Many popular reproductive health apps fall short when it comes to protecting users’ data privacy, according to a new report highlighting potential legal risks to people seeking abortions.
After studying 20 of the most popular menstrual and pregnancy tracking apps, researchers from Found the non-profit Mozilla Foundation That 18 of them had data collection practices that raised privacy or security concerns. the report It also looked at five wearables that track fertility but did not raise concerns about their data collection.
Many apps have vague privacy policies that don’t spell out what data can be shared with government agencies or law enforcement, said Gene Caltrider, principal investigator for Mozilla’s “Privacy Not Included” Buyer’s Guide to Connected Consumer Products. Report.
Ideally, she said, companies would publicly commit to processing data requests from law enforcement by requesting a court order or subpoena before any data is delivered, working to narrow requests as much as possible and alerting users about any requests.
Glow Inc. said. , which makes four of the apps Mozilla has rated as having privacy or security concerns, said in a statement that the company does not share personal data with anyone and will “never sell” user data. The company also said it has a “comprehensive” set of features to protect user data, is subject to an annual privacy and security assessment conducted by a third party, and that employees undergo privacy and security training.
Other companies included in the report reiterated their commitment to data privacy in response to inquiries from The Times. “We will never transfer your private health data to any authority that may use it against you,” Clue, which received an unfavorable rating for privacy and security, said in a statement in May. Apple, whose Apple Watch isn’t classified as a privacy concern, said health data is encrypted when synced with iCloud or when the phone is locked with Face ID, Touch ID or a passcode. Natural Cycles, one of the few apps to receive a favorable rating for privacy and security, said in a statement that the company “has the mindset that every app – even if it has strong privacy protections like us – should work harder to protect data on the user’s behalf.” “
Caitlin Gerdts, vice president of research at Ibis for reproductive health, said the Euki app, which received a positive rating from Mozilla, was based on two years of research into what potential users wanted to see in the sexual and reproductive health app. She said the main concern is privacy and security.
“Privacy and security concerns in reproductive health are not new,” Gerdts said. “Many societies, particularly over-watched and over-watched societies, have had these fears for a long time, and of course now, they’re at the forefront of more people’s minds.”
The experts said Entering health data into most period tracking apps Not subject to the Health Insurance Transfer and Accountability Act, also known as HIPAA, which regulates how health providers and other entities handle patient data. An opaque privacy policy could mean that users won’t know what data is being shared, with whom and under what circumstances, forcing users to blindly trust a company to protect their information.
“It gets really gray and gets slippery very quickly,” Caltereder said. “It’s really hard to be sure exactly what’s being shared and with whom.”
This may be a concern in states that moved to ban abortion after the Supreme Court reversed the landmark Roe v. Wade decision.
Californians, where abortion remains legal, get some protection through the state’s data privacy laws. California residents have the right to access, delete, and opt out of its sale and sharing of their personal information.
“Health micro apps that collect health information or even a Fitbit app that your doctor tells you to wear may not be covered under HIPAA, but they are more likely to be covered under California law,” said Ashkan Soltani, California executive director of Privacy Protection. The agency, which implements and enforces the state’s consumer privacy laws.
Starting next year, Californians will have additional protections, such as restrictions on the company’s ability to collect data for purposes other than its main job.
These laws apply only to Californians, not to out-of-state travelers who may come to California to seek abortion. However, Soltani said it may give California consumers who travel to other states additional protection for their data.
In addition to vague privacy policies, the Mozilla report also found that some apps allowed weak passwords or weren’t clear about how they use algorithms to predict ovulation and fertility time frames.
Consumers often want to protect their privacy but don’t know how to protect their privacy or don’t see immediate harm from not doing so, Caltrider said. But as user data monetization continues to increase, consumers should view this as a “tipping point,” she said.
“Last time abortion was illegal, we didn’t have the internet. Digital monitoring was not a factor,” Caltrader said. “It’s too much now. It’s time we really start to consider that there is harm when our privacy is violated.”