This is the kind of acquisition announcement that deserves more than a press release skim.

On March 24, 2026, Cerebral announced it had acquired Inflow, the CBT-based ADHD app used by more than 300,000 people for symptom tracking, CBT modules, and daily ADHD management. Cerebral called it “expanding access to continuous care.”

What the press release didn’t mention up front: this is Cerebral’s first significant reentry into ADHD care since a 2022 scandal that ended with a $7 million FTC settlement for sharing users’ sensitive mental health data — without meaningful consent — with advertisers including Meta, TikTok, and Snapchat.

If you’re one of Inflow’s 300,000+ users, you have a legitimate reason to pause.

---

TL;DR

Question	Answer
Has Inflow changed yet?	No. Still operating separately for now.
What is Cerebral’s FTC history?	$7M settlement (2024) for sharing sensitive health data with advertisers
Is data sharing already planned?	Cross-referrals between the two platforms are built into the acquisition rationale
Should Inflow users panic?	No. But informed caution is warranted.
What should you do right now?	Read Inflow’s privacy policy, decide your risk tolerance, know the alternatives

Bottom line: The acquisition isn’t an immediate crisis. Cerebral’s track record is the context that makes it uncomfortable. You deserve to know both before your ADHD symptom data is three handshakes away from an ad platform.

---

What Cerebral Actually Did

Before anything else about Inflow, this part needs to be clear.

Between 2019 and 2023, Cerebral shared the sensitive health data of approximately 3.2 million consumers with third-party platforms including LinkedIn, Snapchat, TikTok, Google, and Meta. The data went out via tracking pixels (small bits of code embedded in Cerebral’s website and app). The information shared included contact details, medical histories, insurance data, and prescription details. This wasn’t a breach. It was a deliberate technical setup.

The FTC investigated. In April 2024, Cerebral agreed to a $7 million settlement: a $2 million civil penalty (reduced from a $10 million penalty because Cerebral claimed it couldn’t pay the full amount) plus $5.1 million in consumer refunds covering a separate complaint about deceptive cancellation practices.

The FTC also permanently banned Cerebral from sharing sensitive patient data with advertisers going forward.

That permanent ban matters here. Because Cerebral just acquired an app where 300,000+ people log their ADHD symptoms, track daily CBT progress, and document their mental health.

Cerebral says the ban covers them. It does — for advertising purposes specifically. What it doesn’t cover is how data flows internally between two products that are now under the same corporate roof, or how that data could be used for purposes defined broadly as “treatment” or “care coordination.”

What “Operating Separately For Now” Actually Means

Cerebral’s announcement says Inflow will “continue operating as a separate platform.” Fine. But the mechanism Cerebral explicitly described as the point of the acquisition tells a different story about long-term design.

The integration plan, per the announcement: Inflow members who want clinical support will now be referred to Cerebral’s therapists and psychiatrists. Conversely, Cerebral’s clinicians will be able to send patients into Inflow’s CBT modules for self-guided skill building.

That cross-referral system is the data sharing. The moment a Cerebral clinician refers you to Inflow, your clinical history from Cerebral and your app behavior from Inflow are now linked. The moment an Inflow behavioral module triggers a recommendation to see a Cerebral prescriber, your data flows the other direction.

“Operating separately” describes the branding. It doesn’t describe the data architecture of a unified care pathway.

This isn’t unique to Cerebral. Any acquisition in healthcare eventually involves this kind of integration. What makes it worth attention here is who the acquirer is.

The ADHD Telehealth Trust Problem

Cerebral’s acquisition didn’t land in a vacuum. The past 18 months have been rough for ADHD telehealth users who tried to access care digitally.

Done Global — a prominent ADHD telehealth platform — saw its founder and CEO Ruthia He convicted in November 2025 in a $100 million Adderall distribution and healthcare fraud scheme. The DOJ found that Done spent over $40 million on social media ads designed to convince people they had ADHD, then issued prescriptions with minimal clinical oversight — in some cases continuing prescriptions for patients who had died. Done and Cerebral are different companies. But both were high-profile entrants to ADHD telehealth, and both ended up in federal enforcement.

The DEA has extended telemedicine flexibilities for prescribing controlled substances through December 31, 2026, which keeps telehealth ADHD prescribing legal without a prior in-person visit for another year. That’s genuinely useful for the many ADHD adults who depend on it. But it also means the regulatory environment that enabled Done’s scheme is still technically in place, pending finalized DEA rules on special registration for telemedicine.

None of this means ADHD telehealth is categorically unsafe. It means the industry has earned a scrutiny it doesn’t always get in app store reviews.

What’s Actually Changing for Inflow Users Right Now

The honest answer: not much immediately.

The app still works. The CBT modules are still there. Your existing data is still under Inflow’s (now Cerebral-owned) privacy policy. Inflow hasn’t announced any feature removals, price increases, or mandatory account migrations as of this writing.

The changes that matter are structural and gradual:

Privacy policy: Inflow’s privacy policy is now subject to Cerebral’s corporate umbrella. Any future policy updates will come from a company that has a documented history of burying data-sharing disclosures. That doesn’t mean they will do it again — the FTC ban is real — but it means the fine print deserves attention it might not have required before.

Cross-referral pathways: If you interact with Cerebral’s clinical team through Inflow, your data starts moving across platforms. This is presented as a benefit. It is also the mechanism by which two separate behavioral health profiles become one.

Long-term platform independence: “Operating separately for now” is a temporary state. Every acquisition has an integration roadmap. What that looks like 12–18 months from now depends entirely on decisions made inside a company that has not historically prioritized user privacy as a design constraint.

What To Do if You’re Staying With Inflow

Staying is a reasonable choice. Inflow’s CBT content is well-regarded. The FTC ban on Cerebral using health data for advertising is enforceable. If Inflow is working for you, there’s no reason to abandon it based on an acquisition alone.

Three things worth doing regardless:

1. Read the current Inflow privacy policy at getinflow.io. Note what data categories are collected and who they can be shared with. Compare it against the policy six months from now. Changes matter more than the current text.
2. Don’t opt into Cerebral cross-referrals unless you want to. When the integrated care pathways appear in the app (they’re coming), engaging with them is a choice. So is not engaging. Keeping Inflow as a standalone CBT tool, without linking to Cerebral’s clinical services, is still available to you.
3. Keep an eye on the acquisition integration news. Behavioral Health Business and MobiHealthNews have both been covering this. If the privacy policy changes materially or the cross-platform data architecture becomes clearer, that’s when the calculus changes.

If You Want to Step Away From Inflow

The alternatives depend on what Inflow is actually doing for you.

If it’s the CBT modules you rely on:

The attexis trial data is the most compelling alternative in this space. A 337-person randomized controlled trial found that attexis — a digital CBT app for ADHD — produced effect sizes comparable to face-to-face therapy at 3 months. It’s CE-marked in Germany (covered by statutory health insurance as a DiGA) and available internationally through app stores. It’s not owned by a telehealth company with an FTC history.

If it’s the ADHD coaching and support layer:

Several AI ADHD coaching apps operate independently with no telehealth prescription component — which means no DEA compliance pressure, no clinical data to mishandle, and no cross-referral architecture to worry about. They do different things than Inflow, but if the CBT content was one layer in a larger stack, this is worth exploring.

If it’s the structured symptom tracking:

There are standalone ADHD symptom tracking tools that don’t attach to a telehealth platform at all. The tradeoff: no clinical referral pathway (which may be exactly what you want right now).

If you want a human therapist who specializes in ADHD CBT:

The BMJ umbrella review of ADHD interventions rated CBT as the most evidence-supported non-medication intervention for adults. An independent psychologist or ADHD-specialized therapist gives you the highest-quality version of what Inflow delivers digitally, without any corporate data infrastructure involved. CHADD’s provider directory is a starting point.

The Paragraph Cerebral Wants You to Skip

Here’s the part of the acquisition press release that matters most and gets the least attention:

Cerebral’s announcement describes the acquisition as “its first reentry into ADHD care since winding down its ADHD services in 2022.” That winding-down wasn’t a strategic pivot. It happened because Cerebral’s prescribing practices for controlled substances came under DEA scrutiny simultaneously with the FTC data investigation. The company pulled back from ADHD prescribing under regulatory pressure.

Now it’s back. Via an app with 300,000 users who have opted into a CBT program, not a telehealth prescription service. An app whose users have somewhat different expectations about what their data will be used for.

This might be entirely fine. Cerebral has changed its data practices under the FTC order. The management team has turned over substantially since the 2022 period. The FTC ban is ongoing.

But “companies change” and “this is exactly what happened before” are both true at the same time. Calibrating how much trust to extend is your call, not ours.

The Bottom Line

What should Inflow users do after the Cerebral acquisition?

1. Stay calm. The app hasn’t changed and the FTC ban on Cerebral sharing data for advertising is real and ongoing.
2. Read the privacy policy now and set a reminder to check it again in 90 days. Changes to policy language after acquisitions are how the fine print shifts.
3. Understand the cross-referral design. Inflow and Cerebral are built to funnel users between platforms. Using Inflow as a standalone CBT tool means not engaging with those pathways.
4. Know your alternatives. attexis for CBT, independent ADHD coaches, or a standalone therapist. None of these require trusting a company with an FTC data-sharing history.
5. Watch for integration news. The “operating separately for now” framing has a clock on it. Follow the coverage.

Inflow was a well-designed CBT app before this acquisition. That content didn’t change on March 24, 2026. What changed is who owns the data it generates, and what that owner’s track record looks like.

That’s worth knowing. What you do with it is up to you.

---

For ADHD users managing medication access and prescription continuity during telehealth uncertainty, separate from the Inflow question — that situation has its own complications worth tracking.