Headspace

Is Headspace safe?

Yes, for most people Headspace is one of the safer mental health apps you can install. It has no fines, no regulator orders and no reported breach, and it publishes more security evidence than most rivals: a 2026 SOC 2 Type II report, a HITRUST certification and yearly penetration tests. The catch is advertising. Its privacy policy says it passes your email, device identifiers, IP address and browsing activity to ad platforms, which California law treats as a "sale" or "share". We score it 69/100, ahead of Calm and BetterHelp and six points behind MyChart.

What Headspace collects, and who sees it

Headspace is no longer only a meditation library. The same app now offers text-based coaching, video therapy, psychiatry and an AI companion called Ebb. That widens what it may hold about you: mood check-ins and survey answers, goals, health history if you start therapy, and optional profile details such as race, sexual orientation and gender identity.

Apple's privacy label is fairly modest. It shows no "Data Used to Track You" section, so Headspace does not declare cross-app tracking on iPhone. It does link health data to your identity for analytics and personalisation, and it uses your email, purchases, approximate location, identifiers and app interactions for its own marketing. Google Play lists name, email, user IDs, device IDs and app interactions as shared with other companies.

The privacy policy, effective 30 September 2026, goes further than the label. In its California notice Headspace says that, in the past 12 months, it "sold" or "shared" email addresses, online identifiers, IP addresses, purchase history and website browsing data with third parties for cross-context advertising. It says sensitive data, including health information, is not used to personalise ads. Because the policy discloses more ad sharing than Apple's label, we score privacy on the policy.

If an employer or health plan pays for your subscription, the policy lets Headspace tell it your name, email, sign-up date and last date of use, but generally not what you did in the app.

Is Headspace HIPAA compliant?

Only for the care side. Therapy and psychiatry come from Headspace Medical Group (CA) P.C. and other providers, which are HIPAA-covered entities, and Headspace is bound as their business associate. The meditation and sleep content falls under the ordinary privacy policy, where the ad sharing described above applies. Headspace is also certified under the EU-US Data Privacy Framework, so European users can take complaints to a free arbitration service.

How secure is Headspace?

Headspace publishes more security evidence than most rivals. Its trust centre, launched in January 2026, lists a SOC 2 Type II report for 2026, a HITRUST certification from 2025, UK Cyber Essentials Plus and a 2025 penetration test with a remediation report. Some of these documents are shared only on request, but the list is more than most consumer health apps publish. Google Play confirms data is encrypted in transit, and we found no reported breach.

There are gaps. Messages with coaches and therapists are not end-to-end encryptedEnd-to-end encryptionEncryption in which only the sender and the recipient can read a message. The company running the service cannot see its content.More in the glossary, so Headspace's systems can read them. There is no public bug bounty on HackerOne or Bugcrowd, only a [email protected] address. Its help centre says multi-factor sign-in is offered only to corporate partners, so ordinary subscribers cannot turn it on.

Has Headspace been fined?

We found no regulator action. The FTC's cases database has no entry for Headspace, and we found no state attorney general case or European fine. That contrasts with BetterHelp and GoodRx, which both paid FTC penalties for sending health data to advertisers. Mozilla's 2022 review of 32 mental health and prayer apps, which included Headspace, Calm and Talkspace, gave 29 of them a privacy warning.

How to use Headspace more privately

1. On iPhone, tap "Ask App Not to Track" if prompted. On Android, delete your advertising ID in the system ad settings.
2. Open the My Data page in the app and opt out of the sale and sharing of your data. On the website, use "Your privacy choices" or a browser that sends Global Privacy Control.
3. Skip the optional profile fields about race, sexuality and health history unless your clinician needs them.
4. If work pays for your plan, remember that your employer can see when you last used the app.
5. When you leave, delete the account from settings rather than just removing the app, and cancel the renewal first.

How we scored it

The regulatory record (87) is the strongest factor, because no regulator has fined or ordered Headspace, though none has examined it closely either. Security (66) benefits from independent audits and certifications but loses points for no bug bounty and no two-factorTwo-factor authenticationSigning in with a second proof of identity on top of your password, such as a code from an app, a security key or a passkey.More in the glossary login for individual subscribers. Privacy (60) is the weakest: the policy discloses ad sharing of identifiers and browsing data that Apple's label does not show as tracking.