How 26 Popular Health Apps Share Your Symptom Data With Pharmaceutical Companies
Twenty-six of the top 50 health and wellness apps share user symptom data, medication information, and health conditions with pharmaceutical companies, advertising networks, and data brokers, according to our investigation. Apps marketed for mental health, sleep tracking, symptom checking, and medication management transmit highly sensitive health information to third parties without adequate disclosure or meaningful consent. An estimated 100 million Americans use these apps, sharing information about depression, anxiety, chronic pain, sexual health, and substance use that they would never voluntarily disclose to an employer, insurer, or advertiser. Because consumer health apps are not covered by HIPAA, this data flows through the commercial data ecosystem with virtually no legal protection.
The Scope of Data Sharing
Our technical analysis of the 50 most popular health and wellness apps revealed that 26 share user data with third parties in ways that go beyond what users reasonably expect. We monitored network traffic from each app over a 14-day period, identifying all third-party connections and data transmissions. Among the findings: a popular mental health app transmitted user depression screening scores and therapy session notes to Facebook's advertising API, a medication tracking app shared prescription information with three pharmaceutical companies, and a symptom checker transmitted user-reported symptoms and diagnostic queries to a data broker specializing in health information. In total, the 26 apps transmitted data to 135 distinct third-party companies. Only 4 of the 26 apps disclosed these data sharing practices in language that a typical user could understand. The remaining 22 buried disclosure in privacy policies averaging 7,400 words that fewer than 1% of users read.
Pharmaceutical Industry Data Consumption
Pharmaceutical companies are significant consumers of health app data, using it for market research, drug development targeting, and direct-to-consumer advertising. Our investigation identified data flows from health apps to subsidiaries or data partners of Pfizer, Johnson & Johnson, AbbVie, and eight other major pharmaceutical companies. The data enables pharmaceutical companies to identify individuals with specific conditions and target them with advertising for relevant medications, a practice that raises ethical concerns about the exploitation of health vulnerability for commercial gain. Internal pharmaceutical industry presentations obtained through our investigation describe health app data as a high-value, low-regulation alternative to traditional clinical data sources. One presentation from a pharmaceutical marketing conference described consumer health apps as an unregulated goldmine of real-world patient data.
The HIPAA Blind Spot
Consumer health apps exist in a significant blind spot in health privacy law. HIPAA, which provides the strongest federal protection for health information, applies only to healthcare providers, health insurers, and their business associates. Consumer apps that users download from the App Store or Google Play are not HIPAA-covered entities regardless of how sensitive the data they collect. This means that a mental health app can share a user's depression screening results with Facebook for advertising targeting without violating any federal law. The FTC has used its unfair and deceptive practices authority to take action against health apps that violate their own privacy promises, including a 2023 enforcement action against BetterHelp for sharing therapy intake information with advertising platforms. However, the FTC's enforcement is reactive and represents a fraction of the violations occurring across the industry. The Health Breach Notification Rule, updated in 2023, requires non-HIPAA apps to notify users of data breaches, but does not restrict data sharing that occurs through normal business operations.
Key Findings
- 26 of the top 50 health and wellness apps share user symptom data with pharmaceutical companies, advertising networks, or data brokers.
- The 26 apps transmitted health data to 135 distinct third-party companies, including subsidiaries of major pharmaceutical companies.
- Only 4 of 26 data-sharing apps disclosed these practices in language a typical user could understand.
- A popular mental health app transmitted depression screening scores and therapy session notes to Facebook's advertising API.
Timeline
FTC takes enforcement action against BetterHelp for sharing therapy intake data with advertisers.
FTC updates Health Breach Notification Rule to cover non-HIPAA health apps.
OPV begins network traffic analysis of top 50 health and wellness apps.
Investigation findings shared with affected app companies and FTC before publication.