How to test a mental health app

01Direct answer

02What counts as a mental health app

A mental health app here means an iOS or Android app that delivers therapy, mood tracking or crisis support, collects health answers from consumers and may be used by minors. It counts when users log moods, journal, answer intake questionnaires or book sessions inside the app. An app where clinicians prescribe during video visits is out of scope, and so is the record system a therapy practice keeps its charts in.

Adjacent product types not covered here

• telemedicine app: A telemedicine app prescribes in live visits, so its risks include controlled-drug refills and appointment-slot load that a mood and therapy app does not carry.
• patient portal: A patient portal shows a provider's records under HIPAA access rules, while a mental health app often sits outside HIPAA and answers to consent and breach notice rules.
• wearable companion app: A wearable companion app collects heart rate and sleep from a paired band, so its risks sit in Bluetooth pairing and missed alerts rather than questionnaire answers and subscriptions.

03Risk map

04Mandatory tests (7)

1. 1

   Step 1: release smoke tests

   Why:store-rejection

   Done when: On the release build, a test user completes onboarding, logs a mood entry and opens a therapy session screen on the oldest supported phone.

   Tool class: mobile automation. Who usually runs it: QA engineer.

2. 2

   Step 2: end-to-end functional tests

   Why:money-lossregulatory-penalty

   Done when: A test user signs up, gives or refuses consent, books a session and cancels the subscription, and each choice shows in the account settings afterwards.

   Tool class: mobile automation. Who usually runs it: QA engineer.

3. 3

   Step 3: payment and money-flow testing

   Why:money-loss

   Done when: After a test user cancels in the app, the store or payment sandbox shows the subscription ended and no charge on the next renewal date.

   Tool class: API client. Who usually runs it: QA engineer.

4. 4

   Step 4: compliance checks

   Why:regulatory-penaltystore-rejection

   Done when: A reviewer confirms the consent screen names every third party that receives health data, the age gate blocks under-age sign-up without parental consent, and the store health declarations match the build.

   Tool class: test management. Who usually runs it: product manager.

5. 5

   Step 5: analytics and event tracking tests

   Why:data-breachregulatory-penalty

   Done when: A network capture of onboarding, mood logging and session booking shows no questionnaire answer, mood value or condition name sent to any advertising or analytics domain.

   Tool class: proxy. Who usually runs it: QA engineer.

6. 6

   Step 6: security scanning

   Why:data-breach

   Done when: The scan report for the app and API lists no open high-severity finding on the release date, and no journal or chat text is stored unencrypted on the phone.

   Tool class: SAST scanner. Who usually runs it: security specialist.

7. 7

   Step 7: penetration testing

   Why:data-breach

   Done when: A tester signed in as one user cannot read another user's journal, chat or intake answers by changing an ID in a request.

   Tool class: proxy. Who usually runs it: security specialist.

05Recommended and optional tests

• device and browser compatibilityrecommended

  Becomes mandatory when crash reports cluster on specific phone models or OS versions.

• exploratory testingrecommended

  Becomes mandatory when evidence links a missed crisis path in this kind of app to harm, or the app adds an automated chat that replies to users in distress.

• accessibility testingrecommended

  Becomes mandatory when the app is offered through an employer, insurer or public program that requires WCAG conformance.

• data integrity and migration testingrecommended

  Becomes mandatory when clinicians review mood history to adjust treatment.

• offline and poor-network testingrecommended

  Becomes mandatory when users report lost journal entries.

• unit testsoptional

  May help on the logic that decides which screens show crisis resources and which events go to analytics.

• regression suiteoptional

  May help once SDK updates and consent changes ship often and old tracking calls reappear.

• usability testingoptional

  May help find where users abandon onboarding or cannot find cancellation and crisis resources.

06Not needed and why

• contract tests

  Not needed while one team ships the app and its API together. Becomes recommended when an employer or insurer integration consumes the API.

• performance and load testing

  Not needed while usage is spread across the day with no booking peaks. Becomes recommended when live group sessions or scheduled launches concentrate users.

• localization testing

  Not needed while content ships in one language. Becomes recommended when a second language is added, since crisis numbers differ by country.

07Order of work

08Tools

Listed alphabetically inside each test type, filtered to the tests above and to the platforms of mental health app (ios, android). Not recommendations.

09What to send to the person who will test

Send the checklist and the brief below. The printable checklist for mental health app has the same 7 items with checkboxes.

Download the checklistMarkdownCSVBrief (Markdown)

Acceptance criteria wording

A release of the mental health app is accepted when a cancellation in the app ends the subscription with no charge on the next renewal date and each consent choice shows in account settings. No questionnaire answer, mood value or condition name reaches an advertising or analytics domain, an under-age sign-up without parental consent is blocked, and no journal or chat text sits unencrypted on the phone.

Brief

# Test brief: mental health app

Product type: mental health app. Therapy, mood tracking or crisis support delivered in an app.
Risk map and evidence: https://howtotestaproduct.com/how-to-test/mental-health-app/
Printable checklist: https://howtotestaproduct.com/checklists/mental-health-app/

Run these 7 mandatory tests in this order. A test is done only when its done condition is true on the build you will release.

1. release smoke tests (risks: store-rejection). Tool class: mobile automation. Usually run by: QA engineer.
   Done when: On the release build, a test user completes onboarding, logs a mood entry and opens a therapy session screen on the oldest supported phone.
2. end-to-end functional tests (risks: money-loss, regulatory-penalty). Tool class: mobile automation. Usually run by: QA engineer.
   Done when: A test user signs up, gives or refuses consent, books a session and cancels the subscription, and each choice shows in the account settings afterwards.
3. payment and money-flow testing (risks: money-loss). Tool class: API client. Usually run by: QA engineer.
   Done when: After a test user cancels in the app, the store or payment sandbox shows the subscription ended and no charge on the next renewal date.
4. compliance checks (risks: regulatory-penalty, store-rejection). Tool class: test management. Usually run by: product manager.
   Done when: A reviewer confirms the consent screen names every third party that receives health data, the age gate blocks under-age sign-up without parental consent, and the store health declarations match the build.
5. analytics and event tracking tests (risks: data-breach, regulatory-penalty). Tool class: proxy. Usually run by: QA engineer.
   Done when: A network capture of onboarding, mood logging and session booking shows no questionnaire answer, mood value or condition name sent to any advertising or analytics domain.
6. security scanning (risks: data-breach). Tool class: SAST scanner. Usually run by: security specialist.
   Done when: The scan report for the app and API lists no open high-severity finding on the release date, and no journal or chat text is stored unencrypted on the phone.
7. penetration testing (risks: data-breach). Tool class: proxy. Usually run by: security specialist.
   Done when: A tester signed in as one user cannot read another user's journal, chat or intake answers by changing an ID in a request.

Acceptance criteria wording:
A release of the mental health app is accepted when a cancellation in the app ends the subscription with no charge on the next renewal date and each consent choice shows in account settings. No questionnaire answer, mood value or condition name reaches an advertising or analytics domain, an under-age sign-up without parental consent is blocked, and no journal or chat text sits unencrypted on the phone.

Report back for each test: pass or fail against its done condition, the build or version tested, and the proof (screenshot, log line or report file).

Licence: CC BY 4.0.

For founders: what to forward and what to ask back. For product managers: turning this page into tickets.

10Questions about testing a mental health app

11Evidence

1. ev-0142regulatorprimary

   Proposed FTC Order will Prohibit Telehealth Firm Cerebral from Using or Disclosing Sensitive Data for Advertising Purposes, and Require it to Pay [amount], U.S. Federal Trade Commission

   The FTC complaint describes pharmacy and prescription information sent to third parties through tracking tools, a patient portal access method that exposed medications to other patients, a failure to block former employees from accessing medical records, and a cancel-anytime promise contradicted by a multi-step, often multi-day cancellation process during which consumers kept being charged. The first two transfer to pharmacy delivery apps; the cancellation finding transfers to any recurring subscription sold online.

   published 2024-04-15 · verified 2026-10-07

2. ev-0024regulatorprimary

   Children's Online Privacy Protection Rule (COPPA), U.S. Federal Trade Commission

   COPPA requires verifiable parental consent before collecting personal information from children under 13 on sites and apps directed to children or with actual knowledge.

   published undated · verified 2026-10-07

3. ev-0109regulatorprimary

   FTC Gives Final Approval to Order Banning BetterHelp from Sharing Sensitive Health Data for Advertising, Requiring It to Pay [amount], Federal Trade Commission

   Final FTC order against an online counseling service that sent email addresses, IP addresses and health questionnaire answers to ad platforms after promising privacy. Supports data-breach and regulatory-penalty for mental health apps whose intake questionnaire reveals the user's condition, and for telemedicine apps that run the same intake before a therapy visit.

   published 2023-07-14 · verified 2026-10-07

4. ev-0111regulatorprimary

   FTC Finalizes Changes to the Health Breach Notification Rule, Federal Trade Commission

   FTC rule update stating that health apps outside HIPAA are covered and that an unauthorized disclosure of identifiable health information counts as a breach that must be notified. Supports regulatory-penalty and data-breach for mental health apps and fitness apps that sell direct to consumers, and wearable companion apps, since the FTC ties the update to health apps and connected devices.

   published 2024-04-26 · verified 2026-10-07

5. ev-0170regulatorprimary

   Alcohol Addiction Treatment Firm will be Banned from Disclosing Health Data for Advertising to Settle FTC Charges that It Shared Data Without Consent, Federal Trade Commission

   Monument used the information to target ads for its services to both current users who subscribe to the lowest cost memberships and to target new consumers, according to the complaint.

   Enforcement against an online alcohol use disorder treatment service whose pixels and APIs sent intake and treatment events to ad platforms without consent. Supports data-breach and regulatory-penalty for telemedicine apps and for mental health apps, which collect the same kind of intake answers.

   published 2024-04-11 · verified 2026-10-07

6. ev-0001store-guidelineprimary

   App Review Guidelines, Apple

   Apple reviews every iOS, iPadOS and macOS App Store submission against these guidelines, including crashes and bugs at review, privacy disclosures, in-app purchase rules and extra rules for medical, financial and kids apps, and apps with user-generated content must let users report offensive content and block abusive users (guideline 1.2), and apps offering loot boxes or similar mechanisms must disclose the odds of each item type before purchase (guideline 3.1.1).

   published undated · verified 2026-10-07

7. ev-0110store-guidelineprimary

   Health Content and Services, Google Play

   We don't allow apps with health and medical related functionalities that are misleading or potentially harmful.

   Google Play policy for health apps: a health apps declaration is required, Health Connect data is personal and sensitive user data, apps regulated as medical devices must show clearance, and clinical service payments have their own rules. Applies to every health app distributed on Google Play, so it supports store-rejection for mental health, fitness and telemedicine apps and data-breach for fitness apps that read Health Connect.

   published undated · verified 2026-10-07

12Disclaimer

This page lists tests and risks for a product category, not for your product. Risks are attached only with the evidence shown in the Evidence section. Tools are listed alphabetically and are not recommendations. Nothing here is legal, regulatory or security advice; where a regulator or a store sets a requirement, their page is linked and takes precedence.