App Permissions and Cloud Storage of Health Data

What this page covers

Most wearables and health apps work in two parts: a device or phone app that collects readings, and a company server (the "cloud") where the readings are stored and analyzed. Permissions decide what the app can see on your phone. The cloud decides who holds the data afterwards. This page uses regulator guidance and enforcement records; it does not review any brand's settings, and we did not read phone-maker or device-maker help pages, so menu names and options are not described here.

Permissions

The FTC says some apps may ask for access to information from your device, such as your location, contacts or photos. It advises checking your phone's privacy settings to see what information apps can access, and considering turning off unnecessary permissions or deleting apps that ask for many permissions they do not need to function. [1]

Questions to ask for any permission:

• Does the app need this to do the thing I want? A step counter does not obviously need your contacts.


• Is location needed all the time, or only while the app is open? (The FTC notes you can choose not to share location. [1])


• Does the app request access to health records or other apps' data? This is a bigger decision than a one-off reading.

Default settings

The FTC says an app's default settings often encourage sharing, so it can be useful to select more protective options. [2] It also advises looking for a privacy notice that explains in simple terms what health information the app collects. [2] That advice dates from January 2021; app stores and settings pages have changed since.

Cloud storage

Storing data in the cloud lets you see trends across devices. It also puts your information on someone else's servers, under their security and their policies.

• Security failures are possible. The FTC alleged that a genetic testing company, 1Health.io (Vitagene), stored sensitive data in publicly accessible cloud storage "buckets". [3] This is one company's alleged failure, not a measure of cloud storage in general.
• A breach is not only a hack. The FTC's rule for health apps outside HIPAA treats an unauthorized disclosure as a breach, not only a data security breach. [4]
• Notice duties differ by company type. For businesses covered by the Health Breach Notification Rule, the FTC says the rule requires notifying affected consumers, the FTC and, in some cases, the media. [5] Whether a particular app is covered depends on what it is. See health data vs consumer-app data privacy.
• Where the data lives is a legal question. Washington's attorney general says an entity that only stores data in Washington is not a regulated entity under its health data law. [6] EU rules can apply to non-EU companies that offer services to people in the EU. [7]

A sensible, low-effort review

1. Look at each health app's permissions once, and remove those you do not need.
2. Check whether the app lets you limit sharing, and whether the default is sharing.
3. Know how to delete your data before you need to: see account deletion and exporting your data.
4. Think about whether the data is worth collecting at all; see why more data is not always better.

What this page does not say

We do not claim that any named device or app is safe or unsafe. There is no good public ranking of app privacy that we could verify, and none is given. If a privacy label or certificate is cited by a company, it is a marketing claim until you check who issued it.