M.G. v. Therapymatch, Inc.

Background

The opinion describes this as a data-privacy lawsuit. Therapymatch, Inc., doing business as Headway, operates an online platform that lets users search for mental-health providers based on preferences such as language, race, ethnicity, and gender. According to the First Amended Complaint, Headway embedded Google Analytics code on its website. M.G. alleged that Google intercepted information he entered or generated while using the platform, including his name, address, phone number, health-insurance information, employer, searches related to two unspecified mental-health conditions, provider preferences, and appointment details.

M.G. filed a putative class action asserting six claims: violations of the California Confidentiality of Medical Information Act; aiding and abetting a violation of that Act; aiding and abetting unlawful interception under the California Invasion of Privacy Act; unlawful recording or eavesdropping under that Act; invasion of privacy under the California Constitution; and violations of the California Consumer Privacy Act. Therapymatch moved to dismiss the entire First Amended Complaint for failure to state a claim. On such a motion, the court generally accepts the complaint’s factual allegations as true and asks whether they plausibly support a legal claim.

Rulings on the Claims

Confidentiality of Medical Information Act

The court granted the motion to dismiss M.G.’s claims under the California Confidentiality of Medical Information Act, including the aiding-and-abetting claim. The court held that the complaint’s sparse and generalized allegations did not allow it to determine whether M.G. had shared, and Headway had disclosed, substantive medical information about his medical condition, history, or treatment. The court’s conclusion applied to the underlying claim and, because that claim was dismissed, to the aiding-and-abetting claim as well. The conclusion states that these claims were dismissed with leave to amend.

California Invasion of Privacy Act, Section 631

The court denied the motion to dismiss the claim alleging that Headway aided and abetted an unlawful interception under Section 631 of the California Invasion of Privacy Act. The court concluded that the alleged information about the mental-health conditions for which M.G. sought therapy, his provider preferences, and appointment details could constitute the content of communications, rather than merely information about the communications. The court also accepted, at this stage, the allegation that Google intercepted the information in real time while it was being transmitted. Finally, the court found that M.G. alleged facts supporting his theory that Headway knowingly used and embedded Google Analytics and allowed Google access to users’ private information.

California Invasion of Privacy Act, Section 632

The court denied the motion to dismiss the claim under Section 632, which addresses intentionally recording or eavesdropping on confidential communications without the consent of all parties. Given that M.G. entered mental-health concerns and therapist preferences on a mental-health platform, the court found it reasonable at the pleading stage for him to expect that the communications would not be simultaneously shared with an undisclosed observer. The court also rejected Headway’s argument that the allegations targeted only Google, because the complaint alleged that Headway permitted Google to eavesdrop on or record users’ communications.

California Constitutional Privacy Claim

The court denied the motion to dismiss M.G.’s California constitutional privacy claim. It concluded that Headway had not shown that the alleged disclosure of provider preferences, appointment details, and mental-health searches could not amount to a serious invasion of privacy. The court did, however, dismiss the claim to the extent M.G. sought money damages, because it concluded that money damages were unavailable for this claim. The court allowed the claim to continue insofar as M.G. sought disgorgement of profits, while noting that he might not ultimately recover that remedy.

California Consumer Privacy Act

The court dismissed with prejudice M.G.’s California Consumer Privacy Act claims brought under Sections 1798.100 and 1798.81.5. The court explained that the Act’s private cause of action applies only to the violations described in Section 1798.150(a) and cannot be based on violations of other sections.

The court denied the motion to dismiss the Section 1798.150 claim. It rejected Headway’s argument that a traditional data breach was required, explaining that courts have allowed such claims to proceed where a plaintiff alleges unauthorized disclosure of personal information resulting from inadequate security practices. The court found that Headway had not shown that M.G.’s allegations were insufficient under that section.

Disposition

The court granted in part and denied in part Therapymatch’s motion to dismiss. The Confidentiality of Medical Information Act and related aiding-and-abetting claims were dismissed with leave to amend. The court denied dismissal of the remaining claims, subject to the dismissal of the constitutional privacy claim’s money-damages request and the dismissal with prejudice of the California Consumer Privacy Act claims under Sections 1798.100 and 1798.81.5. Any amended complaint had to be filed by October 16, 2024, and no additional claims or parties could be added without the defendants’ agreement or court permission.