Healing or hacking? Examining the hidden cost of health apps

Whether free or paid, all apps require users to provide some information about themselves in order to function properly. What did people give up in order to stay healthy?

People gave away their contact information generously: Email and name were provided by over 50%, and phone number by over 31% of people surveyed. This (along with health information which was also given by more than half of users) is often a requirement in order to use an app. Signing up is common and begins the tracking of individual data, with 13% of people also adding a photo to their profile. Over 9% of users also gave access to their contact list, so even if you’re being careful with your data, there’s always a chance that someone else isn’t.

Germany stood out in this regard — people gave over more payment info but less other types of data. This behavior can be linked to a higher rate of paid app usage in Germany and shows a clear tradeoff between paid apps and privacy in users’ choices.

However, only 14% of people don’t give any data to their health apps, which means 86% of users rely on the cybersecurity measures of their apps for the privacy of their data. Unfortunately, this does not really play into their decision-making when choosing a health app.

The top three most important features were ease of use, availability of a free plan, and content. This was true in all countries except Malaysia, where privacy policies were the third most important. The high prioritization of free plans reflects the high percentage of people who prefer free apps.

The two least important features were MFA and the app’s developers across all countries. Overall, encryption of user data was the fourth lowest in importance. Other low-scoring priorities were the app’s popularity, description, and price, further showcasing the dominance of free apps.

Those using paid apps to support their health were about three times as likely to have experienced a cybersecurity-related issue with free health apps in the past. It is likely that this served as a motivation to use paid apps to a significant number of users.

What is worrying, however, is that 82% of people who have experienced cybersecurity-related issues still use free apps. It might suggest that users don’t know how to improve their behavior or lack concern for their data. Perhaps they don’t know how to protect it or are simply unable to pay for apps to support their health.

While an app being free is not necessarily a red flag, it often includes exchanging services for sensitive personal data. When this information sold to advertisers and data brokers includes topics like fertility, mental illness, and sexual orientation, it’s particularly worrying.

Data like this can be used to create detailed user profiles containing sensitive information that could potentially be used for discrimination or exclusion, like denying insurance or job opportunities based on your physical or mental health.

Analysis by country shows a slight trend between making active use of apps for mental health and prioritizing privacy policies when choosing an app. This demonstrates an overall awareness of the sensitivity of mental health data among active users, and the need to look at how this data is protected.

As recent history shows, even well-known paid health service providers have sold their paying users’ data to third parties. It shouldn’t come as a surprise that your free meditation, fitness, or meal-tracking app could do the same. Either way, it’s entirely up to you to take care of your data privacy.