Photo credit: facebook/The Medical Futurist
Most health apps fall outside HIPAA, the federal law that protects records held by doctors, hospitals and insurers. As a result, your own settings and the app’s privacy policy do much of the protecting. The Federal Trade Commission also holds app makers to the promises they make about your data.
More than 350,000 health apps exist today. They log everything from heart rate and sleep to mood, cycles and glucose. A clinic holding those numbers faces strict federal rules. An app holding the same numbers generally does not.
What consumer apps share about you
Research shows why this matters. A 2019 study in JAMA Network Open tested 36 top apps for depression and smoking cessation. Of those, 81% sent data to Google or Facebook for advertising or analytics. However, only 43% of the apps sending data to Google disclosed it, and half of those sending to Facebook did.
Other studies point the same way. A BMJ analysis found 79% of 24 medicines apps shared user data, and 55 companies received it. Similarly, a review of 23 women’s health apps found 87% shared data with third parties.
Privacy settings worth a second look
First, check permissions. Location rarely matters for logging meals or sleep, so turn it off unless the app tracks a run. Next, revisit permissions once a month, because some apps keep collecting long after you stop using them. Also, limit linked accounts. Each connection gives another company a copy of your data.
On your phone, go one step further. iPhone users can block the advertising identifier through App Tracking Transparency. Android users can delete it in Settings. Both steps cover every app on the device. In addition, look for a Your Privacy Choices link inside the app or a Global Privacy Control setting in your browser.
Then read the policy for three things. Selling and sharing mean different things. A company can promise never to sell data while still passing identifiers to ad platforms. Next, look for a statement on whether health information builds ad audiences. Finally, find out what happens to your data if you leave or the company is sold. Vague wording about partners and affiliates is a warning sign. So is an all or nothing consent screen.
How to delete health data safely
Export first, because deletion is permanent. Then delete the account itself. Removing the app from your phone does not erase anything on company servers. Policies also differ on how long backups last. If the app offers auto delete, set it to 30 days.
Rules abroad give more control. The GDPR lets people in the EU and UK request a copy of their data and ask for erasure. In the US, some states such as Washington add protections for consumer health data.
Where clinical care fits in
Apps help you spot patterns, but they do not diagnose anything. Questions about symptoms belong with a clinician, whose records fall under HIPAA. Meanwhile, if a policy says one thing and the app does another, report it to the FTC at reportfraud.ftc.gov.
About the Author
