Whether they monitor your sleep, count steps or track periods, these days there are free apps that promise to improve every aspect of your life.
But as the saying goes, ‘there is no such thing as a free lunch’.
At least that’s according to experts, who say developers could make the product yours.
Privacy experts warn that health tracking apps – especially those that are downloaded for free – could potentially use your personal health data for advertising or other commercial purposes.
Such data could include how often people have sex, whether women are pregnant, and how often their periods typically last.
While your fitness tracker app may not sell your step count or workout routine directly, it can use the data to build your daily routines
As long as you accept their terms and conditions, app companies can collect data about your location, habits, activities and other sensitive information and sell it to third parties, warns privacy specialist Beth Barker-Paton.
She is the current associate partner at research and design consultancy Etic Lab and former director of online privacy company Kuva, which offers secure and transparent online work platforms that promise not to collect and store personal data.
“Personal information such as the number of steps you take or how long you sleep can indeed be used for advertising purposes,” says Ms Barker-Paton.
Companies may not directly sell health data, such as step counts or exercise routes, as agreed in some companies’ terms and conditions.
But such data can be used to infer a lot about your location, habits, and even hobbies.
This valuable information can then be sold to target you with advertisements for products and services based on that data, Ms. Barker-Paton claims.
“This information is sold to third parties for targeted advertising,” she told MailOnline.
Andrew Whaley, senior technical director at technology security firm Promon, adds that even if the data is anonymized, as many companies promise to do, companies can still infer where you spend your time and build advertising portfolios around that information.
“For example, if you were to look at someone’s running routes, it could be very local to where they live or work, so you could probably identify that,” he said.
‘You might find swimming records that could be likened to a gym membership.
“So even though that data is anonymized, if you knew enough about a person, you might be able to identify that person’s data.”
While all this type of data collection is concerning, experts are particularly concerned about the rise of period trackers.
Researchers from Chupadados, a Brazil-based cybersecurity guide, reviewed the terms and conditions of more than 200 period tracking apps in 2018.
They found that many of the apps made money by sharing users’ personal information with companies to target users with specific ads.
And in 2022, an analysis of the 25 most popular menstrual cycle tracking apps in Britain by the Organization for the Review of Care and Health Apps, a company that assesses the safety of health apps for the NHS, found as many as four of the five apps share users’ personal data with third parties.
More recently, last September, the Information Commissioner’s Office launched a review of menstruation and fertility tracking apps after an increasing number of women raised concerns about data security.
It followed a poll, commissioned by the regulator, which found that women are more concerned about how their data is used (59 percent) and how secure it is (57 percent) than about the cost or ease of use of an app.
The survey also found that more than half of women who used the apps experienced an increase in fertility or baby-related ads after signing up.
There are also fears in the US about the data recorded by menstruation tracking apps, which are being used to expose women who have had abortions after Roe v Wade was overturned.
Data shared through period tracking apps is some of the most concerning, according to experts, due to the sensitive information companies can collect
Some experts have urged women to delete the apps from their phones or use encrypted versions, fearing that authorities in states that now criminalize abortions could gain access to the data.
Ms Barker-Paton warned users of historical apps everywhere, especially free versions, that they could be giving away highly personal and valuable data.
“Remember that most, if not all, period apps have a free version,” she says.
“And even if they charge, the only way companies can afford to offer this at scale is… because their business model is primarily based on selling your data.
“If you don’t pay for privacy, you pay with it.”
Data that users could give away includes how often they have sex, whether they get pregnant and how long their periods usually last.
This combined with other data, such as your location, can be used to “tailor ads more effectively,” says Ms Barker-Paton.
She warned that this is an example of the ‘surveillance economy’, where data, including that about people’s health, is a commodity that can be bought and sold.
“It is critical that users, especially women, understand that by using such apps they are unknowingly sharing sensitive health information that could be used for commercial purposes,” she says.
‘Before using such services, it is advisable to remove personal data from the apps and understand the privacy implications.’
There is growing interest in AI, with ‘many millions being paid for data sets’ used to train AI models, Whaley warns
But now users don’t just have to be wary of ads.
Companies are also showing a growing interest in AI because the data sets used to train such computer programs are worth millions, Whaley warns.
Such data could theoretically come from health apps.
‘There is a great interest in AI and training models and this data will be very useful for that. It could be used widely without revealing any individual’s data,” he says.
Mr Whaley says that while the practice is still emerging, it can take root for everyone.
For example, he explained that if fitness apps sell this data for insurance purposes, the AI would be trained on data from very physically active people.
This could mean they are unintentionally discriminating against less active people because their data is simply not representative, he adds.
But protecting yourself by reading an app’s terms and conditions first can be tricky.
Mr Whaley says the wording many companies use is “intentionally vague” because at some point they want to leave the door open to monetizing users’ data.
“If privacy is a major concern, individuals should think critically about the need for each app and the permissions it requests,” says Ms Barker-Paton.