by Valentina Cipriani
Medical applications have revolutionised health care: they can help women to plan a pregnancy, book an appointment with an online GP and help people with diabetes to keep their sugar levels under control. But to do so, they collect a huge amount of highly sensitive medical data. And they do not always store or use them safely.
The IEEE says that health app privacy is alarming
A study published in January by the Institute of Electrical and Electronic Engineers (IEEE) calls the practice of mobile health applications’ privacy “alarming”.
For more than a year researchers analysed 20 free mobile health applications that had been downloaded at least 100,000 times each, looking at which personal data they asked for, whether they shared them with third parties and how safely the information was passed on.
The results were discouraging.
“A relevant number of popular mobile health apps could violate users’ privacy by revealing sensitive information such as health conditions, medical symptoms, photos, location, emails and passwords,” says the research.
According to the portal Statista, in 2017 medical apps were downloaded 3.7bn times worldwide. In many cases, these apps make patients’ lives a lot easier, so people are not too picky on how their data are handled.
But there are a bunch of data practices you may at least want to keep an eye on.
“If the data are living on their own device that is not connected to any kind of network or cloud storage, there is no issue, really. It’s like buying a notebook from a shop: the shop does not have any contact with what you write on it. But that is not the norm,” says Professor Dipak Kalra, lecturer of Health Informatics at University College London.
Most apps nowadays offer something more sophisticated. They may store and analyse the data to improve the service; they may compare them to other people’s in your age group or in your city. Or they may resell the data for research or market purposes.
The company refusing to sell data to third parties
The company Isabel HealthCare is an exception to the norm and a model of good practice. It does not advertise nor share data with any third parties, not even with academic researchers.
The project started after three-year-old Isabel Maude almost died because of a misdiagnosis made by her GP. Her father Jason Maude then dedicated his career to develop a diagnosis tools for clinicians.
The company is partially charity-owned and now also offers a free online symptom checker for patients. Jason Maude believes that their ethical data management has everything to do with Isabel’s story.
“I think it’s how the project is born that drives how you behave. We didn’t even originally set up the system to make money, it was set up as a charity and almost forced to become a business in 2004 because it wasn’t sustainable on a charitable basis.
“Our mission has always been to improve diagnosis decision making. It’s about how we can help doctors avoid making mistakes. Then we released the patient version, and its mission is democratisation of health care: how to help patients to be better informed and to ask better questions. Everything stems from there.”
GDPR makes consenting to data sharing more transparent
Storing and reselling data is not necessarily bad, especially when the focus is on improving the product.
The keyword for these practices is consent, a principle that the new European General Data Protection Regulation (GDPR), enforced since 25 May 2018, establishes more clearly. Customers must be provided with readable privacy policies and the ability to withdraw their consent at any point.
“None of these things are wrong or immoral. But they are a sliding scale from locked data protection to higher risks scenarios where there needs to be greater privacy protection and a wider anonymisation. When we start looking at extensive reuse of data, there is a need for customers to be better informed,” says Professor Kalra.
Fiona Leishman talks about the safety of her data
As a Type 1 Diabetic I have to keep a hawk-like watch on my blood glucose levels. Nowadays it’s all done on an app created by Abbott Laboratories, a pharmaceutical company.
For years I had to prick my finger a minimum of four times a day to check my glucose levels; there were times, especially when I was unwell, when this rate rose to as many as 20 times a day.
I was diagnosed at 22-months old. As I’m now approaching my 23rd birthday, daily finger pricking over the years has left me with fingertips that resemble those of a seasoned guitarist.
All this changed in summer 2017 when I was introduced to something called the Freestyle Libre. The Freestyle Libre is a small sensor attached to my arm, which takes a glucose reading every 60 seconds and stores eight hours of data. Using either the meter that comes with the device or my mobile I can then scan this data and view a graph which plots my glucose levels across the day.
To use the app on my phone I had to create an account with Freestyle, which required some personal information. When I signed up there was a privacy notice to read, but it was so long-winded that I simply clicked “Agree” and moved on, like most people.
After looking into it, I found that data from the app, anything from my date of birth, to how often I scan my sensor, or the targets I set for my glucose levels, is taken by the company and stored in a Cloud based server called LibreView. LibreView is a great way for my healthcare professionals and I to have easy access to my data, but how secure is it?
I know that I would definitely like some more explanation as to specifically which data they are using, and who is seeing this.
I don’t mind the company using my data to develop the app, making improvements that would ultimately benefit me, but the use of my data for marketing has left me confused and irritated.
Featured Photo by Esan Swan