Sounds like they might have been sharing hashed emails and other identifiers with advertisers to execute retargeting campaigns:

> BetterHelp said its use of “limited, encrypted information” for targeting ads was an “industry-standard practice” for health-care companies. The company admitted no wrongdoing and it doesn’t share “names or clinical data from therapy sessions” with advertisers, according to a statement.