Medical apps routinely share user data, and physicians should be aware of privacy risks when recommending apps, according to a study in BMJ and detailed in Medscape.
The researchers studied 24 top-rated medical apps available to the public on the Android mobile platform in the U.S., U.K., Canada and Australia. To determine the extent of user data sharing, the study authors set up dummy profiles and analyzed traffic during simulated use.
Six study findings:
1. Nineteen apps — 79 percent — shared user data.
2. A total of 55 unique entities, owned by 46 parent companies, received user data, including developers and parent companies (first parties) and service providers (third parties). One-third provided infrastructure-related services such as cloud services; 67 percent provided services related to collecting and analyzing user data, including analytics or advertising.
3. Network analysis demonstrated that first and third parties received a median of three unique transmissions of user data. Third parties advertised the ability to share user data with 216 "fourth parties."
4. The most commonly shared types of user data were the device name (63 percent of apps), operating system version (42 percent), internet browsing information (38 percent), email address (38 percent), Android ID (33 percent), and medication list (25 percent). Some apps also shared names (21 percent) and date of birth (13 percent).
5. Amazon.com and Alphabet, the parent company of Google, received the most user data (24 transmissions each), followed by Microsoft, with 14 user data transmissions.
6. Even when personal identifiers are absent, "Many types of user data are unique and identifying, or potentially identifiable when aggregated," the study authors wrote. Sharing user data can lead to highly-target advertising or algorithmic decisions about employability and financial services, among other issues.
The study authors suggest physicians be conscious of user data sharing when recommending apps, and explain potential privacy concerns as a part of informed consent.