Headspace

You are agreeing to have your personal information sold or shared with third parties for targeted advertising.

“For that purpose, we may disclose limited personal information to third parties for our cross-context behavioral and targeted advertising purposes and this activity may fall under broader concepts of “selling” and/or “sharing” under the CCPA.”

What that means: Your browsing habits and identity are used to show you ads across other websites and apps.

The document explicitly states that data is shared with third parties for targeted advertising and defines this activity as "selling" or "sharing" under California law. This includes browsing history and online identifiers.

You are agreeing to the creation and retention of inferred psychological and behavioral profiles about you.

“Profile reflecting a person's preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, age and aptitudes”

What that means: Headspace creates detailed profiles of your personality and psychological state based on your interactions.

The document lists "Inferences drawn from other personal information" which includes psychological trends and attitudes, classifying these as collected data.

You are agreeing to let Headspace act as the primary controller of your health-related personal information.

“Headspace operates as a data controller under the General Data Protection Regulation (GDPR) for the majority of the personal information detailed in section 1 and as a data processor for the limited personal information we may receive from your Benefit Sponsor.”

What that means: Headspace controls how your mental and physical health data is processed and retained on their servers.

As a data controller, Headspace determines how your health information is processed. While HIPAA protections apply to some care providers, the main platform acts as a controller for general usage data.

You are agreeing to indefinite data retention while you remain connected to the platform or if legally required.

“We will keep your personal information for as long as needed to perform our obligations to you, or for as long as legally permitted. The criteria used to determine our retention periods include: (i) the length of time we have an ongoing relationship with you...”

What that means: Your data stays on file indefinitely as long as you maintain a relationship with them or they deem it legally necessary.

Data retention is tied to the ongoing relationship and legal permissions, rather than a fixed period after you stop using the service.

You are agreeing to ensure that any users under 13 do not create accounts or provide data independently.

“Our Platform is not intended for individuals below 13 years old or the equivalent age in your jurisdiction. We do not intentionally collect personal information from individuals under that age.”

What that means: Children under 13 are not supposed to use the service, limiting exposure risks for minors.

The policy clearly restricts use to those 13+ and states they do not intentionally collect data from younger children.

You are agreeing that your right to delete data is subject to legal exceptions and verification requirements.

“You have the right to request, under certain circumstances, the deletion of your personal information that we collect.”

What that means: You can ask for your data to be removed, but it might not happen if legal reasons prevent it.

Users can request deletion, but it is subject to exceptions like legal obligations or fraud prevention.

You are agreeing to allow unilateral changes to this policy with notification provided for significant updates.

“When we may make a significant change, such as on how we use your personal information or your rights, we will notify you within the Platform or through another channel such as the email you supplied during account registration...”

What that means: They can modify data practices and will tell you if it affects your rights significantly.

The company can change terms and will notify users of significant changes via email or platform notices.