Does your health app protect your sensitive info?

New health apps are popping up every day, promising to help you track your health conditions, count your calories, manage your medications, or predict your ovulation. These apps often ask for some of your most sensitive personal information, like your health history, medication list, or whether you have ever suffered a miscarriage.

Some apps use that sensitive information only to give you services. But others may use it for their own research, to target you with ads, or disclose — or even sell — your data to other companies. And, unlike your doctor, these apps may not be covered by health privacy laws like HIPAA.

For example, Flo is a health app that functions as an ovulation calendar, period tracker, and pregnancy guide. In a settlement announced today, the FTC said that the makers of the Flo app shared users’ personal health information with marketing and analytics companies like Facebook and Google — even though it had promised users to keep this sensitive information private. As part of the settlement, Flo Health, Inc. has agreed to get users’ consent before it can share their information in the future. The settlement also requires Flo to get an outside review of the honesty of its privacy promises.

How can you avoid the risks associated with these types of health apps? Here are some things to consider:

• Compare privacy protections. Many competing health apps offer similar services. When choosing between apps, compare their privacy protections. Look for a privacy notice that explains in simple terms what health information the app collects from you, as well as how it uses and shares your information with other companies and users. If the app shares your information, does it tell you why, and does it limit what others can do with it?
• Take control of your sensitive information. Take a look at the app’s settings to see if it gives you control over what health information it collects and shares. An app’s default settings often encourage sharing, so it can be useful to select more protective options.
• Keep your app up to date. App updates sometimes include important fixes for privacy or security glitches. One of the best ways to protect your information is to keep your app (and your phone’s operating system) up to date.
• Recognize the risks. What sensitive information will the app have access to? Are the app’s services worth the risk of someone else getting hold of that? Some companies don’t uphold their privacy promises. In this case, we said that even if you reviewed Flo’s privacy promises and looked at the settings, your information could still have been disclosed to other companies. Sharing sensitive information always carries risks, so be sure you’re comfortable with what you’ve shared, in case privacy promises aren’t kept.
• Report your concerns. If you think a health app isn’t keeping up its end of the bargain, let the FTC know. The FTC regularly brings enforcement actions against companies that misrepresent how they use or disclose people’s sensitive health information.