Before Using a Health App, Check Where Your Data Goes

1. Start with the HIPAA boundary

The Health Insurance Portability and Accountability Act, or HIPAA, protects certain health information held by covered entities and their business associates. Covered entities include health plans and health care providers that conduct specified electronic transactions. A business associate handles protected health information on a covered entity’s behalf. An app’s medical subject matter does not, by itself, put the app in either category.

A tool your clinic uses to collect readings under an appropriate business associate arrangement may fall within HIPAA. The same company’s separate consumer product may not. Likewise, when you direct a provider to send records to an independently chosen app, the app’s copy generally is not protected by HIPAA unless the app has another qualifying relationship. The provider’s original records remain subject to its obligations.

Ask whose service you are using and in what capacity. A statement that an app is “HIPAA compliant” is not a blanket federal endorsement or proof that every feature is covered. If a clinic recommended it, ask whether the clinic contracted with the app to handle your information, or merely suggested a tool available to anyone.

2. Map what the app collects before signing up

Begin with the privacy policy linked from the app’s store listing and website. Check its effective date and whether it names the product you plan to use. Read the store’s privacy disclosures too, but treat them as a starting point rather than independent verification. Compare those disclosures with the policy and the permissions requested during setup.

Health information includes more than entries labeled “medical.” Search terms, cycle dates, location, appointment reminders and purchase history can reveal or support inferences about health. An app may also gather device identifiers, IP addresses, interaction logs and data from connected services. Even without your name attached, combinations of these details can sometimes connect records to you.

Separate information needed for the feature you want from information collected for other purposes. A cycle calendar may need dates; that does not explain why it needs your contacts. If a permission seems excessive, deny it and see whether the essential function still works.

• Search the policy for “collect,” “infer,” “location,” “identifier” and “connected.”
• Check whether free-text notes, uploaded photos or chat messages are stored.
• Look for collection that continues in the background or while logged out.
• Review wearable and phone health-platform access field by field, not just app by app.

3. Follow the sharing language, not just the sales promise

“We never sell your data” is narrower than “we never disclose your data.” An app may still send information to hosting providers, analytics services, affiliated companies or advertising partners. Some transfers support basic operations; others support profiling or marketing. The useful question is what each recipient receives, why it receives it and what limits apply afterward.

Look for categories of recipients and, when available, a named vendor list. “Trusted partners” without an explanation is not very informative. Check whether the app shares only technical events or also health entries, URLs and identifiers. A visit to a narrowly focused symptom page can itself be revealing. Claims about aggregated or de-identified information deserve scrutiny too: ask what safeguards prevent re-identification and whether recipients are contractually restricted.

Read advertising choices carefully. Turning off personalized ads may not stop analytics collection or every disclosure. A privacy setting may affect future sharing without recalling earlier transfers. Policies also commonly address acquisitions and legally required disclosures. No app can credibly promise that your information will never be sought through legal process.

• Search for “share,” “disclose,” “advertising,” “analytics,” “affiliate” and “business transfer.”
• Check whether vendors may use information for their own purposes.
• Find out whether chat or journal content can be used to train AI models.
• Save the policy and your consent choices so you can compare later changes.

4. Separate retention, account closure and actual deletion

Deleting an app from your phone usually does not delete its cloud records. Canceling a subscription is also different from closing an account, and closing an account may not remove everything the company holds. Before signing up, find the deletion instructions and read the retention policy alongside them. Look for a stated period or a clear explanation of how retention is determined.

Language such as “as long as necessary” leaves important questions unanswered. Necessary for which purpose, and measured from what event? Ask whether inactive accounts expire, whether backups have a deletion schedule and whether vendors receive deletion requests. Companies may retain some records for security, fraud prevention or legal obligations, but the exceptions should be explained rather than hidden behind an unlimited reservation.

Export anything you need before requesting deletion, then store that export securely. Ask for confirmation and keep the response. Deletion cannot necessarily recover information already sent to an independent recipient, included in a legally retained record or transformed into data no longer linked to your account. Those limits matter most when deciding what to enter initially.

5. Match the privacy test to the kind of app

For a symptom tracker, consider whether you need an ongoing cloud history or simply a short log to bring to an appointment. Check whether entries include medication names, photos, voice recordings or detailed notes about other people. A symptom-checking chatbot deserves the same scrutiny: a conversation can reveal far more than a few selected checkboxes, and its retention rules may differ from the tracker’s.

For fertility and period apps, review the treatment of cycle dates, pregnancy status, sexual activity and location. These records can be especially sensitive in the context of reproductive care and legal disputes. Check whether an optional anonymous mode actually avoids account identifiers, and what technical information remains. Neither an alias nor a privacy-focused marketing claim guarantees anonymity.

For fitness, sleep and wellness tools, inspect social features and employer or insurer connections. Public routes may reveal home addresses or routines. A workplace wellness offering may involve several organizations with different roles; ask exactly what the employer receives, including whether reporting is individual or aggregated. Default settings are not necessarily the choices you would make.

• Disable public profiles, route sharing and contact discovery unless you need them.
• Connect only the wearable measurements required for your chosen feature.
• Avoid unnecessary identifying details in journals, chats and symptom notes.

6. Know which protections may exist outside HIPAA

An app outside HIPAA is not automatically outside the law. The Federal Trade Commission can challenge deceptive or unfair practices, including misleading privacy claims. Its Health Breach Notification Rule can apply to certain health apps and related services. Amendments effective in 2024 clarified its application to health technologies and that breaches can include unauthorized disclosures, not only hacking.

State protections also matter. Washington’s My Health My Data Act, for example, regulates certain consumer health data outside HIPAA and includes consent and deletion provisions, subject to its scope and exceptions. Other states have their own consumer privacy or health-data laws. Coverage depends on factors such as residence, business activities, data type and statutory exemptions; rights are not identical nationwide.

Look for a state-rights section and a working request channel. If an app mishandles information, preserve screenshots, notices and correspondence. Depending on the facts, complaints may belong with the FTC, a state attorney general or, for a HIPAA-covered organization, the federal Office for Civil Rights. These laws provide accountability, not a guarantee against exposure.

7. Make a smaller-data choice and revisit it

Before committing, test the app with minimal information. Prefer explanations specific enough to evaluate: named purposes, limited permissions, understandable retention rules and a usable deletion process. Local-only storage can reduce some sharing risks, but verify whether device backups or connected services send copies elsewhere. Protect the phone and account with strong authentication and current software.

Recheck settings when the app adds AI features, changes owners or updates its policy. Disconnect integrations you no longer use and periodically remove unnecessary records. If the company cannot explain where sensitive information goes, choosing another tool—or a securely kept offline log—is reasonable. The goal is not to find a risk-free app. It is to keep the record you create proportionate to the help you actually need.