You are the lawyer for a prominent investor in technology companies. Your client has contacted you to get your advice in connection with a new potential investment into a start-up company. The start-up is developing a mobile app directed at consumers. The purpose of the app is to assist these consumers in monitoring their overall mood, behavior, and wellness. The app will be marketed to these consumers through normal consumer marketing channels. In addition, employers are interested in making the app available to their employees because of ongoing concerns about the impact of the COVID-19 pandemic on employee mental and physical health. The app will collect data from the individual about the individuals’ daily activity, to inform a judgment (driven by artificial intelligence) as to the state of the individual’s well-being. The artificial intelligence component of the app will offer tips and other assistance to these individuals to support their mental health (and overall behavior) and may also offer other kinds of “wellness” products and services to these individuals based on the information stored on the app. The start-up is considering whether to include any external notification element in challenging situations, such as when the app indicates that an individual is suffering from significant depression.

Your client has been increasingly concerned about recent controversies on privacy issues and wants to understand the relevant legal principles and any reasonable risks related to this kind of product. She has asked you to prepare a memo for her company’s investment Board describing the relevant legal and practical concerns about privacy and data security for this mobile application. She wants to know what laws are relevant, what the major risks are, and how best the start-up company can protect itself against these risks. She wants to understand how various business partnerships that the start-up might have (data sources, data recipients and/or corporate customers) could impact the company’s risks and opportunities. She also is interested in what issues can arise if the app information is shared with employers to help them understand either individual employee health or information about the overall employee population