Smart-phone health apps pose security risks

You probably expect that calorie counter or mileage tracker to help, not hurt you. But according to a study by the nonprofit Privacy Rights Clearninghouse, nearly three-quarters of the 43 popular health and fitness mobile apps recently looked at posed a medium to high risk to users’ privacy.

The study found that 26 percent of the free apps and 40 percent of the paid versions didn’t have privacy policies at all, either in the app or on the developer’s website. And even some apps that had such policies failed to fully disclose the risks to users.

The free and paid apps, which the group did not identify, included pregnancy trackers, behavioral and mental health coaches, symptom checkers that can link users to local health services, sleep and relaxation aids, and personal disease or chronic condition managers. The apps, for Apple iOS and Android devices, were tested on two tablets and two smart phones.

Health and fitness apps aren't the only ones you need to be concerned about. For more information, read our report "How secure is your smart phone?"

The study found that many of the apps used unencrypted web connections and stored data in an unencrypted format on the mobile device. It also found that about a third of the apps sent data to someone not disclosed by the developer.

Free apps, which rely primarily on advertising to make money, were especially likely to have privacy issues. Forty-three percent of those shared personally-identifiable information, such as the user’s name, email address, and physical address, with advertisers, compared to only five percent of paid apps.

What to do

Research apps thoroughly before downloading; read the privacy policy, if there is one; and use a web search to find out what, if anything, others are saying about the app. If you don’t understand the technical mumbo-jumbo, ask a tech-savvy friend for help. When using an app, limit the sharing of personal information, if possible. Even with these precautions, assume that information may be distributed to the developer and third-party advertisers and marketers. Then use your judgment about whether you should download the app at all. If you stop using an app, delete it, along with your personal profile and any collected data, if given the option.

—Anthony Giorgianni