What your health apps know and can find out about you

Fitness trackers, smartwatches and phones provide ways to monitor fitness and health, but you mightn’t be the only one using the data.

Is fitness tech counting steps — or overstepping?

Last week, Twitter users flew into a panic after learning that Google is acquiring Fitbit, the trendy fitness-tracking watch, for US$2.1 billion ($A3.1 billion).

The freak-out centred on user data — specifically, Fitbit users’ concerns that their exercise, food, weight and sleep data would become less secure. Although Fitbit said in a press release that it would “never sell” personal information and promised that “Fitbit health and wellness data will not be used for Google ads”, users are sceptical.

And they may have reason to be concerned, according to NYC lawyer Gary Schober.

“Once you sign onto an app … you’re often just giving everything away,” the cybersecurity specialist tells The Post.

He would know: Part of his job is writing those long, barely skimmed privacy agreements for apps.

“Companies can collect whatever info they want and can use the info any way they want as long as they tell people,” says the lawyer, who says he’s drafted “a bunch of … very favourable policies for my clients because it’s not very likely anyone will read it, anyway”.

So, what happens once your health data — anything from your step count to your diet — are shared or sold to a company? Most often, it’s nothing too scary, says Mr Schober. Typically, advertisers use health data to better target their ads with “no sinister intent”.

But that doesn’t mean things can’t get sinister.

Fitness trackers provide a wealth of data on exercise and health, but you might not be the only person looking at yours.

For instance, if outside parties — such as insurance companies and prospective employers — get a hold of your health data, the ramifications could extend to big insurance premiums and even missed career opportunities.

Plus, there’s precedent for Google getting into hot water over sensitive health info. In 2017, the University of Chicago Medical Centre teamed up with the search-engine giant with the goal of sharing anonymous patient data so techies could analyse it and see if they could improve diagnostics with that information. But in June, both Google and the medical centre were sued for not properly anonymising hundreds of thousands of patient records. (Spokespersons from Google and the University of Chicago told the New York Times that they followed medical privacy guidelines.)

Apple Watch and other fitness trackers track heart rate as one of many data collection points.

Here, Mr Schober and fellow experts break down the potential pitfalls of uploading your health information to your phone — and share their best advice on how to keep your private info private without going full tinfoil hat.

Movement and step tracking

Apps that log the distance, pace and time of aerobic exercise are so popular that iPhones started offering a pedometer feature with IOS 8. It tracks your steps — without you ever asking it to.

But from a data perspective, you could stroll right into trouble if you have a sedentary spell, leave your phone at home or go off the grid.

“Let’s say suddenly you’re not using (your phone) as much and your average pace per mile goes down significantly,” says David O. Klein, an NYC data privacy lawyer. “It’s possible that an entity could discern that you have a health condition.”

That information could in turn be used by health insurance companies to determine you have a “risk factor” and offer you a higher rate, he said.

“Even if it’s not true, it could still influence their decision,” Mr Klein said.

Women’s health

Women want to know when it’s that time of the month, and thanks to numerous apps, the visit doesn’t have to be a surprise. But if your cycle “changes significantly”, said Mr Klein, it could suggest to the health apps — and anyone else who has your info — that you’re pregnant, whether it’s true or not.

Jeffrey Neuburger, an NYC tech lawyer, says that information could have scary practical effects if it gets into the wrong hands — say, a hiring manager’s.

“A prospective employer might not want to hire someone who will be out on maternity leave,” Mr Neuburger said.

There are also mental-health consequences to consider, particularly around fertility issues. For example, if period-tracking data tips companies off to a woman’s fertility struggles, that would allow “IVF companies, for example, to target women”, said Mr Neuburger, possibly stressing out women struggling to conceive.

Or pregnancy-tracking apps can miss the memo during a miscarriage, as Washington Post writer Gillian Brockell called attention to last December. Brockell described “broken-heartedly” receiving early-motherhood ads after learning that her baby would be stillborn. Other women have spoken out about similarly upsetting experiences.

Food and diet

Have a cheat day coming up? It could come back to bite you if you log it into your food tracker — or even if you order a caloric feast via a delivery app.

“If my whole diet consists of nothing but pasta and bread, life insurance companies aren’t going to be happy about that because it’s likely to reduce life expectancy,” says Schober.

It might sound far-fetched, but insurance companies are clearly paying attention to our diets: One, John Hancock, offers incentives and benefits to policyholders for buying more fruits and vegetables and whole grains as part of a “vitality” program. So what’s to stop companies from doing the reverse?

Fitbit is one of the most popular fitness-tracking companies, and some are concerned about Google’s plans to acquire the company. Picture: AP Photo/Richard Drew, File

Then, there’s the direct threat to your health — via temptation, as advertisers pinpoint your junk-food weak spots.

Mr Schober said, “If I show a propensity for eating a lot of pasta, that information can be used to tell me there’s a nice little Italian restaurant on Second Ave I might want to go try.”

Heart monitor

Feeling anxious? Hitting a hard workout? Chugging coffee? You might want to switch off your heart-tracking app.

“Say your heart rate spikes beyond a certain level … it could indicate a heart condition,” said Mr Klein. That doesn’t mean you have one: “It could be completely coincidental, but some of these algorithms are unbelievable now.”

Passing out your heart-health stats can have alarming outcomes. Not only could it raise your insurance premiums if the companies find out, but info on your heart health could also “be factored into real-estate decisions, like whether someone wants to lease you a place or give you a loan”, said Mr Neuburger.

That said, if you have reasons to be concerned about your ticker, the pros of tracking your heartbeat could still outweigh the cons. But if heart health and privacy are of equal concern, go low-tech: You can buy a bicep blood-pressure monitor and use a heart chart (online, on sites like Heart.org) to read your stats.

Lock down your health!

Mr Schober explains how to keep your sensitive health data private.

Agree to disagree: When you download a health app — or any app — don’t just mindlessly swipe through all the agreements. Keep a sharp eye out for options to “disagree” or “opt out” from selling your data to, or sharing it with, external parties.

Stop the ad-ness: If targeted ads on social media give you the creeps, change your smartphone’s settings. IOS phones have an option to “limit ad tracking” to opt out of receiving targeted ads. Start by going to “settings,” scroll down to “privacy” and click on “advertising”. Once there, switch the “limit ad tracking” dial to the right, turning it green. For an Android, go to “settings” and scroll down to “privacy”. Choose “ads”, find where it says “opt out of ad personalisation” and toggle the dial to the right so it turns blue.

Go off the grid: In order to limit location tracking — which can track the distance and locations of your workouts — change your location setting to “while using” or “ask” for iPhone apps and to “only in use” or “denied” for Android apps.

This article originally appeared on the New York Post and was reproduced with permission