Retirement & Telehealth · Telehealth (mental health, subscription) · Regulatory action + Data breach
Cerebral
Headline
In March 2023 Cerebral reported to HHS that it had disclosed health information on 3,179,835 people to Google, Meta, TikTok and other ad platforms through tracking tools, dating back to 2019.
Not independently verified. Verification status: Unverified - heuristic first draft. Publish state: draft unverified.
In March 2023 Cerebral reported to HHS that it had disclosed health information on 3,179,835 people to Google, Meta, TikTok and other ad platforms through tracking tools, dating back to 2019. The disclosures included mental-health assessment answers, treatment and insurance details. The FTC's resulting 2024 order is already tracked as its own enforcement record (ftc-cerebral-2024); this row covers the consumer-facing terms and the breach and does not restate that order.
- Severity
- Evidence tierUnassigned
- Claims confirmed
- Last verified2026-10-16
Primary source. www.databreaches.net/cerebral-inc-notifying-3179835-patients-of-tracking-technologies-breach/ — Unverified - heuristic first draft.
Terms
Arbitration
Yes. Binding individual arbitration before NAM (Sec. 3.4.2, 3.4.6). Class/representative waiver (Sec. 3.4.4) and jury waiver. 60-day informal-resolution period (Sec. 3.4.1). New York governing law; NY, NY courts for non-arbitrable claims (Sec. 3.6).
Data sharing
CONFIRMED HISTORICAL DISCLOSURE: health information on 3,179,835 users reached ad platforms via tracking tools (reported Mar 2023). The current policy still lists 'ad platforms services' among vendors and permits third-party tailored ads. It says Cerebral makes 'no representation about the accuracy or effectiveness' of opt-out mechanisms. The policy gives two different privacy request emails: privacy@cerebral.com (Sec. 14) and privacy@getcerebral.com (Sec. 5).
Fees and billing
Subscriptions auto-renew to the card on file. Cancel via 'Cancel Subscription' in the account before the next billing date (Sec. 1.3-1.4). 'All purchases are final,' with no partial-period refunds (Sec. 1.4). The FTC order's cancellation terms are in ftc-cerebral-2024.
Contacts
Privacy contact. privacy@cerebral.com (also privacy@getcerebral.com in Sec. 5); opt-out@cerebral.com for arbitration opt-out
Legal notice. 2093 Philadelphia Pike #9898, Claymont, DE 19703 (privacy policy footer; appears to be a mail-forwarding address).
Mailing address. Not recorded.
Evidence
No claims have been itemized for this row yet.
Sources
| Source | Claim | Tier | Status | Quote |
|---|---|---|---|---|
| news (breach tracker) · 2023-03-09 www.databreaches.net/cerebral-inc-notifying-3179835-patients-of-tracking-technologies-breach/ | whole row | Unassigned | confirmed | “On March 6, 2023, Cerebral began sending emails to users of its platforms.” Quote basis: not recorded. |
| company terms · 2025-09-17 cerebral.com/terms-and-conditions | whole row | Unassigned | confirmed | “within 30 days of February 15, 2023 or your creation of a User Account, whichever is later” Quote basis: not recorded. |
| company policy · 2025-09-17 cerebral.com/privacy-policy | whole row | Unassigned | confirmed | “HIPAA may not apply to your transactions or communications with Cerebral.” Quote basis: not recorded. |
Source vault
Link status: Candidate - not yet fetched
| Document | Last fetch | |
|---|---|---|
| Privacy policy https://cerebral.com/privacy-policy | Not fetched yet | NOT CONFIRMED |
| Terms of service https://cerebral.com/terms-and-conditions | Not fetched yet | NOT CONFIRMED |
| Website https://cerebral.com | Not fetched yet | — |
| Primary source https://www.databreaches.net/cerebral-inc-notifying-3179835-patients-of-tracking-technologies-breach/ Verification: Unverified - heuristic first draft | Not fetched yet | — |
Enforcement
No enforcement actions are linked to this row.
State statute
No HQ state on file, so no state statute applies by headquarters.