Online Mental Health Subscription Service Settles With FTC After ROSCA, Other Charges

The FTC sued Cerebral and its former CEO, Kyle Robertson, alleging they deceived users about the company’s data sharing and security practices and misled consumers about cancellation policies, said the Friday fraud complaint (docket 1:24-cv-21376) in U.S. District Court for Southern Florida in Miami.

The FTC claims Cerebral violated the FTC Act, Opioid Addiction Recovery Fraud Prevention Act and Restore Online Shoppers’ Confidence Act (ROSCA). Cerebral failed to clearly and accurately disclose material terms related to data privacy, data security and cancellation; failed to obtain consumers’ express informed consent relating to those terms; and failed to provide “a simple mechanism to stop recurring charges” in connection with the promotion or sale of online healthcare services, such as mental health treatment, medication management and substance use disorder treatment services, the complaint said.

Since 2019, Cerebral promoted or sold subscription telehealth mental health treatment and medication management services to “thousands” of patients with depression, anxiety and other ailments, the complaint said. The company matches and gives subscribers access to independent contractor providers who treat them virtually. In 2021 and 2022, it also dealt with addictive disorders, including opioid and alcohol use, it said. The company has reportedly raised "hundreds of millions of dollars” and been valued at $4.8 billion, the complaint said.

Cerebral has sold its service on a “negative option basis,” where consumers' silence -- failure to reject an offer or cancel an agreement -- was taken as consent to be charged for goods or services, the complaint said. The company has charged clients on a recurring basis for subscriptions that automatically renew monthly “unless clients successfully cancel before the end of their monthly billing cycles,” it said.

To deter subscribers from canceling, the company deliberately made the subscription cancellation process "burdensome and challenging, while taking millions of dollars from vulnerable consumers, including patients suffering from mental health problems," the complaint said. That included subscriptions consumers had asked to be canceled, the complaint said.

In its operations, Cerebral has routinely collected and stored personal health information (PHI) from consumers seeking treatment, including home and email addresses, birthdates and phone numbers; audio, images and videos of clients; medical and prescription history; religious and political affiliations and beliefs; sexual orientations; Social Security numbers and payment information; and information related to background checks, the complaint said.

Though Cerebral assures consumers that their PHI is protected and private, “at least during Robertson’s tenure” as CEO, it misrepresented the extent and purposes for which it would disclose “hundreds of thousands of patients’ personal information," said the complaint. The company “mishandled and exposed” those patients’ personal information and failed to provide patients with “a simple means to cancel their subscriptions and stop recurring charges,” the complaint said.

In its settlement notice, Cerebral said it agreed to implement “enhanced consumer protection, privacy, and compliance measures to further protect the personal information of our clients, increase transparency into our data practices, and implement enhanced data security protocols and tools to allow our clients control over their privacy settings.”

Cerebral was “transparent and fully cooperative” throughout the FTC’s investigation “and remains committed to providing excellent care for our valued patients while upholding the highest standards of customer service, data protection, and client privacy,” the statement said. The settlement allows the company to move forward with its mission to create a “new era of mental healthcare with a safe and secure platform” for its clients, it said.