Assessing the Privacy of mHealth Apps for Self-Tracking: Heuristic Evaluation Approach

Abstract

BackgroundThe recent proliferation of self-tracking technologies has allowed individuals to generate significant quantities of data about their lifestyle. These data can be used to support health interventions and monitor outcomes. However, these data are often stored and processed by vendors who have commercial motivations, and thus, they may not be treated with the sensitivity with which other medical data are treated. As sensors and apps that enable self-tracking continue to become more sophisticated, the privacy implications become more severe in turn. However, methods for systematically identifying privacy issues in such apps are currently lacking.ObjectiveThe objective of our study was to understand how current mass-market apps perform with respect to privacy. We did this by introducing a set of heuristics for evaluating privacy characteristics of self-tracking services.MethodsUsing our heuristics, we conducted an analysis of 64 popular self-tracking services to determine the extent to which the services satisfy various dimensions of privacy. We then used descriptive statistics and statistical models to explore whether any particular categories of an app perform better than others in terms of privacy.ResultsWe found that the majority of services examined failed to provide users with full access to their own data, did not acquire sufficient consent for the use of the data, or inadequately extended controls over disclosures to third parties. Furthermore, the type of app, in terms of the category of data collected, was not a useful predictor of its privacy. However, we found that apps that collected health-related data (eg, exercise and weight) performed worse for privacy than those designed for other types of self-tracking.ConclusionsOur study draws attention to the poor performance of current self-tracking technologies in terms of privacy, motivating the need for standards that can ensure that future self-tracking apps are stronger with respect to upholding users’ privacy. Our heuristic evaluation method supports the retrospective evaluation of privacy in self-tracking apps and can be used as a prescriptive framework to achieve privacy-by-design in future apps.

Knock! Knock! Who Is There? Investigating Data Leakage from a Medical Internet of Things Hijacking Attack

“…Recent studies by the European Commission and IBM estimate that within the next decade, over 50 billion medical devices will be Internet capable [2,3]. Coupling this information with industry predictions indicating that 49% of individuals own a wearable device, supports the idea that individuals are increasingly interested in monitoring their health, medical, and dietary practices [4,5].…”

A Multilateral Privacy Impact Analysis Method for Android Apps

“…(1) Researchers have raised serious privacy and security concerns resulted from using invasive health and fitness related apps [20,22,28]; (2) Such apps are sometimes underestimated by the users and we intend to highlight the gap between their perception and reality. User reviews of fitness apps can be treated as complementing factor to the technical properties that is measured, which also supports the emphasis on transparency and intervenability by the GDPR [9].…”

Revealing the unrevealed: Mining smartphone users privacy perception on app markets

“…Lifestyle), 585 for our analysis we decided to focus on Health & Fitness category. Such selection is rationalized as follows: (1) Researchers have raised serious privacy and security concerns resulted from using invasive health-based apps [42,43,44,45]; (2) Healthbased apps are sometimes underestimated by the users. As…”