M.G. v. Therapymatch, Inc.

1                                                                         
2                                                                         
3                                                                         
4                      UNITED STATES DISTRICT COURT                       
5                     NORTHERN DISTRICT OF CALIFORNIA                     
6                                                                         
7    M.G.,                            Case No.  23-cv-04422-AMO           

8              Plaintiff,                                                 
                                      ORDER DENYING MOTION TO             
9          v.                         DISMISS                             

10    THERAPYMATCH, INC.,              Re: Dkt. No. 57                     
               Defendant.                                                 
11                                                                         

12                                                                         
13        This is a data privacy lawsuit alleging unauthorized interception and collection of 
14   information provided via an online platform for individuals to search for and connect with mental 
15   health providers.  Before the Court is Defendant’s motion to dismiss Plaintiff’s third amended 
16   complaint (“TAC”).  ECF 57.  The motion is fully briefed, and because it is suitable for decision 
17   without oral argument, the hearing set for May 22, 2025 is hereby VACATED.  See Civ. L.R. 7-6.  
18   This Order assumes familiarity with the facts and procedural history of this case.  Having read the 
19   papers filed by the parties and carefully considered the arguments therein, as well as the relevant 
20   legal authority, the Court hereby DENIES the motion for the following reasons.  
21   I.   DISCUSSION                                                       
22        On November 6, 2024, Plaintiff M.G. filed the operative TAC.  ECF 54.  On December 6, 
23   2024, Defendant Therapymatch, Inc. d/b/a Headway (“Headway”) moved to dismiss the TAC for 
24   failure to state a claim.  ECF 57.  Under Rule 12(b)(6) of the Federal Rules of Civil Procedure, a 
25   complaint may be dismissed for failure to state a claim for which relief may be granted.  Fed. R. 
26   Civ. P. 12(b)(6).  Rule 12(b)(6) requires dismissal when a complaint lacks either a “cognizable 
27   legal theory” or “sufficient facts alleged” under such a theory.  Godecke v. Kinetic Concepts, Inc., 
1   factual allegations depends on whether it pleads enough facts to “state a claim to relief that is 
2   plausible on its face.”  Ashcroft v. Iqbal, 

556 U.S. 662, 678

 (2009) (quoting Bell Atl. Corp. v. 
3   Twombly, 

550 U.S. 544, 570

 (2007)).  A claim is plausible “when the plaintiff pleads factual 
4   content that allows the court to draw the reasonable inference that the defendant is liable for the 
5   misconduct alleged.”  

Id. at 678

.                                     
6        When evaluating a motion to dismiss, the court “accept[s] factual allegations in the 
7   complaint as true and construe[s] the pleadings in the light most favorable to the nonmoving 
8   party.”  Manzarek, 

519 F.3d 1025, 1031

 (9th Cir. 2008).  However, “allegations in a complaint . . . 
9   may not simply recite the elements of a cause of action [and] must contain sufficient allegations of 
10   underlying facts to give fair notice and to enable the opposing party to defend itself effectively.”  
11   Levitt v. Yelp! Inc., 

765 F.3d 1123, 1135

 (9th Cir. 2014) (citations omitted).  The Court may 
12   dismiss a claim “where there is either a lack of a cognizable legal theory or the absence of 
13   sufficient facts alleged under a cognizable legal claim.”  Hinds Invs., L.P. v. Angioli, 

654 F.3d 14 846, 850

 (9th Cir. 2011).                                             
15        Headway moves to dismiss M.G.’s claims alleging violations of the Confidentiality of 
16   Medical Information Act (“CMIA”) and the California Consumer Privacy Act (“CCPA”).1  Each 
17   is discussed below.                                                   
18        A.  Confidentiality of Medical Information Act                   
19        M.G. alleges that Headway violated California Civil Code §§ 56.10, 56.06, and 56.101.  
20   Section 56.101 states that “[a]ny provider of health care . . . who negligently creates, maintains, 
21   preserves, stores, abandons, destroys, or disposes of medical information shall be subject to the 
22   remedies and penalties” provided under Section 56.36(b)-(c).  

Cal. Civ. Code § 56.101

.  Section 
23   56.10 prohibits “provider[s] of health care” from “disclos[ing] medical information regarding a 
24   patient of the provider of health care or an enrollee or subscriber of a health care service plan 
25   without first obtaining an authorization.”  Section 56.06 defines “provider of health care,” while 
26                                                                         

27                                                                         
    1 The Court granted Headway’s motion to dismiss M.G.’s CMIA claims in the first amended 
1   Section 56.10 dictates, in pertinent part, that a provider of health care “shall not disclose medical 
2   information regarding a patient . . . without first obtaining an authorization . . . .”  Section 56.36 
3   provides statutory damages of up to $1,000 for violations of the CMIA.  

Cal. Civ. Code § 4

   56.36(b)(1).  Headway argues the TAC fails to allege any medical information or records were 
5   transmitted to Google or that anyone viewed any medical information.  Mot. at 12-17.   
6        The CMIA defines “medical information” as “individually identifiable information . . . 
7   regarding a patient’s medical history, mental health application information, mental or physical 
8   condition, or treatment.”  

Cal. Civ. Code § 56.05

(i); see Eisenhower Med. Ctr. v. Superior Ct., 226 

9 Cal. App. 4th 430, 434

 (2014) (“ ‘[M]edical information’ as defined under the CMIA is 
10   substantive information regarding a patient’s medical condition or history that is combined with 
11   individually identifiable information.”).  “Mental health application information” means 
12   information “related to a consumer’s inferred or diagnosed mental health or substance abuse 
13   disorder . . . .”  

Cal. Civ. Code § 56.05

(j).  “This definition does not encompass demographic or 
14   numeric information that does not reveal medical history, diagnosis, or care,” and “the mere fact 
15   that a person may have been a patient at the hospital at some time is not sufficient” without 
16   “substantive information regarding that person’s medical condition, history, or treatment.”  
17   Eisenhower, 226 Cal. App. 4th at 435.  The use of a patient portal to “schedule appointments, 
18   refill prescriptions, and to view [] test results and appointment notes,” however, constitutes 
19   “medical history, diagnosis, or care.”  B.K. et al, v. Desert Care Network, Desert Regional 
20   Medical Center, Inc. et al, No. 223-CV-05021-SPGPDX, 

2024 WL 1343305

, at *5 (C.D. Cal. 
21   Feb. 1, 2024); see also Tamraz v. Bakotic Pathology Assocs., LLC, No. 22-CV-0725-BASWVG, 
22   

2022 WL 16985001

, at *5 (S.D. Cal. Nov. 16, 2022).                    
23        The Court previously dismissed M.G.’s CMIA claim because the FAC failed to allege 
24   “substantive information” regarding M.G.’s “medical condition, history, or treatment.”  Order at 5.  
25   M.G. has cured that deficiency in the TAC.2  Therein, M.G. alleges he provided Headway with 
26                                                                         
    2 M.G. filed a second amended complaint on October 16, 2024, asserting new factual allegations.  
27                                                                         
    ECF 49.  On October 29, 2024, the parties filed a stipulation requesting that M.G. be allowed to 
1   information about the symptoms he was experiencing, the mental health issues for which he 
2   sought treatment, the type of therapy he sought, his preferred type of therapy, and his preferred 
3   qualities for a therapist. TAC ¶¶ 11-12.  He avers that when prompted, he disclosed that “he was 
4   suffering from stress, trauma, and past abuse,” and “described his symptoms and indicated he was 
5   experiencing depression, anxiety, stress, and lack of sleep.”  TAC ¶ 11.  M.G. further disclosed 
6   that “his reasons for seeking mental health services and treatment were related to his stress at work 
7   and marital issues with his spouse.”  

Id.

  He also selected options indicating his preference for 
8   general therapy with a female therapist of color located in his area who offered online therapy 
9   sessions.  TAC ¶ 12.  These allegations constitute “substantive information” regarding M.G.’s 
10   “medical history, diagnosis, or care” as the CMIA requires.  See R.C. v. Sussex Publishers, LLC, 
11   No. 24-CV-02609-JSC, 

2025 WL 948060

, at *5 (N.D. Cal. Mar. 28, 2025) (finding information 
12   constituted “medical history, diagnosis, or care” where plaintiffs searched for therapists on website 
13   by selecting filters that reflected their symptoms, the type of therapy they sought, and their 
14   preferred gender, race, and faith for their therapist).  And because M.G. alleges he concurrently 
15   inputted individually identifiable information, including his name, address, cell phone number, 
16   age, marital status, ethnicity, religion, occupation, employer, income range, and insurance 
17   information, TAC ¶¶ 9-10, he has sufficiently alleged that he provided “medical information” as 
18   defined by the CMIA.  See St. Aubin v. Carbon Health Techs., Inc., No. 24-CV-00667-JST, 2024 

19 WL 4369675

, at *9 (N.D. Cal. Oct. 1, 2024) (finding disclosure of the reason patients booked a 
20   medical appointment and their identifiable information constituted disclosure of “medical 
21   information” under the CMIA).                                         
22        M.G. has also sufficiently alleged that his medical information was improperly viewed.  
23   Under the CMIA, a plaintiff must allege “the information was ‘improperly viewed or otherwise 
24   accessed.’ ”  Stasi v. Inmediata Health Group Corp., 

501 F. Supp. 3d 898

, 922 (S.D. Cal. 2020) 
25   (citing Regents of University of California v. Superior Court, 

220 Cal. App. 4th 549

, 553-54 
26   (2013)).  That is, a plaintiff must “show[] that an unauthorized party viewed the confidential 
27                                                                         
1   information.”  Vigil v. Muir Med. Grp. IPA, Inc., 

84 Cal. App. 5th 197

, 231 (2022).  The TAC 
2   alleges that Google accessed M.G.’s information and that of the putative class members, then 
3   “used [it] for its own purposes, including improving Google’s advertising and analytics services 
4   offerings and revenue,” TAC ¶ 123, by “measur[ing] the effectiveness of advertising and 
5   personaliz[ing] content and ads that one sees on Google’s and its partners’ sites and applications,” 
6   TAC ¶ 31; see also TAC ¶¶ 15, 42.  Accepting M.G.’s allegations as true and viewing them in the 
7   light most favorable to him, the Court finds M.G. has alleged that Google “viewed or otherwise 
8   accessed” his information in violation of CMIA.  Stasi, 501 F. Supp. 3d at 922; see also R.C., 
9   

2025 WL 948060

, at *5 (finding plaintiffs sufficiently alleged unlawful viewing where they 
10   alleged Google collected information and used it for its marketing and analytics services); Cousin 
11   v. Sharp Healthcare, 

702 F. Supp. 3d 967

, 975 (S.D. Cal. 2023) (denying motion to dismiss CMIA 
12   claim and finding it was “sufficiently plausible” that plaintiffs’ information was “viewed or 
13   otherwise accessed” as defined by the CMIA where plaintiffs alleged upon information and belief 
14   that “Meta regularly viewed” the information and that Meta’s business model involves using the 
15   information for targeted advertising).                                
16        Because the TAC plausibly alleges that Google viewed or accessed M.G.’s medical 
17   information, Headway’s motion to dismiss M.G.’s CMIA claim is DENIED.  
18        B.  California Consumer Privacy Act                              
19        Headway also moves to dismiss M.G.’s second cause of action for violation of the CCPA.  
20   Mot. at 17.  However, the Court already denied a motion by Headway to dismiss this claim, see 
21   Order at 14, and Headway cannot now raise an objection that was available to it previously, Fed. 
22   R. Civ. P. 12(g)(2) (“Except as provided in Rule 12(h)(2) or (3), a party that makes a motion or 
23   objection under this rule must not make another motion under this rule raising a defense or 
24   objection that was available to the party but omitted from its earlier motion.”); see also Niantic, 
25   Inc. v. Global++, No. 19-CV-03425-JST, 

2020 WL 8620002

, at *3 (N.D. Cal. Sept. 2, 2020) 
26   (noting a defendant “cannot bring a second motion to dismiss challenging a claim that is ‘based on 
27   substantially the same allegations in the amended complaint and the original complaint’ ”) (citing 
    1    (S.D. Cal. Aug. 15, 2019)).?  Although some courts have exercised their discretion to consider 
    2  || motions barred by Rule 12(g)(2) on the merits where it would serve the interests of judicial 
    3    economy, see LLE One, LLC v. Facebook Inc., No. 16-CV-06232-JSW, 

2019 WL 13201973

, at *4 
    4    (N.D. Cal. Apr. 25, 2019), Headway has not shown why such an exercise of discretion is 
    5  || warranted here.  Thus, Headway may not again challenge M.G.’s CCPA claim and its motion to 
    6  ||  dismiss that cause of action from the TAC is DENIED. 
    7  |  IL     CONCLUSION 
    8          For the foregoing reasons, Headway’s motion to dismiss is DENIED.  As Headway’s 
    9  || request for judicial notice corresponds to its motion to dismiss M.G.’s CCPA claim, it is thus 
   10  || DENIED as moot.  The Court SETS an initial case management conference for July 10, 2025. 
   11    The parties SHALL file a case management statement by noon on July 2, 2025. 
    12 

                 IT IS SO ORDERED. 

     14  || Dated: May 19, 2025                                            Wed      
   15                                                           coh: 
 2                                                         ARACELI MARTINEZ-OLGUIN 
a    16                                                    United States District Judge 

 =    17 

Z    18 
   19 
   20 
   21 
   22 
   23 
   24 
   25    3 Although M.G. did not list § 1798.150 in the heading of the cause of action in the FAC, he did 
   26 || discuss it in the body of the FAC, which was enough to put both Headway and the Court on notice 
        of his claim under that section.  See Mot. to Dismiss the FAC (ECF 20) at 13 (noting “Plaintiff 
   07    asserts .. . violations of §1798.150(a) of the CCPA .  . .”); Order at 14 (“Although M.G. lists only 
        CCPA subsections 1798.100(e) and 1798.81.5(b) in the heading of the cause of action, he includes 
        section 1798.150 in the body of the FAC. .. . Thus, the Court addresses whether M.G. has stated a 
   28                     . 
        Section 1798.150 claim.”).