When it comes to privacy and data transparency, smoking cessation and depression apps fall short, according to a new study published in JAMA this morning. The study, which zeroed in on 36 apps, found that 33 of those apps transmitted data to a third party. However, 17 of those apps either “lacked a privacy policy, failed to disclose the transmission policy in text or said that the transmission wouldn’t occur.”

“Our data highlight that, without sustained and technical efforts to audit actual data transmissions, relying solely on either self-certification or policy audit may fail to detect important privacy risks,” authors of the study wrote. “The emergence of a services landscape in which a small number of commercial entities broker data for large numbers of health apps underlines both the dynamic nature of app privacy issues and the need for continuing technical surveillance for novel privacy risks if users and health care professionals are to be offered timely and reliable guidance."

TOPLINE DATA

The authors of the study found that 29 of the examined apps were transmitting data to Google or Facebook’s marketing or advertising service. However, only 12 (33%) disclosed this privacy policy with accuracy.

Researchers found tha 25 out of 36 of the apps (69%) did incorporate a privacy policy. While 22 of 25 apps told users about their primary uses for data collection, only 16 of those mentioned any secondary uses. 

HOW IT WAS DONE

Between April and June of 2018, researchers focused on 36 of the “top-ranked” smoking cessation. They then did a “technical assessment of encrypted and unencrypted data transmission.”

WHAT'S THE BACKGROUND

Mental health apps are increasingly being used to address the shortage of trained mental health professionals. However, the business model for these apps vary. 

Researchers noted that many apps are still incorporating data sharing into their business model, but users are often not informed of the usage. 

But mental and behavioral health apps aren’t alone. The authors of the study pointed to past research that found dementia and diabetes apps also had a high proportion of data selling. 

“This tension between personal privacy and data capture by health care apps is largely driven by the business models of these apps,” authors of the study wrote. “Because many national health payers and insurance companies do not yet cover apps (given their often nascent evidence base), selling either subscriptions or users’ personal data is often the only path toward sustainability.”

IN CONCLUSION

“Health care professionals prescribing apps should not rely on disclosures about data sharing in health app privacy policies but should reasonably assume that data will be shared with commercial entities whose own privacy practices have been questioned and, if possible, should consider only apps with data transmission behaviors that have been subject to direct scrutiny,” the researchers wrote.