# data[].attributes.body
Did you know that 70% of health apps have data tracking kits to share your data with third parties?

Health apps require vulnerable information from their customers and it is concerning that this is being shared. Women's health apps in particular are tracking and sharing details such as sex life, menstrual cycle, pregnancy, interest in abortion, etc. These apps are also tracking specific habits of pregnant women to make sure there is no risk or harm to the pregnancy.

People need to understand that health and commercial data have different regulatory requirements. When you give personal health data online it has fewer safe guards than a physicians office might. People need to be more aware and particular with the information they are choosing to share with apps related to health.

if you're using one of these apps, get off it now and delete your data!

# data[].attributes.body
"sensitive data was shared with third parties via software development kits (SDKs) incorporated into the Flo App."

# data[].attributes.headline
"Many of the apps examined are also obtaining location information in some form, which when correlated with these unique identifiers, strengthens the capability for surveilling an individual person, as well as their daily habits, behaviors, and who they interact with"

# data[].attributes.subject
"Many of the apps examined are also obtaining location information in some form, which when correlated with these unique identifiers, strengthens the capability for surveilling an individual person, as well as their daily habits, behaviors, and who they interact with"

# data[].attributes.body
"This is a landmark moment in the effort to safeguard digital privacy rights," said Michael Canty of Labaton Keller Sucharow, the plaintiffs' legal representation. "Our clients entrusted their most sensitive information to a health app, only to have it exploited by one of the world’s most powerful tech companies," he reportedly told the Courthouse News Service.

This is important because it shows that people’s private health information, something very personal and sensitive, was not properly protected. Instead, it was allegedly misused by a big tech company. The case highlights how important it is for companies to respect digital privacy rights, especially when people trust them with their most personal data.

# data[].attributes.attachment_link.description
Verifying you are human. This may take a few seconds.

# data[].attributes.body
“If you are using an online period tracker or tracking your cycles through your phone, get off it and delete your data. Now."

Discovering that period-tracking apps could be used to prosecute people seeking abortions is deeply unsettling. It raises serious questions about how much of our personal data is being monitored, and what else companies, or even governments, might be able to access without our knowledge or consent.

# data[].attributes.attachment_link.title
Period-tracking apps may help prosecute users, advocates fear

# data[].attributes.attachment_link.description
Abortion advocates fear period-tracking apps and other digital footprints could be used against abortion-seeking people in states where it is now illegal.

# data[].attributes.body
“Flo Health told users that ‘their sensitive reproductive health information’ and survey questions would not be disclosed, but that personal data ended up being shared with companies like Meta and Google.”

Having used the app myself, learning that it was secretly collecting and sharing personal data is unsettling. It makes me wonder what other information companies are taking, and what else they’re getting away with behind the scenes.

# data[].attributes.attachment_link.title
California jury rules Meta violated privacy law in case involving period-tracking app

# data[].attributes.attachment_link.description
A California jury ruled against Meta in a privacy-related lawsuit involving the alleged collection of sensitive data from Flo, a period-tracking app.

# data[].attributes.body
“People seeking help for opioid addiction are among the most vulnerable, and their data deserves the highest level of protection.”

This quote stood out because it’s true, people dealing with opioid addiction are some of the most vulnerable. Taking their personal data without clear consent feels wrong, especially when they’re just trying to get help.

# data[].attributes.attachment_link.readable_text
Several widely used opioid treatment recovery apps are accessing and sharing sensitive user data with third parties, a new investigation has found.

As a result of the COVID-19 pandemic and efforts to reduce transmission in the U.S, telehealth services and apps offering opioid addiction treatment have surged in popularity. This rise of app-based services comes as addiction treatment facilities face budget cuts and closures, which has seen both investor and government interest turn to telehealth as a tool to combat the growing addiction crisis.

While people accessing these services may have a reasonable expectation of privacy of their healthcare data, a new report from ExpressVPN's Digital Security Lab, compiled in conjunction with the Opioid Policy Institute and the Defensive Lab Agency, found that some of these apps collect and share sensitive information with third parties, raising questions about their privacy and security practices.

The report studied 10 opioid treatment apps available on Android: Bicycle Health, Boulder Care, Confidant Health. DynamiCare Health, Kaden Health, Loosid, Pear Reset-O, PursueCare, Sober Grid, and Workit Health. These apps have been installed at least 180,000 times, and have received more than $300 million in funding from investment groups and the federal government.

Despite the vast reach and sensitive nature of these services, the research found that the majority of the apps accessed unique identifiers about the user's device and, in some cases, shared that data with third parties.

Of the 10 apps studied, seven access the Android Advertising ID (AAID), a user-generated identifier that can be linked to other information to provide insights into identifiable individuals. Five of the apps also access the devices' phone number; three access the device's unique IMEI and IMSI numbers, which can also be used to uniquely identify a person's device; and two access a users' list of installed apps, which the researchers say can be used to build a "fingerprint" of a user to track their activities.

Many of the apps examined are also obtaining location information in some form, which when correlated with these unique identifiers, strengthens the capability for surveilling an individual person, as well as their daily habits, behaviors, and who they interact with. One of the methods the apps are doing this is through Bluetooth; seven of the apps request permission to make Bluetooth connections, which the researchers say is particularly worrying due to the fact this can be used to track users in real-world locations.

"Bluetooth can do what I call proximity tracking, so if you're in the grocery store, it knows how long you're in a certain aisle, or how close you are to someone else," Sean O'Brien, principal researcher at ExpressVPN's Digital Security Lab who led the investigation, told TechCrunch. "Bluetooth is an area that I'm pretty concerned about."

Another major area of concern is the use of tracker SDKs in these apps, which O'Brien previously warned about in a recent investigation that revealed that hundreds of Android apps were sending granular user location data to X-Mode, a data broker known to sell location data to U.S. military contractors, and now banned from both Apple and Google's app stores. SDKs, or software development kits, are bundles of code that are included with apps to make them work properly, such as collecting location data. Often, SDKs are provided for free in exchange for sending back the data that the apps collect.

"Confidentiality continues to be one of the major concerns that people cite for not entering treatment... existing privacy laws are totally not up to speed." Jacqueline Seitz, Legal Action Center

While the researchers keen to point out that it does not categorize all usage of trackers as malicious, particularly as many developers may not even be aware of their existence within their apps, they discovered a high prevalence of tracker SDKs in seven out of the 10 apps that revealed potential data-sharing activity. Some SDKs are designed specifically to collect and aggregate user data; this is true even where the SDK's core functionality is concerned.

But the researchers explain that an app, which provides navigation to a recovery center, for example, may also be tracking a user's movements throughout the day and sending that data back to the app's developers and third parties.

In the case of Kaden Health, Stripe - which is used for payment services within the app - can read the list of installed apps on a user's phone, their location, phone number, and carrier name, as well as their AAID, IP address, IMEI, IMSI, and SIM serial number.

"An entity as large as Stripe having an app share that information directly is pretty alarming. It's worrisome to me because I know that information could be very useful for law enforcement," O'Brien tells TechCrunch. "I also worry that people having information about who has been in treatment will eventually make its way into decisions about health insurance and people getting jobs."

After ExpressVPN's findings were published, Kaden Health said it removed Stripe from its mobile app following an app store review.

The data-sharing practices of these apps are likely a consequence of these services being developed in an environment of unclear U.S. federal guidance regarding the handling and disclosure of patient information, the researchers say, though O'Brien tells TechCrunch that the actions could be in breach of 42 CFR Part 2, a law that outlines strong controls over disclosure of patient information related to treatment for addiction.

Jacqueline Seitz, a senior staff attorney for health privacy at Legal Action Center, however, said this 40-year-old law hasn't yet been updated to recognize apps.

"Confidentiality continues to be one of the major concerns that people cite for not entering treatment," Seitz told TechCrunch. "While 42 CFR Part 2 recognizes the very sensitive nature of substance use disorder treatment, it doesn't mention apps at all. Existing privacy laws are totally not up to speed.

"It would be great to see some leadership from the tech community to establish some basic standards and recognize that they're collecting super-sensitive information so that patients aren't left in the middle of a health crisis trying to navigate privacy policies," said Seitz.

Another likely reason for these practices is a lack of security and data privacy staff, according to Jonathan Stoltman, director at Opioid Policy Institute, which contributed to the research. "If you look at a hospital's website, you'll see a chief information officer, a chief privacy officer, or a chief security officer that's in charge of physical security and data security," he tells TechCrunch. "None of these startups have that."

"There's no way you're thinking about privacy if you're collecting the AAID, and almost all of these apps are doing that from the get-go," Stoltman added.

Kaden Health told TechCrunch that while these roles are not displayed on its website, it has "a robust team dedicated to its privacy and security programs, including security, privacy, and technology officers."

Google is aware of ExpressVPN's findings but has yet to comment. However, the report has been released as the tech giant prepares to start limiting developer access to the Android Advertising ID, mirroring Apple's recent efforts to enable users to opt out of ad tracking.

While ExpressVPN is keen to make patients aware that these apps may violate expectations of privacy, it also stresses the central role that addiction treatment and recovery apps may play in the lives of those with opioid addiction. It recommends that if you or a family member used one of these services and find the disclosure of this data to be problematic, contact the Office of Civil Rights through Health and Human Services to file a formal complaint.

"The bottom line is this is a general problem with the app economy, and we're watching telehealth become part of that, so we need to be very careful and cautious," said O'Brien. "There needs to be disclosure, users need to be aware, and they need to demand better."
Recovery from addiction is possible. For help, please call the free and confidential treatment referral hotline (1-800-662-HELP) or visit findtreatment.gov. This article was updated with comment from Kaden Health.
Read more:

# data[].attributes.attachment_link.title
Opioid addiction treatment apps found sharing sensitive data with third parties | TechCrunch

# data[].attributes.attachment_link.description
Several widely-used apps access unique device identifiers that can track users.

# data[].attributes.body
There was an increase in telehealth after COVID-19, due to the rapid spread of the disease as well as budget cuts. Software Development Kits were found in 7/10 apps (these kits collect data and user data for third parties). Many privacy laws don't apply to apps, leaving space for confusion/ wiggle room for apps to take advantage of their users data.

# data[].attributes.body
Post-Dobbs highlights the risk of personal data being misused. Courts now recognize privacy violations as real crimes. Now Big Tech must be more careful concerning data so that it doesn't face lawsuits.

# data[].attributes.body
"The report identified at least 210 cases in which pregnant people faced criminal charges associated with pregnancy, abortion, pregnancy loss or birth in the first year after the Dobbs decision."

“Pregnancy as a Crime shows that in the post-Dobbs environment, pregnant people are under increased surveillance and are getting arrested, prosecuted, and incarcerated for any actions that have a perceived risk of harm to the pregnancy.”

health and Commerical data have different regulatory requirements. When you give personal health data to an app, it has fewer safeguards than physicians might have in place.

"Many femtech apps contain third-party trackers that share user data across complex data ecosystems with third parties for targeted advertising, analytics and algorithmic improvement."

# data[].attributes.attachment_link.title
Post-Roe, Your Period App Data Could Be Used Against You

# data[].attributes.attachment_link.description
Your period app data is valuable to you, but femtech apps that share data with third parties can put your reproductive privacy at risk.

# data[].attributes.body
Flo= #1 moble product for womens health

Uses personal information (sex habits, health habits, mood, etc) to predict ovulation date

Flo stated that "repeated assurances that the information provided would remain private and confidential and would not be shared with any third parties, unless the user provided explicit consent"

"sensitive data was shared with third parties via software development kits (SDKs) incorporated into the Flo App."

# data[].attributes.attachment_link.title
Jury Rules Meta Violated California Privacy Law by Collecting Flo App Users’ Sensitive Data

# data[].attributes.attachment_link.description
Users of the Flo Period & Ovulation Tracker app (Flo App) who sued Facebook (Meta) and others over the alleged collection and interception of their A California jury has found Meta liable for violations of California privacy law in a lawsuit filed in response to the collection of sensitive data from users of the Flo fertility tracking app. Flo Health, the app developer and owner, and other defendants chose to settle with the plaintiffs.