Hacker News Reader

Comment by anigbrowl | Hacker News Reader

While I think there's definitely room for AI therapy as it can give people better results than many humans, if you don't have safety infrastructure in place (both psychological and patient data) you're walking off a liability cliff. Nobody with a clue would trust a startup with confidential mental health info, which means your customer pool is going to be made up of unstable people.

  Tell us about yourself
   First Name
   How was your childhood?
   What is your relationship status?
   What is your MBTI type?
   Where did you grow up?
   Where do you live?
   What is your criminal history?
   How often do you have drugs or alcohol?
   How is your family life?
   What is your religion?
   What is your highest level of education?
   What medication are you taking?
   Are you working?

This screams 'SCAM' to any normal person. The GoDaddy anonymous domain registration makes that even more likely. If this is a sincere effort to launch a business, start over and do your homework.

View on HN

There are insane amounts of laws surrounding ALL of this data with significant fines and prison time, varying by country.

Shut this down now before you get too much attention.

Right now, I store their data in redis and delete their session when they refresh or close the page.

The first questions I'd ask myself is probably, is that data properly encrypted? And is it properly anonymized?

What do you suggest as a solution?

Leave it to professionals (humans).

Absolutely. I will give support to anyone chasing a dream, but I will shut this down so hard.

Stop, re-evaluate, and understand there is significant potential, but depending on where you are, there could be prison time, man.

As far as medical therapy goes, sure. Otherwise I'm sure the OpenAI devs have in place proper filters for questions pertaining to sensitive personal data, or sensitive health related questions. There is nothing wrong in providing general "life advice" as it were, and then add a caveat such as "if your condition is serious, you should seek professional medical advice." Further more, I'm sure they have the extra cash on hand to hire medical professionals who can better formulate such caveats based on flagged inputs.

Personally I'm not a big fan of the EU, but they got one thing right, and that is the General Data Protection Regulation (GDPR).

Personal faith and religion, criminal history, and health related questions such as medication, drug and alcohol use, are all considered as highly sensitive personal data, which is protected under the regulation. Collecting and processing such data is subject to strict requirements and conditions under the GDPR, and requires a legal basis for processing sensitive personal data.

The other questions on the list may not necessarily conflict with GDPR on their own, though that depends on how they are collected, processed, and used. Specifically, since the questions are so broad, most if not all of those questions can be used to fish for secondary information, which can then be used for either illegal marketing, down right scams, or even provide third parties with means of discrimination, which are of course all completely illegal. As such, even otherwise "innocent" questions may also be regulated by the GDRP depending on how you handle them.

As a minimum, sensitive data should be securely encrypted in compliance with the regulation, and then stored only for the minimum required time for processing it. Excess personal data should not be stored at all, and even asking some questions — such as asking whether you're religious — might get you into a heap of trouble depending on how you handle or store that information, if at all.

I think you probably meant well, but as it looks now, I think you should look into the GDPR regulation and carefully consider how your implementation stacks up against it, and also carefully consider how you can build trust in the way you set up your site.

As of now, I wouldn't type anything into your site. But that's me. There might be people who do type stuff into your system, and then is made aware that it's something they should never have done. And that's where most serious legal problems may arise. It is thus in your best interest to carefully consider how such regulations might affects your site, and even if it might be considered to be outside of your jurisdiction.

There are also implications to consider when you send data to a third party's API that probably wasn't meant to handle such data, and that you yourself have no control over outside of the data you get back. You might thus be handing over sensitive data to a third party, where either you, or they, might be considered to handle or store it illegally. To me this represents a rabbit hole of legal problems, of which there are a ton of footguns for us small-time devs. So just make sure you thread carefully.

Reply on news.ycombinator.com