You open the app, log your steps, check your sleep score, maybe track a cycle or a blood pressure reading, and close it again. Thirty seconds, tops. But in those thirty seconds, a lot more happened than a number changing on your screen. Data moved. Decisions got made. Companies you’ve never heard of may have received a copy of what you just typed.
That’s not a scare story. It’s how a large share of the health apps in your pocket are built to work. And most of us have no idea, because the interesting part happens where we can’t see it: behind the screen.
There are more than 350,000 mobile health apps that provide health information, according to a 2021 estimate cited by the U.S. National Center for Complementary and Integrative Health, and in 2023, nearly two-thirds (63.4 percent) of U.S. adults used a mobile health app in the past year. Health and fitness apps surpassed an estimated 3.6 billion downloads in 2024. We’ve handed these tools some of the most personal information we own. It’s worth understanding what they do with it.
Where Your Data Actually Goes
Here’s the part most people find surprising: your health data rarely stays between you and the app.
In 2019, researchers led by Quinn Grundy at the University of Toronto published a study in The BMJ analyzing top-rated medicine-related apps on Android. Of the 24 sampled apps, 19 (79 percent) shared user data outside of the app. They traced that data to 55 unique entities, owned by 46 parent companies. Some were infrastructure providers. Many were in the business of collecting and analyzing data for advertising. Both Amazon and Alphabet, Google’s parent company, received the highest volume of user data.
It goes further. Those third parties advertised the ability to share user data with 216 “fourth parties,” including technology companies, digital advertising firms, telecommunications corporations, and a consumer credit reporting agency. Only three of these could be characterised as belonging to the health sector.
That was a small sample. A larger 2021 BMJ study looked at more than 20,000 health apps and found the pattern held at scale. Though these apps collected less data than other app types, 88 percent still had access to and could potentially share user data. About two-thirds could collect advertising identifiers or cookies, one-third could collect a user’s email address, and a quarter could identify the phone tower connected to a user’s device, which hints at location.
Why does anyone want this? Because health signals are commercially valuable. What you weigh, when you don’t sleep, which medication you look up, whether you’re trying to conceive: these paint a precise picture of a person. None of the sharing above is necessarily illegal. That’s the uncomfortable part. Much of it happens by design, disclosed (if at all) in a privacy policy almost nobody reads.
What Actually Goes Into Building a Health App
To understand why your data behaves this way, it helps to look at how these apps get made. A health app is rarely one tidy program. It’s a stack of parts stitched together, and each part is a decision that affects your privacy and safety.
A typical build includes:
- The interface you tap, which is the only piece you ever see.
- A backend server where data is stored and processed, often rented from a cloud provider like Amazon, Google, or Microsoft.
- Software development kits (SDKs) dropped in to add features quickly, such as analytics, crash reporting, or login-with-Google. Many SDKs quietly send data back to the company that made them.
- Third-party APIs that connect to wearables, pharmacies, or payment systems.
That third item is where a lot of the leakage starts. A developer who wants to know which screens confuse users might add an analytics SDK. It does its job, and it also ships behavioral data off to a company whose whole business is data. The convenience and the privacy risk arrive in the same line of code.
Serious healthcare app development handles this deliberately: encrypting data in transit and at rest, minimizing what’s collected in the first place, vetting every SDK before it ships, and building consent that’s genuine rather than buried in fine print. The gap between an app that does this work and one that skips it is invisible from the outside, which is exactly why it matters so much.
There’s a cost dimension too. Building privacy and security in properly takes time and money. When an app is free and has no obvious way of making money, the data it collects is often the business model. That isn’t a rule without exceptions, but it’s a fair question to ask before you trust one.
The HIPAA Myth
Most people assume a law protects their health data. Ask around and you’ll hear the word “HIPAA” said with real confidence. Here’s the catch: HIPAA usually doesn’t apply to the app on your phone.
HIPAA applies to covered entities, meaning healthcare providers, health plans, and healthcare clearinghouses, and the vendors used by those entities. The majority of health apps are not covered by HIPAA, nor is the health information they collect, store, or transmit. If your hospital builds an app to show your records, that’s covered. But a period tracker, a meditation app, or a step counter you found on your own typically isn’t. The company can collect and share that data in ways a hospital never could, and HIPAA has nothing to say about it.
The FDA has similarly narrow reach. Most mobile health apps do not need FDA authorization; fitness tracking, meditation, nutrition logging, and other general wellness tools are typically not regulated, as long as they avoid disease-specific diagnostic or treatment claims. The agency steps in mainly when an app functions like a medical device. And passing app store review isn’t the same as clearing a regulator: app stores enforce platform policies, while the FDA enforces medical device laws.
So for a big chunk of the health apps people use daily, the main guardrail is the app’s own privacy policy and whatever consumer-protection enforcement arrives after the fact. That’s a thinner layer of protection than most users imagine.
How to Read an App Before You Trust It
You don’t need to be an engineer to make smarter choices. A few habits go a long way:
- Check who makes it and how they make money. A subscription or a device sale is a clearer business model than “free forever.” If you can’t tell how a free app pays its bills, assume your data is part of the answer.
- Skim the privacy policy for two words: “share” and “third parties.” You’re looking for whether they sell or share data, and whether you can opt out. Vague language is itself a signal.
- Look at the permissions it requests. A sleep tracker probably doesn’t need your contacts. A workout log probably doesn’t need your microphone. Deny anything that doesn’t fit the job.
- Turn off your advertising identifier. Both iOS and Android let you limit ad tracking in settings, which cuts one of the most common data trails.
- Prefer apps tied to a real clinical relationship when you’re handling sensitive conditions. Those are far more likely to fall under HIPAA’s actual protections.
None of this makes you paranoid. It makes you a harder target for the parts of the ecosystem that profit from inattention.
The Bottom Line
Health apps can be genuinely useful. Plenty of people manage conditions, build steadier habits, and catch problems earlier because of them. The point isn’t to delete every one. It’s to use them with your eyes open.
Three things to keep in mind:
- Your health data often travels well beyond the app, and much of that sharing is both legal and invisible.
- HIPAA probably isn’t protecting the wellness app you downloaded yourself, and app store approval isn’t a safety guarantee.
- How an app is built, especially how it handles your data, matters more than its star rating or its slick interface.
Next time you install something that asks for your body’s information, take the extra minute. Read who’s behind it, check the permissions, and decide what you’re actually comfortable trading. The screen shows you a number. Now you know a bit more about what’s happening behind it.
- About the Author
- Latest Posts
Our Editorial Team are writers and experts in their field. Their views and opinions may not always be the views of Wellbeing Magazine. If you are under the direction of medical supervision please speak to your doctor or therapist before following the advice and recommendations in these articles.
