Telehealth Privacy Misrepresentations: What Platforms Sent to Advertisers

Telehealth privacy FTC actions examine misleading privacy promises and unauthorized disclosures of health information to advertisers. The Federal Trade Commission’s BetterHelp action concerned treatment questionnaires and account information used for advertising targeting. A private therapy conversation need never leave the platform for its advertising system to reveal something sensitive. If you work in product, marketing, engineering or privacy, you may know what the patient was promised and what the technology actually sent.

The Data Flow Starts Before the Visit

Intake and account data can tell a health story before a clinician begins an appointment. BetterHelp’s privacy order addresses treatment, account and questionnaire information used for targeting. The distinction matters to someone who built the intake form: the patient’s reason for seeking treatment can be sensitive even when it sits outside the therapist’s conversation.

The useful comparison follows questionnaire answers, account identifiers, appointment data, device readings and connections to an electronic health record separately. Advertising software can create another path to an outside recipient. We examine which fields crossed that path, what connected them to a person and what the company said about that use.

An advertising identifier attached to treatment information can matter under an order’s definitions. In the Easy Healthcare order, app information and identifiers are part of the advertising restrictions. The data does not have to look like a medical chart to reveal something about a person’s health.

The brand, clinical practice and technology vendor may also be different businesses. Management companies can handle scheduling, billing, technology and marketing while a separate professional entity supplies care. That division makes responsibility concrete: who controlled the interface, who held the clinical record and who operated the advertising tools? A patient sees one service. An insider may see the separate systems behind it.

The FTC Orders Change What Platforms Can Do With Data

The privacy orders reach beyond the promises on a patient’s screen to the software sending information elsewhere. Restrictions on advertising and requirements to delete data change what a platform can do with information patients supplied for care.

BetterHelp and Treatment Questionnaire Data

BetterHelp’s order required $7,800,000 for relief including consumer redress, alongside deletion and independent assessments. An employee who understands the intake and account systems may see the disclosure even without access to a therapist’s notes.

BetterHelp’s order also separates disclosures subject to consent from disclosures it expressly prohibits. Consent cannot authorize a disclosure the order bans. For the product team, changing a consent screen and changing the data transfer are different pieces of work.

GoodRx and Easy Healthcare Address Advertising Transfers

GoodRx’s order, announced by the Justice Department, imposed a $1,500,000 civil penalty and addressed health-data advertising disclosures, breach notices and representations about HIPAA status. Advertising restrictions, consent, deletion and a privacy program accompanied the monetary relief.

The Easy Healthcare action extended that advertising concern to Premom app information and identifiers. Its order imposed a $100,000 civil penalty, advertising restrictions, notices, deletion and a privacy program.

These orders connect the privacy representation to the transfer and the recipient. Deleting information from the platform’s own systems addresses only one location in that chain. The recipient records and deletion workflow matter too.

Monument and the Suspended Penalty

A telehealth privacy order’s suspended penalty and a paid fine describe different outcomes. Monument’s June 7, 2024 entered order imposed a $2,500,000 civil penalty suspended on financial conditions. It also imposed advertising restrictions and a privacy program, addressing tracking disclosures and HIPAA representations. The advertising restrictions still changed what the platform could do with the data.

Flo Makes Consent a Separate Disclosure

Flo Health’s June 17, 2021 order addressed alleged reproductive-health disclosures contrary to assurances. It required a disclosure separate from the privacy policy and terms of use, together with user notice, deletion requests and outside review.

The screen asking permission matters alongside the policy the company published. Flo and Premom also extend the comparison beyond the remote appointment: information supplied to a health app can be the subject of advertising restrictions in its own right.

Cerebral’s Refunds Addressed Cancellation

Cerebral’s consumer action concerns allegations about privacy representations, sensitive-data disclosures, security and subscription cancellation. Its April 15, 2024 stipulation set out proposed consumer relief and a civil penalty with a portion payable and the remainder conditionally suspended.

The Federal Trade Commission later announced in May 2025 that it was sending more than $5 million in refunds to 40,249 consumers over cancellation problems. The privacy allegations concern a different question: what happened to sensitive information entrusted to the platform.

A Privacy Promise Has to Match the Technology

A HIPAA compliant badge on a telehealth site does not tell you where its advertising pixels send data. HIPAA obligations depend on the actual role of the health care organization or the business handling protected information for it.

GoodRx and Monument show why representations about HIPAA status belong beside the advertising configuration. The promise may appear on the patient-facing screen while the transfer happens through software managed elsewhere in the business. We compare the language shown to the patient with the fields sent, their recipients and the consent in place at the time.

What Evidence Is Needed to Report Fraud?

For a platform privacy concern, the useful evidence connects the promise, the information, the transfer and the recipient. Our whistleblower experts work with you to see how those records fit together. Tracker configurations, recipient logs, consent screens and deletion workflows show different parts of that connection.

An engineer may understand the advertising software’s configuration. A privacy employee may know which consent interface accompanied it. A marketing employee may know how the recipient used the information. We connect those accounts with the company’s representations and the records of the transfer. The question becomes specific enough to investigate: what did this recipient receive under this version of the patient-facing promise?

Contracts help identify the businesses involved. A management agreement describes nonclinical responsibilities, while a platform agreement identifies the technology relationship. Privacy obligations can also sit in agreements with businesses handling protected information. We put those responsibilities beside the configuration and recipient records to understand who controlled the transfer.

Deletion adds a further comparison. Flo’s order required deletion requests. BetterHelp’s required deletion and independent assessments. We examine what the company instructed recipients to do, what its own workflow recorded and what information remained in use. We also examine how long information stayed available to the recipient after the transfer. A revised privacy policy answers what patients were told afterward. The transfer and deletion records answer what happened to information already collected.

Telehealth Privacy Rules Changed on Different Dates

The pandemic telehealth policy and the Federal Trade Commission’s health-app breach rule followed separate paths. HHS began holding back penalties for good-faith telehealth using non-public-facing communications on March 17, 2020. HIPAA remained in place, and ordinary enforcement resumed on August 10, 2023, after the transition in the expiration notice.

The Federal Trade Commission’s amended Health Breach Notification Rule took effect July 29, 2024. It addresses covered health-record businesses outside HIPAA, health apps, the capacity to draw information from multiple sources and unauthorized disclosures. An advertising disclosure can be the relevant breach event, even without a hacker entering the system.

On September 9, 2026, the Federal Trade Commission withdrew its superseded health-app policy statement from 2021. The 2024 rule remained in place. That distinction matters when a company relies on an old policy summary to explain a newer data transfer.

Hims & Hers Puts the Intake and Advertising Systems Together

The Federal Trade Commission, California and Utah’s July 29, 2026 complaint against Hims & Hers challenges what patients were promised about consultations and when the platform charged them. It also alleges problems with treatment approval, refills, cancellation and disclosures to advertisers.

The company’s own annual filing describes separate physician-owned medical groups, administrative support and a largely customer-paid U.S. model. A subscription, a shipment and a consultation are separate business events. That structure helps explain why the intake interface, the payment record and the clinical record answer different questions.

For the privacy inquiry, we connect the representation shown during intake with the advertising transfer. For the subscription inquiry, the relevant comparison includes what was offered, when the customer was charged and what access continued. Interface versions and timing give those comparisons their meaning.

NextMed and the Advertised Membership Price

If a telehealth membership price excludes medication and lab work, the advertised bundle and the charged services become the comparison. The NextMed final order addresses price and benefit representations, including what the telehealth price covers, as well as fabricated reviews, recurring billing and cancellation.

Where Platform Practices Meet Government Claims

Cerebral’s whistleblower complaint alleged that prescribing incentives led to claims paid by federal health care programs. Its consumer action addressed privacy and cancellation.

A whistleblower case under the False Claims Act can pay 15% to 30% of what the government recovers. If you know one part of a platform’s operation, our whistleblower experts work with you to examine how its technology, treatment decisions and payments fit a potential case.

You Know What the Platform Sent

If you know the privacy promise and the advertising transfer behind it, speak to one of our whistleblower experts about what the platform sent. We work beside you throughout the case, connecting the technology, the money and the decisions that shaped both. We bring in healthcare fraud whistleblower lawyers with the expertise to build your strongest whistleblower case.