Is AI Therapy Private? Data, Confidentiality, and What to Check

Is AI therapy confidential? The short answer

No. AI therapy is not confidential the way a session with a licensed therapist is. When you talk to a licensed therapist, the law protects what you say. Therapists are bound by professional confidentiality, and in most legal settings your communications are also covered by therapist-patient privilege, which limits when they can be used in court. There are narrow exceptions, such as an imminent risk of harm to yourself or others or a court order, but the default is strong, enforceable protection.

AI therapy is different. A chatbot is software run by a company, not a clinician who owes you a professional duty. Nothing about typing into an app automatically makes the conversation confidential or privileged. The only thing standing between your messages and misuse is the company's privacy policy and its security practices. That is a meaningful gap, and it is the single most important thing to understand before you share anything personal.

This does not mean every AI tool is careless with your data. Some are genuinely privacy-forward. It means the protection is a business promise, and you have to verify it yourself. Privacy sits near the top of any honest list of AI therapy pros and cons.

What actually happens to your data

When you message an AI therapy app, your text is usually sent to a server, processed, and stored. From there, several things can happen, depending on the company. Your conversations may be retained on the company's systems, sometimes indefinitely, so they can power features like history and personalization.

Human review is common. Many companies allow employees or contractors to read a sample of conversations to improve the product, check quality, or moderate for safety. Your messages may also be used to train or fine-tune AI models, which means fragments of what you wrote can become part of how the system behaves for everyone, unless the company offers and you choose an opt-out.

Third parties are often in the loop too. Apps frequently rely on outside services for hosting, analytics, crash reporting, and advertising, and your data, or signals derived from it, can be shared with those providers. Some apps have shared or sold sensitive information for marketing. Regulators have taken action against mental-health and health apps for exactly this kind of undisclosed data sharing. In 2023 the FTC banned BetterHelp from sharing consumers' health data with advertisers and ordered $7.8 million in refunds, so it is not a hypothetical risk.

Finally, stored data can be exposed in a breach or requested through legal process. The more sensitive the information you put in, and the longer a company keeps it, the more there is to lose if something goes wrong. The World Health Organization has flagged this at the global level, warning that the health information people share with AI systems may not receive the protection it deserves.

Is AI therapy HIPAA compliant?

HIPAA, the US Health Insurance Portability and Accountability Act, is the rule people assume protects all health information. It does not. HIPAA only applies to covered entities, which are health plans, healthcare clearinghouses, and healthcare providers that bill electronically, along with the business associates that handle data on their behalf. It governs how those specific organizations use and disclose protected health information.

Most consumer AI therapy apps are not covered entities. They are technology companies selling a wellness or self-help product directly to you, not providers billing insurance. Because of that, the sensitive emotional information you share with them generally falls outside HIPAA's protection, even though it feels exactly like health data. A privacy policy that says the app is not a covered entity, or that simply never mentions HIPAA, is telling you that HIPAA's safeguards do not apply.

There are exceptions. If an app connects you to licensed clinicians, operates inside a healthcare system, or partners with providers and handles their patient data, parts of it may be HIPAA-bound. Some apps voluntarily describe themselves as HIPAA-compliant or use HIPAA-aligned security even when they are not legally required to. That can be reassuring, but read carefully, because a marketing claim is not the same as a legal obligation, and 'HIPAA-compliant infrastructure' can describe the hosting while the app still shares data in ways HIPAA would not allow for a provider.

Some states are starting to fill the gap HIPAA leaves. Washington's My Health My Data Act extends consumer health data protections to apps HIPAA does not cover, and other states are following. Where you live can change what an app is legally allowed to do with your data.

Privacy features to look for

Companies that follow best practices for AI chatbots in therapy make their data practices easy to find and easy to control. Look for encryption, both in transit and at rest, so your messages are protected as they travel and while they sit on the company's servers.

Look for a clear way to opt out of model training, ideally on by default, so your conversations are not used to train AI systems unless you agree. Look for real data deletion: the ability to delete individual chats and your whole account, with a statement that deletion actually removes your data rather than just hiding it.

Anonymity helps. Apps that let you start without an email, real name, or phone number reduce how easily your conversations can be tied back to you. Minimal data collection is a good sign in general: the less an app gathers, the less there is to leak or misuse.

Most important is a clear, specific privacy policy. It should plainly state what is collected, how long it is kept, whether humans review conversations, whether data is used for training or advertising, and which third parties receive it. A short, readable policy that answers those questions is a stronger signal than a long, vague one full of 'we may share with partners' language.

Red flags to watch for

Some signals should make you pause before sharing anything personal. A missing or hard-to-find privacy policy is the biggest one: if a company will not tell you clearly what it does with your data, assume the worst.

Watch for language that permits broad sharing or selling, such as sharing data with 'partners,' 'affiliates,' or 'for marketing purposes,' especially without a way to opt out. Be cautious when an app uses your conversations to train AI with no opt-out, when it requires more personal information than the service needs, or when it shows targeted ads, which usually means data is being shared with ad networks.

Other warning signs include no clear way to delete your data, vague or contradictory statements about human review, and marketing that leans on the word 'confidential' or 'private' without explaining what that means in practice. A history of regulatory action or a publicized data breach is worth a quick search before you commit, and a scan of AI therapist reviews often surfaces breach history and data complaints. None of these guarantees harm, but together they tell you how seriously a company takes your trust.

Practical advice: protect yourself while using AI therapy

You can get value from AI support while limiting your exposure. The simplest rule is to treat the chat as something a company can read and keep, and to share accordingly. Avoid putting in details that identify you, such as your full name, address, employer, or the names of other people involved in your situation.

Be careful with highly sensitive specifics: things tied to your legal situation, immigration status, substance use, or anything that could harm you if it were exposed or subpoenaed. You can still describe how you feel and work through a problem using general terms instead of identifying particulars. Our guide on how to use AI as a therapist responsibly goes deeper on this. Where the app allows it, sign up with a minimal account, turn off model training, and delete conversations you no longer need.

Read the privacy policy before you start, not after. Spend two minutes on the sections about data retention, training, human review, and sharing. And remember the limits of the tool itself: AI therapy apps are self-help aids, not crisis services and not a replacement for a licensed clinician. If you are in crisis or thinking about suicide, call or text 988 in the US to reach the Suicide and Crisis Lifeline, available 24 hours a day. For genuine confidentiality and protected, privileged conversations, a licensed therapist remains the right choice.