Reviewing the data security and privacy policies of mobile apps for depression

Abstract

BackgroundMobile apps have become popular resources for mental health support. Availability of information about developers' data security procedures for health apps, specifically those targeting mental health, has not been thoroughly investigated. If people are to use and trust these tools for their mental health, it is crucial we evaluate the transparency and quality around the data practices of these apps. The present study reviewed data security and privacy policies of mobile apps for depression.MethodsWe reviewed mobile apps retrieved from iTunes and Google Play stores in October 2017, using the term “depression”, and evaluated the transparency of data handling procedures of those apps.ResultsWe identified 116 eligible mobile phone apps. Of those, 4% (5/116) received a transparency score of acceptable, 28% (32/116) questionable, and 68% (79/116) unacceptable. Only a minority of the apps (49%) had a privacy policy. The availability of policies differed significantly by platform, with apps from iTunes more likely to have a policy than from the Google Play store. Mobile apps collecting identifiable information were significantly more likely to have a privacy policy (79%) compared to those collecting only non-identifiable information (34%).ConclusionThe majority of apps reviewed were not sufficiently transparent with information regarding data security. Apps have great potential to scale mental health resources, providing resources to people unable or reluctant to access traditional face-to-face care, or as an adjunct to treatment. However, if they are to be a reasonable resource, they must be safe, secure, and responsible.

‘Help for trauma from the app stores?’ A systematic review and standardised rating of apps for Post-Traumatic Stress Disorder (PTSD)

“…A further concern relates to the inadequate data protection and privacy declarations revealed in many apps in this study. This finding is consistent with the results of prior investigations (O'Loughlin, Neary, Adkins, & Schueller, 2019;Sucala et al, 2017;Terhorst et al, 2018). Even more concerning is the fact that many apps transmit data to commercial entities without disclosing this (Huckvale, Torous, & Larsen, 2019).…”

Developments in Privacy and Data Ownership in Mobile Health Technologies, 2016-2019

“…Transparency, therefore, is of the utmost importance. However, the literature is consistent in its illustration of the mHealth industry as being poorly compliant with the provision of appropriate privacy policies or Terms of Service agreements to users [84,89,90,[105][106][107][108][109][110][111][112][113]. Where privacy policies do exist, they are often non-specific to the app in question, may not inform users if the policy is being updated or if their data is to be shared, and may not provide users the right to access their personal data or be otherwise HIPAA-noncompliant [107,108,110,[114][115][116].…”

Security and Privacy of mHealth Applications: A Scoping Review

“…These are considered separately due to the growing importance of compliance in the mHealth industry [65]. [24], [41], [69], [73], [75], [76], [80], [82], [83] General security and privacy evaluation focus 6 studies [6], [8], [54], [60], [62], [68] Compliance…”

“…On a more detailed level, Table 6 includes the categories and subcategories of evaluation artefacts and the numbers of papers that covered them. Healthcare expert evaluation [69], user evaluation [21], [72] [2], [6], [8], [17], [21], [22], [24], [27], [41], [68]- [70], [72], [75], [77]- [79], [81]- [83] Privacy policy (PP) and Terms of Agreement (ToA) content evaluation Readability assessment [17], [23], [56], [116] [1], [6], [17], [22]- [24], [41], [55], [56], [58], [60], [68], [71], [74], [75], [77], [78], [83], [116] Technical security mechanisms evaluation…”