The digitalization of mental health care generates new ways of recording and processing information about an individual's mental state, which reveals a mismatch between the sensitivity of such information and the scope of its legal protection: existing regulation links the extent of safeguards primarily to the manner in which information is obtained and the legal status of the entity processing it, whereas the degree of interference with private life is determined by the content of the information itself and its capacity to reveal an individual's inner mental sphere. Drawing on Russian legislation and legal scholarship, the article substantiates the independent significance of mental privacy as a legal category defining the content and limits of an individual's right to protection of the inner mental sphere; criteria are proposed for determining when information falls within this sphere, and it is established that the regimes of medical confidentiality and personal data protection do not exhaust the mechanisms of its legal protection. The need for additional safeguards in the digital processing of such information is substantiated, including requirements concerning the disclosure of information to the individual, the purposes and duration of data use, and the conditions of third-party access.