It’s not your responsibility to “protect” your users by snooping around what they reasonably expect to be private messages. (Regardless of what the UI calls them.)
That’s not only unethical, it might be illegal under HIPAA or other laws.
Hopefully I can figure out what your site is so I can stay far away from it with my medical information.