New health apps are popping up every day, promising to help you track your health conditions, count your calories, manage your medications, or predict your ovulation. These apps often ask for some of your most sensitive personal information, like your health history, medication list, or whether you have ever suffered a miscarriage.
Some apps use that sensitive information only to give you services. But others may use it for their own research, to target you with ads, or disclose — or even sell — your data to other companies. And, unlike your doctor, these apps may not be covered by health privacy laws like HIPAA.
For example, Flo is a health app that functions as an ovulation calendar, period tracker, and pregnancy guide. In a settlement announced today, the FTC said that the makers of the Flo app shared users’ personal health information with marketing and analytics companies like Facebook and Google — even though it had promised users to keep this sensitive information private. As part of the settlement, Flo Health, Inc. has agreed to get users’ consent before it can share their information in the future. The settlement also requires Flo to get an outside review of the honesty of its privacy promises.
How can you avoid the risks associated with these types of health apps? Here are some things to consider:
- Compare privacy protections. Many competing health apps offer similar services. When choosing between apps, compare their privacy protections. Look for a privacy notice that explains in simple terms what health information the app collects from you, as well as how it uses and shares your information with other companies and users. If the app shares your information, does it tell you why, and does it limit what others can do with it?
- Take control of your sensitive information. Take a look at the app’s settings to see if it gives you control over what health information it collects and shares. An app’s default settings often encourage sharing, so it can be useful to select more protective options.
- Keep your app up to date. App updates sometimes include important fixes for privacy or security glitches. One of the best ways to protect your information is to keep your app (and your phone’s operating system) up to date.
- Recognize the risks. What sensitive information will the app have access to? Are the app’s services worth the risk of someone else getting hold of that? Some companies don’t uphold their privacy promises. In this case, we said that even if you reviewed Flo’s privacy promises and looked at the settings, your information could still have been disclosed to other companies. Sharing sensitive information always carries risks, so be sure you’re comfortable with what you’ve shared, in case privacy promises aren’t kept.
- Report your concerns. If you think a health app isn’t keeping up its end of the bargain, let the FTC know. The FTC regularly brings enforcement actions against companies that misrepresent how they use or disclose people’s sensitive health information.
The purpose of this blog and its comments section is to inform readers about Federal Trade Commission activity, and share information to help them avoid, report, and recover from fraud, scams, and bad business practices. Your thoughts, ideas, and concerns are welcome, and we encourage comments. But keep in mind, this is a moderated blog. We review all comments before they are posted, and we won’t post comments that don’t comply with our commenting policy. We expect commenters to treat each other and the blog writers with respect.
- We won’t post off-topic comments, repeated identical comments, or comments that include sales pitches or promotions.
- We won’t post comments that include vulgar messages, personal attacks by name, or offensive terms that target specific people or groups.
- We won’t post threats, defamatory statements, or suggestions or encouragement of illegal activity.
- We won’t post comments that include personal information, like Social Security numbers, account numbers, home addresses, and email addresses. To file a detailed report about a scam, go to ReportFraud.ftc.gov.
We don't edit comments to remove objectionable content, so please ensure that your comment contains none of the above. The comments posted on this blog become part of the public domain. To protect your privacy and the privacy of other people, please do not include personal information. Opinions in comments that appear in this blog belong to the individuals who expressed them. They do not belong to or represent views of the Federal Trade Commission.