Staggering Number of Mobile Health Apps Harvest User Data

By Betty Joita

Posted on June 18, 2021

Smartphones and the apps that come along with them are now integral parts of our lives in more ways than one, health included. Most of these apps help us keep our bodies in check and for some, they are fundamental to their well being. However, is our health data as secure as we might think?

According to a research conducted by the Australian Macquarie University, which was published in The British Medical Journal, the answer is no, not really.

The study analyzed over 20,000 mobile apps from the Google Play Store, apps which required the users to disclose their health information. These apps ranged in type from step and calorie counters to menstruation trackers and symptom checkers.
It’s worth noting that, in addition to this information, the apps also require the users to provide them with their email, mobile number or even geolocation info, in some cases.

Muhammad Ikram, a lecturer at the Macquarie University Cyber Security Hub has stated that most of these apps, a staggering 88% of them, to be more exact are “using tracking identifiers and cookies to track user activities on mobile devices, and some of these applications are actually using tracking across different platforms.”

More than 87% of the data collection and 56% of the data transmission was on behalf of advertisers and tracking providers. Out of all this, around 23% of user data transmissions were found to take place via insecure communication channels.

While only about 4% of those apps actively transmitted the users’ data to third parties, the number is still considered substantial enough to raise concern.
Ikram went on to add that “Some of this information collected is used for tracking purposes and profiling purposes, which is done by third parties like advertisers and tracking companies and which is basically a form of data mining and this is done without user consent and it is being done explicitly and implicitly.”

The study found that around 28% of the apps did not even offer users the option to read through their privacy policy, while 25% of the data transmission was downright in violation with what was stated in any privacy rules.

While the report applauded the European General Data Protection Regulation for improving transparency around data collection from apps, Ikram stated that Australia on the other hand, lacked such policies regarding mobile health applications.

However, the study also found that just 1.3% of user reviews found any concerns regarding privacy.

Ikram insisted that the users should “look at their privacy policy link available on Google Play. If the app does have a policy link on Google Play, then they should use it, otherwise they should avoid installing those applications. Similarly, the users should also look into how these applications would be sharing the data and to whom they would be sharing the data so that they can have a general sense of what sort of privacy risks exist.”

The research soon made its way to Google, who responded via a spokesperson that the company’s “Google Play Developer Policies are designed to protect users and keep them safe. When violations are found, we take action. We are reviewing the report.”