Mental Health Apps: Types, Evidence, Privacy and FDA Rules

Mental health apps are smartphone programs built to track, teach, support or treat mental health symptoms. The National Institute of Mental Health (NIMH) says thousands are available in the iTunes and Android app stores and that the number grows every year^[1].

They sit alongside traditional care for people with any mental illness, and range from free meditation timers to prescription-only software. What separates them is less the screen than three questions: what the app claims to do, who regulates it, and where user data goes.

NIMH groups apps by function into six categories: self-management, thinking-skills (cognitive remediation), skill training, illness management and supported care, passive symptom tracking, and data collection^[1]. Supported-care apps connect users to a peer or a trained provider, while passive trackers use phone sensors to record movement, call and text counts, and vocal tone^[1].

A separate group is regulated as medical devices. Federal rules define a prescription-only category of "computerized behavioral therapy" software meant to be used alongside clinician-supervised outpatient treatment^[5].

One of the most comprehensive answers comes from a 2024 World Psychiatry meta-analysis of 176 randomized controlled trials^[2]. Apps produced small but statistically significant improvements in depression symptoms (g=0.28, more than 33,500 participants, number needed to treat 11.5)^[2].

Results for generalized anxiety were similar: g=0.26 across 150 comparisons, with a number needed to treat of 12.4^[2]. In plain terms, roughly 11 to 12 people would need to use an app for one additional person to improve compared with a control group^[2].

Effects on depression were larger in trials of cognitive behavioral therapy (CBT) apps, apps with chatbot features, and trials that compared apps with an inactive control such as a waitlist^[2]. That last point matters: 60% of trials used an inactive control, and only ten compared an app with an active psychological treatment such as face-to-face sessions^[2].

Engagement, dropout and the head-to-head numbers are covered in detail in our mental health apps statistics analysis. For how common these conditions are in the first place, see the any mental illness data page.

Only apps that function as medical devices face FDA review, and many of those are exempt in practice. The FDA applies a risk-based approach and focuses on software that presents a greater risk to patients if it does not work as intended^[3].

For software that technically meets the definition of a device but poses minimal risk, the FDA exercises "enforcement discretion" and does not expect premarket review or registration^[3]. That explicitly includes apps that help users self-manage a condition without giving specific treatment suggestions^[3], a description that fits many mood-tracking and coping-skills apps.

Apps that claim to treat a psychiatric disorder fall into a different lane. Since December 2017, federal regulation has classified computerized behavioral therapy devices for psychiatric disorders as Class II, prescription-only, with special controls that require clinical data validating the therapy model^[5].

The same rule requires labeling that warns the device is not a standalone therapy and does not substitute for the patient's medication^[5]. Rejoyn, listed as a computerized behavioral therapy device for depressive disorders, was found substantially equivalent under this regulation through a 510(k) decision dated March 30, 2024^[4].

What about AI therapy chatbots?

On November 6, 2025, the FDA's Digital Health Advisory Committee met specifically on generative AI-enabled digital mental health devices, citing a rise in "AI therapists" and therapist-like chatbots^[8]. The committee flagged risks including hallucinations, model bias, missed therapeutic cues, worsening symptoms including self-harm behaviors, and unhealthy parasocial attachment to the chatbot^[8].

Committee members also said labeling should state clearly that the AI is not a human therapist and should include crisis information and data-use details^[8]. They noted that waitlist controls may not be ideal for studying these devices^[8].

Usually not. HIPAA applies only when protected health information is handled by covered entities (health plans, most providers, clearinghouses) and their business associates^[6].

The HHS Office for Civil Rights states that in most cases, unless a covered entity or its business associate provided the app, HIPAA does not protect data that people download or enter into mobile apps for personal use^[6]. The same guidance warns that app data may be used for targeted ads or sold to data brokers^[6].

An app supplied by a clinic or health plan is different, as is a teletherapy session with a provider who is a covered entity. The VA makes the same distinction for its own PTSD Coach app: self-monitoring data belongs to the user, but once it is shared with a health care provider, that provider must follow HIPAA^[9].

What the privacy research found

A 2019 JAMA Network Open study intercepted the network traffic of 36 top-ranked apps for depression and smoking cessation^[7]. Data went to at least one third party from 33 of the 36 apps (92%)^[7].

Twenty-nine of the 36 (81%) sent data to analytics or advertising services run by Google or Facebook^[7]. Almost half (17 of 36) transmitted data to a third party while lacking a privacy policy, omitting the transmission from the policy, or stating it would not happen^[7]. The apps were sampled in January 2018, so the specific titles have likely changed^[7].

Where the FTC comes in

Outside HIPAA, the Federal Trade Commission polices deceptive privacy promises. In March 2023 the FTC announced an order requiring the online counseling service BetterHelp to pay $7.8 million and banning it from sharing consumers' health data for advertising^[10].

The FTC alleged BetterHelp had shared email addresses, IP addresses and health questionnaire answers with Facebook, Snapchat, Criteo and Pinterest after promising to keep that data private^[10]. The agency called it the first Commission action returning money to consumers whose health data was compromised^[10].

Yes. The VA's National Center for PTSD publishes a set of apps in three groups: self-help apps, treatment companions for use with a provider, and apps for related problems^[11].

Self-help titles include PTSD Coach, Mindfulness Coach, VetChange and Coping Coach; treatment companions include CBT-i Coach, CPT Coach, PE Coach and ACT Coach; related apps include Insomnia Coach and Safety Plan^[11]. The VA states the apps are not intended to replace needed professional care^[11].

PTSD Coach is free and publicly available to anyone, not only veterans, and the VA reports more than 1 million downloads in 115 countries^[9]. Its built-in questionnaire is the PTSD Checklist (PCL), which the VA notes is not a substitute for professional evaluation^[9]. Background on the condition itself is on the PTSD page.

The VA's published privacy policy says its mental health apps send no identifying data to VA or third parties and collect only anonymous usage data, which users can switch off^[11].

The American Psychiatric Association's App Evaluation Model is a framework clinicians use to vet apps. It is a hierarchy of questions rather than a ranking, and the APA says there is no minimum number of levels an app must meet to be considered useful^[12].

The model runs in six steps^[12]:

1. Background: ownership, funding, conflicts of interest, cost, whether it claims to be medical, and whether it was updated in the last 180 days^[12].
2. Access: platforms, offline use, accessibility features, languages and reading level.
3. Privacy and security: a readable privacy policy, declared data uses, opt-out and deletion, where data is stored, breach plans, and whether and how AI is used.
4. Clinical foundation: accurate content, a relevant evidence base, testing in the intended users, and disclosed retention rates.
5. Usability: engagement, customization and ease of navigation.
6. Integration: whether users can access and export their data and share it with a care team.

The APA notes there is currently no gold standard for rating app privacy and that an app with no clear privacy policy may not be suitable for sensitive health information^[12].

NIMH's checklist overlaps: it suggests checking the developer's credentials, looking for guidance on what to do if symptoms worsen or there is a psychiatric emergency, and searching PubMed for published research on the app^[1]. NIMH also warns that it has not developed or endorsed any apps and that some developers have used its logo without permission^[1].

When an app has no studies of its own, NIMH suggests checking whether it is based on a tested treatment, noting that research has found internet-based CBT as effective as conventional CBT for depression, anxiety, social anxiety disorder and panic disorder^[1]. Background on that approach is in our guide to CBT for depression.

The evidence does not show that. Only ten of the 176 trials in the 2024 meta-analysis compared an app with an active psychological treatment such as face-to-face sessions or a web-based program^[2].

Regulators and the VA frame apps the same way. Federal labeling rules for prescription therapy apps require a warning that the device is not a standalone therapy^[5], and the VA says its own apps are not meant to replace professional care^[11].

NIMH lists convenience, anonymity, lower cost, 24-hour availability and wider outreach as advantages, along with open questions about effectiveness, privacy, regulation and overselling^[1]. Those advantages are most relevant where in-person care is hard to reach, a gap documented in our reports on the mental health treatment gap and the therapist shortage.

For human options, see our overview of kinds of therapists.