Mental Health App Terms And Privacy In NZ

Launching a mental health app is exciting, but it can also feel weighty. You're not just handling logins and subscription payments - you may be asking people to share mood patterns, medication notes, therapy goals, crisis signals or journal entries.

That means your terms and privacy documents need to do more than tick a box. They should help users understand what your app can and can't do, how their information is handled, and when a human professional or emergency service is needed instead.

The good news is that this doesn't have to be overwhelming. With the right legal foundations, you can launch with clearer user expectations, safer data practices, an information security policy and fewer surprises down the track.

Do Mental Health Apps Need Terms And Conditions In NZ?

Yes, if your app is available to users in New Zealand, you should have clear app terms and conditions before launch.

Your terms are the contract between your business and your users. They set out what users are allowed to do, what your app provides, what you don't promise, and what happens if something goes wrong.

For a mental health app, your terms should be more specific than a standard software app. Mental health tools can be misunderstood as clinical care, diagnosis or emergency support, even when they're designed for wellbeing, journaling, habit tracking or self-guided support.

Your app terms will usually cover:

• Who can use the app: age limits, account rules and whether users must be in New Zealand.
• What the app does: the actual features, such as mood tracking, chatbot support, guided exercises or appointment tools.
• What the app doesn't do: for example, no emergency response, no diagnosis, or no substitute for a registered health professional unless that's genuinely part of your service.
• User responsibilities: accurate information, safe use and not relying on the app in a crisis.
• Subscriptions and payments: renewal terms, cancellation steps and refund rules.
• Intellectual property: who owns the app, content, prompts, exercises and branding.
• Acceptable use: no misuse, scraping, reverse engineering or harmful content.
• Account suspension: when you can restrict or remove access.

Your terms also need to be easy for users to find and accept. For example, you might include a checkbox at sign-up saying the user agrees to your terms and privacy policy, rather than just placing a link in your footer.

What Privacy Laws Apply To Health Data In New Zealand?

The Privacy Act 2020 applies to personal information, and the Health Information Privacy Code 2020 adds extra rules for health information.

Mental health information is highly sensitive. If your app collects information about a user's mood, mental health symptoms, therapy history, medication, self-harm risk, appointments or clinician notes, you're likely dealing with health information.

That means you need to be clear about what you collect and why. You also need to make sure your collection, storage, use and sharing of information matches what you've told users.

In practice, your privacy policy should explain:

• what personal and health information you collect
• how you collect it, including through the app, integrations, cookies or wearable devices
• why you collect it, such as providing app features, improving safety, analytics or customer support
• who you share it with, including hosting providers, analytics tools, clinicians, payment processors or crisis support partners, and whether a health data sharing agreement is needed
• whether information is stored or accessed outside New Zealand
• how users can access or correct their information
• how long you keep information for
• what happens if there's a privacy breach

Under the Privacy Act 2020, users can ask to access their personal information. You generally need to respond to an access request within 20 working days, unless a valid extension applies.

If a privacy breach is likely to cause serious harm, you may need to notify the Privacy Commissioner and affected people as soon as practicable. For a mental health app, a breach involving therapy notes, crisis indicators or identifiable health data can become serious very quickly.

If your app connects users with registered health practitioners, you may also need to think about the Health and Disability Commissioner Code of Health and Disability Services Consumers' Rights. The exact position depends on what your app does and who provides the service.

How Should Your App Handle Consent?

Your app should get clear, specific consent before collecting or using sensitive mental health information in ways users may not expect.

Consent isn't just a buried sentence in a long privacy policy. For sensitive health data, it's usually better to use plain, timely prompts that explain what's happening at the point the user makes a choice.

For example, if your app asks a user to connect their wearable device, you might explain:

• what data will be imported, such as sleep, heart rate or activity
• how that data will be used, such as showing mood correlations
• whether it will be shared with any third party
• whether the user can disconnect the wearable later

Consent is especially important where you use information for:

• AI-generated insights or recommendations
• sharing information with a clinician, coach or employer programme, including through a consent form
• research, product development or de-identified analytics
• marketing based on health-related behaviour
• crisis escalation or welfare checks

Be careful with broad wording like, "we may use your data to improve our services" if you're using sensitive entries to train models or create behavioural profiles. Users need to understand the real use, not just the general category.

A Practical Example

Maya launches a New Zealand mood tracking app with 3,000 users. The app asks users to rate anxiety from 1 to 10 each day and write private journal notes. Maya wants to use anonymised journal data to improve a new AI feature.

Before doing that, Maya needs to check whether the data is genuinely de-identified. If the notes include names, workplaces, locations or unique incidents, there may still be a re-identification risk. A safer approach is to explain the improvement use clearly, let users opt in, and strip out identifiers before any analysis.

That extra consent step may feel slower, but it helps build trust with users who are sharing very personal information.

What Disclaimers Should A Mental Health App Include?

Your app should include disclaimers that accurately describe the limits of your service without overstating your protection.

Disclaimers don't let you avoid all responsibility, and they can't fix misleading marketing. Under the Fair Trading Act 1986, you must not mislead users about what your app can do. Under the Consumer Guarantees Act 1993, consumer-facing services may come with guarantees that can't simply be contracted out of for everyday consumer users.

Still, well-written disclaimers are very useful because they manage expectations and reduce risky reliance.

For a mental health app, consider disclaimers around:

• No emergency service: your app isn't monitored 24/7 unless it genuinely is.
• No diagnosis: your app doesn't diagnose mental illness unless qualified practitioners provide that service through the app.
• No substitute for professional care: self-guided content shouldn't replace medical, psychological or emergency advice.
• Accuracy limits: mood scores, AI outputs and wellbeing suggestions may be incomplete or inaccurate.
• User-generated content: journal entries, peer forum posts or messages are the user's responsibility.
• Third party services: links, integrations and app store payment systems may have their own terms.

Your disclaimers should match your product. If your marketing says your app "treats depression" or "detects suicide risk", a generic disclaimer saying the app is for wellbeing only may not be enough. The stronger your health claims, the more likely you need tailored advice on regulatory risk.

Crisis Support Wording

Crisis wording needs to be direct and visible. If your app isn't suitable for emergencies, say so during onboarding, in relevant features and in your terms.

For example, if a user enters a high-risk journal entry, your app might display a clear message that the app can't provide emergency help and that the user should contact emergency services or a crisis support service. You should also think carefully about whether your team will monitor, triage or escalate those entries. If you say you will, you need the people, process and records to back that up.

What Should A Mental Health App Privacy Policy Include?

Your privacy policy should explain your data practices in plain English, with extra care around health information, AI tools, overseas providers and data sharing.

A generic privacy policy template often misses the details that matter for healthtech. It may say you collect "personal information" without explaining mood data, journal content, risk indicators or clinician messages. That can create a gap between what users think is happening and what your business is actually doing.

Use this outline as a starting point, but have a lawyer or legal team tailor it before you use it.

1. Who You Are: identify your business, trading name and contact details.
2. What Information You Collect: list account details, health information, app activity, device data and payment data.
3. How You Collect It: explain direct entry, integrations, cookies, analytics, clinicians and support channels.
4. Why You Use It: cover app functionality, safety features, support, billing, improvement and legal compliance.
5. Health Information Handling: explain how sensitive mental health data is treated differently from basic account data.
6. Consent Choices: set out opt-ins, opt-outs and settings users can control.
7. Sharing And Disclosure: name the types of recipients, such as hosting providers, analytics tools, clinicians and crisis partners.
8. Overseas Storage Or Access: say if providers in other countries may store or access data.
9. Security: describe practical protections without promising perfect security.
10. Access And Correction: explain how users can request access or correction, including the 20 working day response point.
11. Retention And Deletion: say how long you keep account, health and backup data.
12. Privacy Breaches: explain how you'll assess, contain and notify notifiable breaches.
13. Children Or Young Users: explain age rules and any parent or guardian consent process.
14. Changes To The Policy: say how you'll tell users about meaningful updates.

If you use AI, add a clear explanation of whether human review is involved, whether outputs are personalised, and whether user data is used to train or improve models. Avoid promising that AI outputs are clinically accurate unless you've tested and validated that claim properly.

What Platform And Regulatory Rules Should You Check Before Launch?

You should check privacy law, consumer law, health regulation, app store rules and professional obligations before you launch.

App store review can be a real bottleneck for mental health apps. Apple and Google both scrutinise health-related apps, especially where an app gives health guidance, handles sensitive information, uses subscriptions, or may affect a user's wellbeing.

Before launch, check:

• App store rules: make sure your privacy disclosures, subscription flows, health claims and user safety processes match the platform requirements.
• Health claims: avoid saying your app diagnoses, treats or prevents a condition unless you can support that claim and have checked any regulatory obligations.
• Medical device risk: if your app is intended to diagnose, monitor or treat a medical condition, check whether it may be treated as a medical device. In New Zealand, medical device obligations can involve Medsafe requirements, including notification on the Web Assisted Notification of Devices database.
• Professional services: if registered practitioners provide care through the app, make sure their registration, scope of practice, record keeping and complaint processes are covered.
• Advertising: your website, app store listing and social media claims must be accurate and supportable under the Fair Trading Act 1986.
• Company and IP basics: check your company details on the Companies Office register, use your NZBN where relevant, and consider protecting your brand through IPONZ trade mark registration.

If your app is only a wellbeing tool, your regulatory position may be simpler. If it gives personalised clinical recommendations, alerts clinicians to risk, or connects users to therapy, the legal picture is more involved.

It's worth mapping your features before drafting the documents. Small product choices can change the legal wording you need.

How Do You Prepare Your Documents Before Launch?

You can prepare for launch by mapping your user journey, data flows and risk points first, then drafting documents that match the actual app.

Start with what users see and do. If the terms say one thing but the onboarding screens say another, users may be confused and your legal position may be weaker.

Pre-Launch Checklist

• Map each feature: mood tracking, journaling, AI chat, clinician messaging, community forums, wearable integrations and crisis prompts.
• List each data type: account details, mental health notes, usage data, device data, payment data and support messages.
• Identify each third party: hosting, analytics, payment processors, AI providers, customer support tools and clinical partners.
• Check consent moments: health data collection, AI use, data sharing, research, marketing and overseas disclosure.
• Review health claims: make sure website and app store wording doesn't overpromise.
• Prepare user-facing documents: terms, privacy policy, subscription terms, community rules, consent wording and any telehealth terms.
• Set internal processes: access requests, correction requests, breach response, user complaints and data deletion.
• Test crisis flows: decide what happens when a user indicates immediate risk and make sure your wording matches your actual response.

Templates can be a helpful starting point, but mental health apps aren't a place to rely on wording that doesn't fit your product. If your app handles sensitive information, uses AI, or involves clinicians, your documents should be tailored to your model.

Keep records of the decisions you make. For example, record why you collect each data point, who can access it, and when it's deleted. Those records will help if you later need to respond to a user, a platform review, a privacy incident or an investor due diligence question.

Key Takeaways

• Mental health app terms should clearly explain what your app does, what it doesn't do, and when users need professional or emergency support.
• The Privacy Act 2020 and Health Information Privacy Code 2020 are central when you collect mood, journal, therapy or other health information.
• Consent should be specific and easy to understand, especially for AI features, data sharing, research and wearable integrations.
• Disclaimers are useful, but they need to match your marketing and product features. They won't fix misleading health claims.
• Before launch, check app store rules, consumer law, health regulation, data flows and internal privacy processes.
• Your documents should be tailored to your app, especially if you use clinicians, AI, crisis prompts or sensitive user-generated content.

If you'd like help with your app terms, privacy policy, consent wording or healthtech launch checklist, you can reach us at 0800 002 184 or team@sprintlaw.co.nz for a free, no-obligations chat.