness
- Not Block Charging Port: Ultra-thin tab can support corded and wireless charging without being removed. It's suitable for all smartphones with a full-coverage case from 4 to 6.9 inches securely. Note: Not support half-coverage phone case
- Easy to Use: Just stick the pad on your phone case, then connect to the lanyard through the charging port of your phone case
- Multifunctional Lanyard: The anti-theft phone tether is a reliable accessory for outdoor activities like hiking, walking, shopping, or biking, keeping your phone secure. It can also hold keys, USB drives, earbud cases, ID cards, and other essentials, making it a practical tool for students, professionals, and travelers
Compare two services with the same evidence categories
If you are choosing between apps, use identical questions and record the source and date for each answer. A service should not receive a higher privacy rating merely because its policy is longer or uses reassuring language.
| Comparison axis | Evidence to record | Decision question |
|---|---|---|
| Provider and legal role | Operator, therapist or clinic, business-associate explanation, and governing terms | Can you identify who is responsible for the data and under which legal framework? |
| Data scope | Content, identifiers, metadata, device and location data, billing, and inferences | Does the service collect only what its therapy function requires? |
| Purpose and sharing | Care, operations, analytics, advertising, research, affiliates, vendors, and brokers | Are optional uses genuinely optional, and are recipients named clearly? |
| Retention and control | Message and backup periods, closure, deletion, access, correction, export, and consent withdrawal | Can you predict when data disappears and exercise meaningful control? |
| Safeguards | Encryption, MFA, access controls, logging, incident response, and notices | Does the documentation describe protections rather than merely call the service secure? |
| Transparency | Policy readability, change notices, app permissions, and consistency with observed behavior | Do the disclosures match the product experience? |
When a cell is unknown, label it “not stated” and ask the provider. Unknown is a decision-relevant result; it is not evidence that the app has the stronger practice.
Warning signs and how to respond
- Only a HIPAA badge: Ask which covered entity is involved, what data is PHI, and whether the vendor is a business associate.
- Broad “we may share” language: Request a recipient list and examples of data sent to each category.
- Advertising mixed with care: Ask whether message content, appointment details, device identifiers, or inferred conditions feed advertising systems.
- Vague deletion promises: Ask about backups, contractors, legal holds, and a specific completion timeline.
- No MFA or session controls: Use a separate strong password, secure the recovery email, and ask whether the provider plans stronger authentication.
- Unreadable or conflicting documents: Pause enrollment until the provider explains which document controls and when it was last updated.
- Unexpected permissions: Deny access to contacts, precise location, microphone, camera, or files unless the therapy function clearly requires it.
If the provider will not answer basic data-flow questions, choose a communication method that exposes less information or ask your clinician about a platform with clearer controls. Do not send a complete history merely to test the service.
Before your first sensitive message
- Save the current privacy notice, terms, consent screens, and the provider’s written answers.
- Confirm the recipient address or therapist identity; a misdirected message can defeat strong technical controls.
- Disable lock-screen previews and check whether the app stores attachments in an ordinary photo or file folder.
- Use MFA, a unique password, an updated device, and a private network and room.
- Send the minimum information needed for the immediate care question. Ask how to transmit records that must be retained in a clinical file.
- Review account and notification settings after the first message, including analytics or advertising choices.
If you suspect misuse, loss, or a breach
First preserve evidence: save relevant policy versions, screenshots of permissions or disclosures, dates, messages from the provider, and any unusual account activity. Stop optional data sharing and change your password if you suspect account access. Ask the provider what information was involved, which recipients received it, whether copies were deleted, and what notification process applies.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →For care delivered by a covered provider, contact the provider’s privacy officer and consult HHS information about HIPAA rights. For an app outside HIPAA, deceptive or unfair practices may still be reported to the FTC, and a state attorney general or state privacy regulator may have authority under local law. The applicable path depends on the app’s role, your location, and the facts of the incident; do not assume that one complaint process covers every service.
Make the decision
A therapy messaging app is a reasonable choice only when its data flows are understandable and acceptable for the sensitivity of your care. Verify the provider relationship instead of relying on HIPAA language, inventory content and metadata, identify advertising and analytics recipients, confirm retention and deletion limits, examine documented safeguards, and secure your own devices and surroundings. If material questions remain unanswered, treat that uncertainty as part of the privacy risk and ask for a different channel or service.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
