The only legal issue I could see is violation of privacy, but I bet their EULA covers them there.
Now, if they screw up bad enough, I could see it precipitating some new legislation that they might not like. Until then, I think they're in the clear.
It's another one of those situations where everyone is incentivized to "do something" whether it's actually helpful or not. "Student dies after symptoms of suicidal depression went ignored" is a splashy headline. "Student unable to graduate after involuntary psychiatric detention" is not.