AbleProFAIR OR NOT
☰ Menu
Pay · what you’re chargedOwn · what happens after you buyAgree · what you sign or clickTrust · who is really on your sideHelp · getting a problem fixedData · what happens to your informationBrowse by area of lifeReport a problemRead reportsCommon pricing problemsNickel-and-dime tacticsFind your subscriptionsFree toolsGuidesComplain in your stateSearch
Report a problem
Home › Data › Health apps sharing your data
Data: What happens to your information · Health & insurance

Health apps sharing your data: fair or not?

People tell health apps about symptoms, medications, moods, cycles and weight, and many assume federal health privacy law protects that information. Often it does not, and some apps have shared health details with advertising platforms. Is it fair for an app to treat your health data like any other marketing data?

Is it fair for health, fitness and period-tracking apps to share your data with advertisers?

Be one of the first to vote.

What happens

Apps for fitness, diet, sleep, mental health, prescriptions and period tracking collect detailed personal information. Many include tracking tools from ad and analytics companies. These tools can send data about what you do in the app, along with identifiers like your email or device ID, to outside companies.

HIPAA, the federal health privacy law, mainly covers doctors, hospitals, health plans and their contractors. An app you download yourself usually is not covered, even if it handles health information. So the main protections come from the app's own privacy promises, the FTC's power to stop deceptive or unfair practices, and a few state laws.

Why many people say it’s not fair

  • People reasonably expect health details to be private, but many apps fall outside HIPAA.
  • Data about medications, therapy or pregnancy can be used to target ads or build profiles.
  • Privacy policies are long and vague about who receives data.
  • Sharing can happen through hidden tracking code, without a clear choice.
  • Health data, once shared, is very hard to pull back.

The other side

App makers say advertising and analytics keep many apps free or low cost, and that measuring which ads bring in users is standard for any online business. They say most data shared is about app use, not medical records, and is often coded or aggregated.

Many companies say they follow their privacy policies, let users opt out of ad tracking, and do not sell health data. They also point out that analytics help them fix bugs and improve features.

Options you may not be told about

If you live in Washington, its My Health My Data Act requires consent before most collection or sharing of health data, lets you request deletion, and lets consumers sue over violations.
On an iPhone, turn off Allow Apps to Request to Track under Settings > Privacy & Security > Tracking. Apps then cannot use Apple's advertising identifier.
On Android, go to Settings > Privacy > Ads and delete your advertising ID.
Under the FTC's Health Breach Notification Rule, health apps not covered by HIPAA must notify you if your health data is shared without your permission.
You can ask your doctor or health plan for their official patient portal, which is covered by HIPAA, instead of a third-party app.

What you can do

  1. Before installing, read the app's privacy summary in the app store.
  2. Share only what the app needs, and skip optional health questionnaires.
  3. Turn off ad tracking on your phone and decline in-app tracking prompts.
  4. Use the app's settings to delete old data, and delete accounts you no longer use.
  5. If you suspect misuse, report the app to the FTC and your state attorney general.

Rules and your rights

HHS says HIPAA generally does not protect health information you store on your own phone or tablet. The FTC's Health Breach Notification Rule, updated effective July 29, 2024, covers many health apps and treats unauthorized sharing as a breach. In 2023 GoodRx agreed to a $1.5 million civil penalty in the FTC's first case under that rule, and BetterHelp agreed to pay $7.8 million over sharing health data with advertisers; both orders limit ad sharing. Washington's My Health My Data Act took effect March 31, 2024.

Has this happened to you? Share what happened so others know what to expect.

Share your experience

Related

Common questions

Does HIPAA protect my health app data?

Usually not. HIPAA covers doctors, hospitals, health plans and companies working for them. A fitness, diet or period-tracking app you download yourself is usually not covered. The FTC can act against apps that break privacy promises, and some states, like Washington, have their own health data laws.

Do period-tracking apps sell your data?

It depends on the app. Some promise not to sell or share data, while others use ad and analytics tools. Read the privacy summary in the app store, check whether the app offers anonymous or on-device modes, turn off ad tracking, and delete data you no longer need.

What happened with GoodRx and BetterHelp?

In 2023 the FTC said both companies shared users' health information with advertising platforms despite privacy promises. GoodRx paid a $1.5 million civil penalty and BetterHelp agreed to pay $7.8 million for customer refunds. Both are barred from sharing health data for most advertising. Both must also run privacy programs.

Sources: Mofo: FTC issues final rule to expand the Health Breach Notification Rule (effective July 29, 2024) ↗ · Arnold & Porter: FTC fines GoodRx $1.5 million in first Health Breach Notification Rule action ↗ · FTC: Proposed order bans BetterHelp from revealing consumers' data for advertising (March 2023) ↗ · AP via Bangor Daily News: Federal patient privacy law does not cover most period-tracking apps (HHS guidance) ↗ · Jones Day: Washington enacts My Health My Data Act ↗ · Perkins Coie: My Health My Data Act consumer rights ↗ · Apple Support: If an app asks to track your activity ↗ · Google: Advertising ID (reset or delete) ↗

General information, not legal, financial or real estate advice. Whether a practice is fair is a matter of opinion; votes and shared experiences are the views of site visitors, not AblePro, Inc. Rules and company policies change; check current terms and your state’s rules.