I would love to disclose my extremely disturbing and potentially violent intrusive thoughts to an application with a completely murky privacy policy...
Looks like you have to login and your private medical data is stored "in the cloud." I have no idea why anyone would think this would be a good idea. Storing it locally would be the only remotely sane solution.
I mean, I don't mind telling someone I have an anxiety disorder (and I do have one). But the content of some of those intrusive thoughts is something I don't want anyone to know. Especially not some startup who may sell their company to, say, Facebook one day. Some of my intrusive thoughts are things that I did wrong (10 years ago...). So logging them would mean a third party would have an entire database of almost every mistake I made in my life, out of context. The potential for that to go wrong is... extreme. I'd rather have nudes be leaked.
And the stupid embedded video in a jQuery modal. Stop it, you're making your videos unusable. Let me pause. Oh wait, I can't. I need to pause the video because it runs at lighting speed, so fast it is impossible to gain any information at all from it unless you pause it.
The website rendered so badly on my phone I went to go check out how it looked on the desktop. Well, the video pause issue is fixed... (I still think putting a video in a jQuery modal is incredibly annoying...just embed the video)
You need to fire your "usability consultant." Your color scheme is absolutely horrible for anyone who is older or with less than perfect vision. It is very difficult to read for me.
Any time your as yourself "should I display my -main content-* in white text" the answer should be no. Doublely so if you your background is light pastel green.
Light grey on white is another combo that is extremely hard to read. So is white on very light picture of a beach.
Animated backgrounds(?) (The background is not animated in my mobile browser) are not only are incredibly distracting, but also actually, ironically, cause anxiety for me. I'm sure I'm not the only one.
I know different people have different preferences, but at LEAST give your color scheme some halfway sane contrast. And fix the rendering errors on mobile. Both issues, besides affecting usability, make you look amateurish. In my opinion.
*not saying you should never use white text, ever. Just not in paragraph form.
In addition, it obviously isn't enough to just say that "we take privacy very seriously," although we do. While we don't store Protected Health Information, we treat the data we do store as such and are taking the same steps to protect users' data that we would have to if we were.
As mentioned in another comment, PHI is defined as something that originates from a healthcare provider. Some of the restrictions for what we can say the app does actually come from the FDA. We don't say that we treat specific anxiety disorders (we call it "stress and anxiety"), and we don't ask our users for that type of information. But it really is a bit of a grey area. It's something that we're acutely aware of though and are trying to follow all the guidelines we can find.
Emails are often trivially linked to identity. It doesn't matter that someone could have generated an "anonymous" email address (I've very skeptical that user-provided email addresses would pass muster as de-identified identifiers), if you can use that email to communicate with the person, it's definitely linked to their identity. If they link the email address to their identity elsewhere, the burden is still on you, not the user. You cannot demand that users protect the email address they use to sign up for your service the same way they would protect a social security or medical record number. That's ridiculous.
You should look into obtaining HIPAA/HITECH compliance training perhaps as an unaffiliated learner on https://www.citiprogram.org/ to understand why those of us that work in health care are expressing concern.