Ward v. Mochi Health Corp.

Background

Kimberly Ward alleged that she used Mochi Health Corp.’s online weight-loss platform and that Mochi placed third-party tracking tools, sometimes called pixels, on its website. She alleged that the trackers collected sensitive health information and that Mochi used or shared the information for advertising and marketing.

Ward asserted ten claims: violation of the federal Wiretap Act; violations of California’s Invasion of Privacy Act provisions concerning wiretapping, eavesdropping and recording, and pen registers and trap-and-trace devices; breach of express contract; breach of implied contract; negligence; breach of fiduciary duty; bailment; and violation of California’s Comprehensive Computer Data Access and Fraud Act. Mochi moved to dismiss under the federal pleading rules.

Standing and Timeliness

The court held that Ward plausibly alleged an injury because the alleged collection of her sensitive health information without consent was sufficiently similar to an intrusion into private matters. She did not need to identify the specific medical conditions or medications allegedly collected. The court also found a plausible connection between Mochi’s use of trackers and the alleged harm.

The court further held that Ward plausibly alleged standing to seek an order requiring future changes. Although she believed Mochi still used trackers, the court said she might reasonably but incorrectly believe that the trackers had been removed, and the alleged previously collected data could still be used.

Some alleged events occurred more than one year before the lawsuit, and Ward had not adequately alleged when or how she discovered those claims. But the court held that her claims were still timely because she allegedly continued using Mochi’s website until May 2025, less than one year before filing, and each alleged collection of her data started a new limitations period.

Claims That Survived

The court held that Ward plausibly alleged a federal Wiretap Act claim. She plausibly alleged that the trackers intercepted the contents of communications and that the exception for conduct constituting a crime or tort could apply because Mochi allegedly disclosed and used her information for advertising contrary to its privacy-policy commitments.

The court also held that Ward plausibly alleged all three California privacy claims discussed in the order. For the California wiretapping claim, Ward plausibly alleged that Mochi aided third parties by installing the trackers and using the collected information. For the eavesdropping and recording claim, the court held that software can qualify as a device and that Ward plausibly alleged interception or recording of confidential communications made in a health-care setting. For the pen-register and trap-and-trace claim, the court held that the alleged collection of internet-request headers and internet-protocol addresses could qualify as collection of addressing information.

Ward’s express-contract claim survived because she identified privacy-policy provisions that allegedly prohibited using her information for marketing and sharing it with third parties for resale. The court also found that she plausibly alleged damages based on paying for services that were allegedly worth less because of weaker privacy protections.

Ward’s negligence claim survived. The court held that the Health Insurance Portability and Accountability Act, commonly called HIPAA, could provide a duty and standard of care under California’s negligence-per-se doctrine, even though HIPAA does not itself provide a private right to sue. Ward plausibly alleged that Mochi had a duty to protect patient information, breached that duty by disclosing protected health information without consent, and caused a loss of the benefit for which she paid.

The breach-of-fiduciary-duty claim also survived. The court held that Ward plausibly alleged that she entrusted confidential medical information to Mochi while obtaining health-care services and that Mochi therefore could have a duty to safeguard that information under either California or Ohio law.

Finally, the court held that Ward plausibly alleged a claim under California’s Comprehensive Computer Data Access and Fraud Act. She alleged damage or loss from not receiving a share of profits allegedly generated from her data and plausibly alleged that Mochi allowed third parties to access the data without permission. The court also declined to dismiss her requests for punitive damages and attorney’s fees at the pleading stage.

Claims Dismissed and Disposition

The court concluded that Mochi’s motion to dismiss was granted in part and denied in part. It dismissed the bailment claim because collecting personal information was not sufficiently similar to the traditional delivery of property for storage or another bailment purpose.

The conclusion also states that the “breach of implied warranty” claim was dismissed with leave to amend because Ward had not adequately explained why that claim could proceed alongside her express-contract claim. Earlier in the opinion, however, the claim is identified and analyzed as a breach-of-implied-contract claim. The order allows amendment because the court could not conclude that amendment would be futile.

The order states that all other claims survived dismissal. Ward could file an amended complaint by September 22, 2026, limited to correcting the identified deficiencies unless the court or the parties authorized more extensive changes. If she did not amend by that date, the claims dismissed in the order would remain dismissed with prejudice.