In this project, we aim to investigate whether and what user data is collected by health-related mobile applications (mHealth apps), to characterise the privacy conduct of all the available on Google Play mHealth apps, and to gauge the associated privacy risks. To this end, we design an automated data crawling, analysis of the static source code and apps' files/codes as well as run-time network traffic, and analysis of public app reviews.
On Google Play store, we found 20,991 mHealth apps which included 15,838 free apps (requiring neither download nor subscription costs) and 5,159 paid apps. We found that 88% of mHealth apps collect/share user data. 16.8% of the detected data-collection practices, are towards the app developers (first-party), while 83.2% are towards external services providers (third-parties). A small number of third-parties (including popular services, like Google and Facebook) received 67.8% of the collected data. 23% of privacy leaks occur on insecure communications protocols. 20% of apps provide no privacy policies, while only 47% of data leaks are compliant with the practices disclosed by in the privacy policy. Less than 2% of users' reviews raised privacy concerns.
Our large-scale analysis of mHealth apps surfaced serious privacy issues, with limited awareness of app users. It is important for clinicians to articulate these to patients, in order to be able to accurately weigh the benefits and risks of the apps.
Our paper is submitted to the BMJ Journal, 2021. You can contact us on the following email for if you want to use our collected dataset, analysis scripts, or interested in our full paper.
mhealthapps2020 [at] gmail.com or gioacchino.tangari@mq.edu.au or muhammad.ikram@mq.edu.au