"I expect they are deidentifying under safe harbor and reselling as much as possible."
You've hit the nail on the head. A key excerpt from Jane.app's privacy policy highlights the potential risks:
"Suppliers and Service Providers. In order to operate our business and provide the Services to our Subscribers and their users, we may need to share a limited amount of personal information, including Patient Data, with our third-party suppliers and service providers." [1]
Currently, I'm attempting to remove my clinical data from Jane.app's servers, but I don't have high hopes for success. Many if not most of these smaller psychology and therapy groups rely on these platforms to store patient data. It is infuriating to me that the moment we disclose the most intimate details of our lives, they become permanent record.
"Removing Data from Jane. Practitioners offering health and medical services are under legal obligation to retain health or medical information that was collected during the course of treatment. It is their responsibility, in collaboration with the Jane Subscriber (clinic owner), to maintain these records, and in many cases, they are simply not allowed, under law, to delete certain records that they created, and they must retain records for a number of years, sometimes 10 years or more." [2]