Myndgard

Blog · · 5 min read

Ten questions universities should ask a mental-health app vendor

A GDPR checklist for counselling services choosing a mental-health app: lawful basis, roles, data location, retention, security and tracking.

By Myndgard Limited · Updated

Banner reading: Ten questions universities should ask a mental-health app vendor

When a university brings in a digital mental-health tool, it is asking students to trust a third party with some of the most sensitive information they have. Under the GDPR, "data concerning health" is one of the special categories of personal data in Article 9, and processing it is prohibited unless one of a short list of conditions applies.

These ten questions are the ones we would want a counselling-service lead to ask in the first conversation, before any contract is drafted.

1. What is your lawful basis for processing health data?

A vendor should be able to name both its Article 6 basis and its Article 9 condition for each purpose, without hesitation. For a service students choose to use, this is often explicit consent under Article 9(2)(a). Other conditions, such as 9(2)(h) for health care, require a basis in law or a contract with a health professional and are subject to professional secrecy.

Ask to see the consent screens. Consent should be specific, recorded and as easy to withdraw as to give.

2. Who is the controller, and who is the processor?

This determines who answers to students and to the regulator. If the vendor is a processor acting on the university's instructions, Article 28 requires a binding contract that covers, among other things: processing only on documented instructions, confidentiality, security, help with data subject requests, deletion or return of data at the end of the contract, and audits. If the vendor is a controller in its own right, its privacy notice should say so and explain how it shares data with the university's clinicians. Either model can work, as long as both sides agree which applies.

3. Where is the data stored, and does any of it leave the EU?

Ask for the hosting region of the main database and backups, and for a list of every service that touches personal data, including email delivery, push notifications and error reporting.

If any data goes to the United States, ask how the transfer is covered. The EU–US Data Privacy Framework has been in place since the Commission's adequacy decision of 10 July 2023. On 3 September 2025 the EU General Court dismissed an action to annul it in Latombe v Commission, finding that the United States ensured an adequate level of protection when the decision was adopted. The Court also noted that the Commission must keep the framework under review and can suspend or amend it if US law changes. Mr Latombe appealed to the Court of Justice on 31 October 2025 (Case C-703/25 P), and at the time of writing that appeal is still pending.

The framework is valid today, but two previous EU–US arrangements were struck down by the Court of Justice. A vendor that keeps health data itself in the EU, and limits any US transfers to minimal operational data, is less exposed if the position changes.

4. Which sub-processors do you use, and how will we hear about changes?

Under Article 28(2), a processor may only engage another processor with the controller's prior written authorisation. Where that authorisation is general, the controller must be told of changes and be able to object. Ask for the current list and how changes are notified.

5. Have you done a Data Protection Impact Assessment?

Ireland's Data Protection Commission explains that a DPIA is required where processing is likely to result in a high risk to people's rights and freedoms. Its guidance lists sensitive data and vulnerable data subjects among the criteria, and says processing meeting two or more criteria will generally need one. A mental-health tool for students will usually meet both. Ask to see the vendor's DPIA, and expect to complete your own as well.

6. How long do you keep data, and what happens when a student leaves?

Ask for retention periods in days, not principles. What happens when a student deletes their account, when they graduate, and when the university's contract ends? How long until backups are overwritten?

7. Can students see, export and delete their own data?

Students have rights of access, erasure and data portability under the GDPR. A good tool lets them act on these rights themselves, without emailing a support address and waiting.

8. How is the data protected?

Encryption in transit should be a given. Ask whether sensitive content is also encrypted at rest at the application level, who can access it, whether access is limited to the clinicians assigned to a student, and whether that access is logged. Ask whether health information is kept out of logs, crash reports and notification text.

9. What happens if there is a breach?

The DPC's guidance is that organisations must notify it within 72 hours of becoming aware of a breach that poses a risk, and tell affected people without undue delay where the risk is high. Ask how quickly the vendor will tell the university, who your contact is, and whether they have rehearsed it.

10. Is there any advertising, analytics or tracking?

This deserves a direct question and a direct answer. In 2023 the US Federal Trade Commission alleged that an online counselling service had shared users' mental-health questionnaire answers and other data with advertising platforms after promising to keep them private. The final order, approved in July 2023, required it to pay $7.8 million and banned it from sharing health data for advertising. Ask whether any third-party software development kits run in the app, and what each one receives.

How Myndgard Share answers these

Updated 13 October 2026: our answers to each of these questions for Myndgard Share are set out in full in the Myndgard privacy policy, version 2.0.0.

What this means for counselling services

You do not need to be a data protection specialist to ask these questions. You do need clear, specific answers, in writing, before students are invited. A vendor that answers them easily has probably thought about them already. Bring in your data protection officer early, and treat the DPIA as a shared piece of work rather than a formality.

This article is general information, not legal advice.

Sources