Digital Health Data Privacy
Which privacy laws cover health apps and which do not, what the US FTC alleged in four app cases, what a 2019 study found about app data sharing, and what to check.
Content last updated . This page has not been medically reviewed.
Quick answer
Health information in an app is not automatically protected by the best-known health privacy law. In the United States, HIPAA applies to certain organizations, and many consumer apps are outside it. Other rules apply instead, and they differ by country and state. This page describes what the official sources say. It is information only and not legal advice; laws change, so check the official sources linked below.
Who is covered by what
| Rule | Jurisdiction | Who and what it covers | Official source |
|---|---|---|---|
| HIPAA Rules | United States (federal) | Health plans, certain health care providers and clearinghouses (covered entities), and companies that handle protected health information for them. [1] | FTC business guidance, read 2026-10-22; the HHS pages were not readable (HTTP 403) |
| FTC Act | United States (federal) | Applies to health data practices beyond HIPAA; an app's collecting, using or sharing of health information must not be unfair or deceptive. [1] | FTC |
| Health Breach Notification Rule | United States (federal) | Vendors of personal health records, related entities and third-party service providers, which are outside HIPAA. It requires notice to affected consumers, the FTC and in some cases the media after a breach. [1] The FTC finalized changes on April 26, 2024, stating that the rule applies to health apps and similar technologies not covered by HIPAA. [2] | FTC |
| My Health My Data Act | Washington State | The state attorney general describes it as the first privacy-focused law in the country to protect personal health data outside HIPAA. [3] | Washington Attorney General |
| GDPR, Article 9 | European Union | Data concerning health is a "special category" subject to specific processing conditions, such as explicit consent or other listed grounds. [4] | European Commission |
This table is not a full map. State laws other than Washington's, and rules in other countries, were not read for this page, so they are not verified here.
What the FTC alleged in four app cases
In each case below, the FTC alleged that a company shared health information despite privacy promises. Each led to an FTC order or a proposed order. These are the FTC's statements, not independent findings.- Flo Health (period and fertility app). On January 13, 2021, the FTC said Flo promised to keep health data private and use it only to provide the app's services, but did not stop disclosing the data until a news article in February 2019. The settlement required an independent privacy review, user consent before sharing health information, and notice to affected users. [5]
- GoodRx. On February 1, 2023, the FTC said GoodRx agreed to a $1.5 million civil penalty for violating the Health Breach Notification Rule. It alleged unauthorized disclosure of health information to Facebook, Google, Criteo, Branch and Twilio, and the order permanently prohibits sharing user health information with applicable third parties for advertising. [6]
- BetterHelp (online counseling). On March 2, 2023, the FTC said BetterHelp had promised it would not use or disclose personal health data except for limited purposes, yet shared email addresses, IP addresses and health questionnaire information with Facebook, Snapchat, Criteo and Pinterest. [7] The order was finalized on July 14, 2023, with $7.8 million payable and a ban on sharing health data for advertising. [8]
- Premom (ovulation tracking app). On May 17, 2023, the FTC proposed an order requiring a $100,000 civil penalty for violating the Health Breach Notification Rule, alleging that users' sensitive health data was disclosed to AppsFlyer and Google. [9]
The dates above are the dates of the announcements. A company's present practices may differ.
What research found about how apps handle data
A 2019 JAMA Network Open study checked 36 top-ranked depression and smoking-cessation apps in the US and Australia in 2018. 25 apps (69%) had a privacy policy, but data transmission to a third party was detected in 33 of 36 apps (92%). Twenty-nine apps (81%) sent data for advertising, marketing or analytics to just two companies, Google and Facebook, and only 12 of the 28 sending data to Google disclosed it. [10] It describes apps as they were in 2018, so it shows how disclosures and behavior can differ, not what any app does today.What to check before using a health app
- Who is the company, and which law covers it? A medical provider's portal and a consumer wellness app can fall under different rules, as the table shows.
- What happens to your data? The UK regulator (MHRA) suggests asking how data is stored and used, because these tools often collect very sensitive personal information. [11]
- Read the permissions and the sharing settings: see app permissions and cloud storage of health data and who is covered by privacy law.
- Genetic and location data carry extra concerns; see genetic and location data privacy.
- Think before uploading lab results to an AI tool: uploading lab or genetic results to apps and AI.
For the broader emerging-technology view, see health data privacy in emerging technologies.
Limits
This page does not rank apps and does not say any app is safe. A privacy policy shows what a company says, not what its software does. Laws outside the jurisdictions in the table were not verified.Frequently asked questions
Does HIPAA protect everything I put in a health app?
No. The FTC says the HIPAA Rules apply to covered entities and the companies that handle protected information for them. [1] Many consumer apps fall under other rules, such as the FTC Act and the Health Breach Notification Rule. [1]
What did the FTC do about apps sharing health data?
It brought cases including Flo Health, GoodRx, BetterHelp and Premom, alleging disclosures to advertising and analytics companies despite privacy promises. [5][6][8][9]
Is health data treated specially in Europe?
Under the GDPR, data concerning health is a special category with specific conditions for processing, such as explicit consent. [4]
Do mental health apps share data?
Some did in one 2018 study: 33 of 36 depression and smoking-cessation apps transmitted data to third parties. [10] That is a study of a sample of apps, not all apps.
Is this legal advice?
No. It summarizes what regulators and one law's official page say, read on 2026-10-22. Laws change, so check the current official text.
References
- Federal Trade Commission. Business guidance (page date August 2024, as shown on the page). Collecting, Using, or Sharing Consumer Health Information? Look to HIPAA, the FTC Act, and the Health Breach Notification Rule. Read 2026-10-22.
- Federal Trade Commission. Press release, April 26, 2024. FTC finalizes changes to the Health Breach Notification Rule. Read 2026-10-22.
- Washington State Office of the Attorney General. Protecting Washingtonians' Personal Health Data and Privacy. Read 2026-10-22.
- European Commission. Legal grounds for processing data (additional rules for special categories, including health data). Read 2026-10-22.
- Federal Trade Commission. Press release, January 13, 2021. Developer of popular women's fertility-tracking app settles FTC allegations it misled consumers about the disclosure of their health data. Read 2026-10-22.
- Federal Trade Commission. Press release, February 1, 2023. FTC enforcement action to bar GoodRx from sharing consumers' sensitive health info for advertising. Read 2026-10-22.
- Federal Trade Commission. Press release, March 2, 2023. FTC to ban BetterHelp from revealing consumers' data, including sensitive mental health information, to Facebook and others for targeted advertising. Read 2026-10-22.
- Federal Trade Commission. Press release, July 14, 2023. FTC gives final approval to order banning BetterHelp from sharing sensitive health data for advertising. Read 2026-10-22.
- Federal Trade Commission. Press release, May 17, 2023 (proposed order). Ovulation tracking app Premom will be barred from sharing health data for advertising under proposed FTC order. Read 2026-10-22.
- Huckvale K, Torous J, Larsen ME. JAMA Netw Open. 2019;2(4):e192542. PMID 31002321. Assessment of the data sharing and privacy practices of smartphone apps for depression and smoking cessation. Read 2026-10-22.
- Medicines and Healthcare products Regulatory Agency (UK). Press release, 27 January 2026. MHRA issues new guidance for people using mental health apps and technologies. Read 2026-10-22.
Education, not medical advice. This page is for general information. It does not diagnose or treat any condition and is not a substitute for care from a qualified health professional. Natural does not automatically mean safe. Ask a clinician or pharmacist before changing your care, especially if you take medication, are pregnant or breastfeeding, or have a health condition.