The policy describes encryption, security monitoring and HITRUST certification
BetterHelp says it applies industry standards and strives for best practices while acknowledging inherent internet-service risk. It describes HITRUST certification, a security team and internal tests, 256-bit member/therapist message encryption, multiple Tier 3 AWS centers, modern TLS, encrypted/scrambled databases, and automated/human monitoring with security personnel on a 24/7 rotation. These are the policy’s stated measures, not a guarantee against incidents.
Details not recorded for this card
Supporting quotations
We apply industry standards and strive to apply best practices to prevent any unauthorized access and disclosure. Internet-based services carry inherent security risks
Our Platform is certified by HITRUST - one of the most recognized data security certification programs in the health industry.
We have an Information Security team who test internal security at BetterHelp to try and anticipate threat actors and act defensively to build processes and infrastructure to prevent incidents and attacks.
All messages between a Member and their Therapist are secure and have 256-bit encryption.
Our servers are distributed across multiple Tier 3 AWS Data Centers for optimal security and protection.
Our browsing encryption system (TLS) follows modern best practices.
Our databases are encrypted and scrambled rendering them useless in the unlikely event that they are stolen or inappropriately retrieved.
We have robust monitoring and alerting systems and procedures in place that include both automated systems and humans. For example, there are always security personnel active in our 24/7 rotation.
BetterHelp says it will not seek credentials in insecure or unsolicited messages
The policy says BetterHelp will never request login or credit-card information through non-secure or unsolicited communications. It advises checking that account information is entered in its secure system.
Details not recorded for this card
Supporting quotations
We will never request your login information or credit card information in any non-secure or unsolicited communication. You should always be diligent when you are asked to provide your account information and make sure it is in our secure system.
Security & Safeguards · Permission or license
Suspected immediate danger or privacy infringement may prompt investigation or contact
If BetterHelp has reason to believe someone may be in immediate danger or privacy has been infringed, it may use information to investigate or contact the individual or appropriate authorities where legally appropriate/permitted. The permission depends on the stated concern and legal condition.
Details not recorded for this card
Supporting quotations
For example, if we have reason to believe that you or any other person may be in immediate danger or your privacy has been infringed upon, we may use the information to investigate or reach out to you or the appropriate authorities if it is legally appropriate/permitted to do so.
Security & Safeguards · Company practice
Security processing supports access controls, fixes and abuse detection
BetterHelp may process data for account access controls/challenges, security patches and bug fixes, abuse tracking, incident prevention/detection, protection against malicious, deceptive, fraudulent or illegal activity, and prosecution of those responsible. This describes purposes, not a guarantee that breaches cannot occur.
Details not recorded for this card
Supporting quotations
For example, we process certain data to make sure only you are able to access your account, and to place controls or challenges to prevent unauthorized access.
We may also process some of your data when issuing security patches and bug fixes in order to address security risks.
We may also process your data to track potential abuse on the platform, prevent and detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity, or prosecute those responsible for such activities.
Security & Safeguards · Company practice
Emergency address and IP-derived location serve different needs
BetterHelp processes an address supplied as emergency-contact information at therapy start to meet therapy regulations and ethical requirements and for potential immediate-danger situations. Rough IP location may help autocomplete it. ReCAPTCHA also processes IP-derived rough location to identify potentially malicious visitors. This sits alongside the policy promise not to request or process exact GPS location.
Details not recorded for this card
Supporting quotations
Your contact information is required to comply with therapy regulations and ethical code. It can be used, for example, in case your Therapist believes you are in immediate danger. When you are filing out this field, we may process your rough location to provide autocomplete suggestions for your convenience.
Rough location using your IP address is also Processed by the ReCAPTCHA security API tool we use. ReCAPTCHA is a Service Provider we use to identify potentially malicious actors trying to access our site.
We do not request or process exact location information such as information provided by your phone via GPS.