Mental-health chatbot conversation content or health data sold or shared with third parties

Strip chat text and health fields from every analytics, ad-pixel, CRM, and broker payload, and send health data to vendors only under a recorded HIPAA-equivalent contract.

Route all third-party telemetry from the chatbot through one event helper with an allowlist of non-content properties (event name, counts, latency, plan), so message text, transcripts, and health fields (mood logs, diagnoses, PHQ-9 scores, medications) can never be attached, and do not load ad pixels or session-replay scripts on chat pages. Any call that sends identifiable health information to an outside party first checks the destination against a vendor registry that records HIPAA-equivalent contract terms, or against a stored user consent or request, and refuses anything else. Raw conversation content is never sent to a third party.

Where it goes: 1 application source code, 6 API calls and integrations, 9 AI output handling, 10 logs and telemetry.

What reviewers look for: analytics.track, mixpanel.track, amplitude.track, posthog.capture, gtag('event'), and fbq('track') calls whose properties carry no message, transcript, prompt, or health fields (an allowlist or scrub_user_input before telemetry); no ad pixels or session replay on chat pages; health-data transfers gated on vendor_registry baa == True or a stored consent or request record.

posthog.capture('message_sent', { message: input, mood: moodScore });

posthog.capture('message_sent', { length: input.length, turn, latency_ms: latencyMs });  // counts only, no text or health fields

Engineering guidance, not legal advice. Each provision below may add its own details (a cadence, a deadline, a required notice element): open it for those.