I can't think of anything more horrifying that having therapy sessions leaked.

HIPAA was never a protection, quite opposite.

If the app and servers are based in the US, they will have an identification loophole somewhere in the supply chain.

They control the Internet backbones, the prominent operating systems, and the servers.

If they can pull a specific person's transcripts for court then the data isn't anonymized at all.