How Could Commercial Terms of Use and Privacy Policies Undermine Informed Consent in the Age of Mobile Health?

Abstract

Granular personal data generated by mobile health (mHealth) technologies coupled with the complexity of mHealth systems creates risks to privacy that are difficult to foresee, understand, and communicate, especially for purposes of informed consent. Moreover, commercial terms of use, to which users are almost always required to agree, depart significantly from standards of informed consent. As data use scandals increasingly surface in the news, the field of mHealth must advocate for user-centered privacy and informed consent practices that motivate patients' and research participants' trust. We review the challenges and relevance of informed consent and discuss opportunities for creating new standards for user-centered informed consent processes in the age of mHealth. Privacy and Informed Consent in the Age of Mobile HealthMobile health (mHealth) refers to the use of technologies such as smartphone apps or wearable sensors to monitor health. In the past decade, there has been increasing enthusiasm for the role of mHealth in promoting precision medicine and learning health systems. 1 However, there are significant risks to collecting, transmitting, and storing personal health data that experts and the public alike have been slow to recognize. Current news about the sheer amount of data shared or sold by health technology companies and by platforms like Facebook, the lack of transparency about these activities, and the many possible malicious uses of these data have sparked a "techlash" reflecting public unease about many technologies central to mHealth research and clinical care. [2][3][4] In the current climate, demonstrating a clear and consistent commitment to the tenets of informed consent will be more important than ever for conscientious scientists and health care practitioners who wish to maintain the trust of participants and patients involved in mHealth studies or clinical interventions. ELSI research agenda.

Privacy perceptions and norms in youth and adults.

“…Recently, online data privacy has become another important discussion point, especially for providers who integrate mobile health apps and other online tools into clinical practice with patients. These apps and tools, especially commercially developed ones, frequently contain convoluted and complex terms of use and privacy policies that are not easily understandable to users yet allow companies to use data in ways they see fit, often without users' full knowledge (Schairer, Rubanovich, & Bloss, 2018). This is problematic, particularly for AYAs who have fewer privacy concerns or who might not perceive as many consequences from information disclosure.…”

Incorporating Community Partner Perspectives on eHealth Technology Data Sharing Practices for the California Early Psychosis Intervention Network: Qualitative Focus Group Study With a User-Centered Design Approach

“…As such, the EULA does not parallel the clinical or research-informed consent framework, and there is much that can be applied regarding the ethical use of eHealth technology. Though informed consent is required to cover aspects of privacy, risks, and ethical use of data, it still falls short in similar ways to the typical EULA, such as falling into the trap of long, technical, and difficult-to-understand language (ie, above recommended reading levels), and often requiring supplemental scripts describing the process in more granular steps, using plain layperson’s terms, and requiring comprehension checks [ 20 , 28 , 31 , 32 , 34 , 46 - 48 ], though this has historically not been a standardized process [ 49 ]. The goal of this project was to respond to previous EULA and consent framework limitations and address the concerns that users had.…”

“…EPI-CAL’s design relies on clients with EP “choosing” to share their data for analysis outside of standard clinical care by agreeing to a EULA that allows the software to be used to collect, transfer, and present client data. To create an adequate EULA in this setting, previous research suggests that EULAs should be relevant and understandable [ 27 ], use video explanations [ 28 , 29 ], set the reading level to sixth to eighth grade [ 27 , 30 ], include comprehension checks [ 31 , 32 ], offer explicit “opt-in” selections [ 16 , 30 , 33 , 34 ], and include options to request ending data collection or delete data entirely [ 30 ]. Unfortunately, such proposals are rarely implemented in practice [ 35 ], and therefore, our team sought to elicit feedback from relevant community partners to inform the design of a EULA that incorporates best practices for informed data sharing in an EP setting.…”

Developments in Privacy and Data Ownership in Mobile Health Technologies, 2016-2019

“…Users often agree on the assumption of minimal risk, as reading dense policies is onerous and time-consuming 118 119 120 . Moreover, while Article 7 of the GDPR specifies that information sharing as a condition of use may prohibit consent from being “freely given” if processing of data is not necessary for performance of such a contract 18 , the literature notes that users are frequently required to agree to data sharing in order to access relevant mHealth devices and services 79 121 , which may also predispose them to agree to privacy policies or terms without full perusal or understanding.…”