Assessment of the Fairness of Privacy Policies of Mobile Health Apps: Scale Development and Evaluation in Cancer Apps

Abstract

Background Cancer patients are increasingly using mobile health (mHealth) apps to take control of their health. Many studies have explored their efficiency, content, usability, and adherence; however, these apps have created a new set of privacy challenges, as they store personal and sensitive data. Objective The purpose of this study was to refine and evaluate a scale based on the General Data Protection Regulation and assess the fairness of privacy policies of mHealth apps. Methods Based on the experience gained from our previous work, we redefined some of the items and scores of our privacy scale. Using the new version of our scale, we conducted a case study in which we analyzed the privacy policies of cancer Android apps. A systematic search of cancer mobile apps was performed in the Spanish version of the Google Play website. Results The redefinition of certain items reduced discrepancies between reviewers. Thus, use of the scale was made easier, not only for the reviewers but also for any other potential users of our scale. Assessment of the privacy policies revealed that 29% (9/31) of the apps included in the study did not have a privacy policy, 32% (10/31) had a score over 50 out of a maximum of 100 points, and 39% (12/31) scored fewer than 50 points. Conclusions In this paper, we present a scale for the assessment of mHealth apps that is an improved version of our previous scale with adjusted scores. The results showed a lack of fairness in the mHealth app privacy policies that we examined, and the scale provides developers with a tool to evaluate their privacy policies.

Privacy Policy Compliance of Chronic Disease Management Apps in China: Scale Development and Content Evaluation

“…According to the results, most of the apps collected in the initial sample (33/45, 73%) included a privacy policy, which was similar to a previous assessment of cancer apps by Benjumea et al [ 22 ] who found that 71% of the apps in their sample had a privacy policy. Considering that the prevalence of privacy policies for high-download apps is significantly higher than that of low-download apps (high downloads: 15/17, 88%; and low downloads: 33/64, 52%; P =.006) [ 31 ], our result might be higher than the actual situation.…”

“…The level 3 indicators under policy disclosure and policy updates can maintain a scoring rate of 57%-58%, which indicated that most PI controllers had a basic awareness of protecting user privacy. However, only 48% (16/33) of apps introduce the basic information of the PI controller in the privacy policies, which is far lower than a previous study (77%) [ 22 ].…”

“…This result is consistent with the prior finding by Fu and Zhao [ 30 ], who determined that most mHealth apps in China did not meet the requirements of PI Specification. Benjumea et al [ 22 ] analyzed the privacy policies of 31 cancer Android apps from the Google Play website (Spanish version) and obtained an average score of 50.5 points; in Hutton et al [ 21 ], the average score for 64 self-tracking mHealth apps from Google Play was 46.2% (SD 24.3%). These differences might also be the result of different mHealth app types, evaluation scales, and even normative background (Hutton et al [ 21 ] refer to GDPR, FIPS, and usability, whereas Benjumea et al [ 22 ] refer to GDPR).…”

“…The most common items in the evaluation criteria included stating processing purposes, determining the recipient of personal data, the existence of the data rights of the individuals, and the existence of privacy policies. Although a few papers on the privacy assessment of mHealth apps were based on laws or regulations, such as General Data Protection Regulation (GDPR), Fair Information Practices (FIPS) [ 18 , 21 ], some of them proposed a set of items to check the compliance of laws or regulations [ 20 , 22 ].…”

Analysis of Diabetes Apps to Assess Privacy-Related Permissions: Systematic Search of Apps

“…To perform a more complete assessment of apps’ privacy risks, additional technical, human, and contextual research (eg, analysis of the skills of patients using diabetes apps) should be conducted. For example, when dealing with privacy issues in health apps, an important factor to be considered would be the legitimacy of the request, as highlighted in a recent publication on mHealth apps for cancer in which the authors evaluated a new scale to assess the privacy policies of mHealth apps [ 51 ]. Tracking users’ location might be fair in the case of reporting a medical emergency (eg, hypoglycemic crisis).…”