Cerebral has agreed to pay more than $7m to settle Federal Trade Commission (FTC) charges that alleged that the telehealth company disclosed its consumers’ personal health information to third parties for advertising. 

The proposed order, pending federal court approval, was filed by the US Department of Justice upon notification from the FTC.  

It will see Cerebral pay around $5.1m to provide partial refunds to consumers affected by its deceptive cancellation practices and a $10m civil penalty, which will be suspended after Cerebral pays a $2m penalty, acknowledging the company's limited ability to pay the full amount. 

The order permanently restricts Cerebral from using or disclosing the personal and health information of the consumers to third parties for advertising or marketing purposes. 

Cerebral is also required to implement a specific ‘data retention schedule’ and delete consumers’ data that is not used for healthcare operations unless they provide their consent to its retention.  

Additionally, the order mandates a comprehensive privacy and data security programme and requires a notice on Cerebral's website about the complaint's allegations and its required actions. 

Cerebral, which offers online mental health services, collects extensive personal data from consumers who use its services.  

The complaint asserts that Cerebral and its former CEO, Kyle Robertson, violated privacy promises and misled consumers about the company's cancellation policies.  

They are also accused of breaching the Opioid Addiction Recovery Fraud Prevention Act of 2018 with their substance use disorder treatment services. 

According to FTC, Robertson has yet to agree to a settlement, which is why the court will decide on charges against him. 

The complaint further alleges that Cerebral shared nearly 3.2 million consumers' sensitive data with third parties such as Snapchat, LinkedIn and TikTok without explicit consent. 

It also highlights inadequate data security measures and practices such as sending unsealed promotional postcards revealing more than 6,000 patients' treatment details and allowing former employees access to user data. 

FTC chair Lina Khan said: “As the Commission’s complaint lays out, Cerebral violated its customers’ privacy by revealing their most sensitive mental health conditions across the Internet and in the mail. 

“To address this betrayal, the Commission is ordering a first-of-its-kind prohibition that bans Cerebral from using any health information for most advertising purposes."