The Federal Trade Commission (FTC) is proposing a $7 million fine against Cerebral, a mental telehealth firm that it says not only was careless with patients’ data but actively shared it with third parties for advertising purposes. The company and its CEO, Kyle Robertson, are also accused of lying to customers about how their data is shared and of having a misleading cancellation policy.

The FTC notes that Cerebral shared the sensitive data “of nearly 3.2 million consumers” with third parties like LinkedIn, TikTok, and Snapchat through trackers on its website or apps — something the company admitted to last year. That apparently included details like home and email addresses, phone numbers, pharmacy and health insurance details, and medical history. Many of Cerebral’s ads were misleading, promoting ADHD treatment by, for instance, linking ADHD to obesity.