Privacy and your health data

How private is the data on your wearable?

Often less private than people assume. A wearable and its phone app collect data about you, your condition, your activities and your day-to-day choices. That data can be combined, stored and shared with others, and it may be used in ways you didn't expect⁶. Wearables may also record other people⁶.

The phone app can hold a lot. Some apps for fitness bands and smartwatches store detailed records: days of recent activity and, in some cases, every data point since you first used the device, such as heart rate every 5 minutes and step counts⁷.

The tracker itself can also give away information. Most trackers send out a fixed, unique identifier that could let someone follow your movements over time when the tracker isn't connected to your phone⁸. Some tracker apps have also had flaws that let an unauthorised person read, write and delete user data⁸.

Taking your name off data doesn't fully solve this. A person can sometimes be identified from as little as 1–300 seconds of recording, even from sensors not usually thought to identify anyone, such as an electrocardiogram².

What you can do:

• Read the privacy information before you buy or set up a device or app, and choose the most privacy-protective settings.
• Protect the phone linked to your wearable with a password, and keep its software updated.
• Switch the tracker off when you're not using it. That is one way to stop it broadcasting its identifier.

Devices and apps change often, so what yours does today may differ from what's described here.

How private is your data in health apps?

Not very private, going by what's known: sharing user data with other companies is routine in health apps³. Many apps send data to services run by Facebook or Google, and the privacy policy often doesn't say so⁵. Most apps give you no way to see this coming, so you can't make an informed choice about whether it's acceptable to you⁵.

Companies that receive app data usually reserve the right to use de-identified, combined data for their own commercial purposes, to share it with commercial partners, or to pass it on if the company is sold³. Many apps also send identifiers that can link your activity over time and across services⁵, and sharing with other companies raises the chance of someone being identified². Many popular free health apps don't follow well-known privacy practices or data protection rules⁹.

Privacy policies aren't a reliable guide. They average about 1,755 words, are written at about college reading level, and often don't make an app's practices clear⁴. A high rating or popularity doesn't show that an app protects your data: the link between an app's rating and having a clear privacy policy is weak⁴. If a policy is long or hard to follow, that is a common problem, not a failing on your part.

What you can do:

• Don't treat a high rating or a big download count as a sign an app handles your data well.
• Use a strong, different password for each app.

When to check with a health professional

If you're starting exercise after a long break, it's always a good idea to see your doctor first.

For an injury or a health condition, see a health professional, such as your doctor or a physio. Treat what an app tells you about your health as general information, and follow your doctor's advice over an app's.

Call your local emergency number for chest pain or pressure (or pain spreading to the arm, neck, jaw or back, especially with sweating or feeling sick), severe breathlessness, fainting or collapse, signs of a stroke, a serious injury, or someone who isn't safe.