What happens to your health data when you put it in an app?

Short answer

Usually less protected than you assume. In the US, HIPAA does not cover consumer health apps — the FTC's own guidance says so — and when researchers tested 36 top-ranked apps for depression and smoking cessation, 81% sent data to Google or Facebook for advertising or analytics, while 43% of those sending to Google and half of those sending to Facebook disclosed it. The useful move is not to find a perfect app but to know which three questions to ask any of them.

Who is actually allowed to see your health data?

The first thing to fix is a misconception that almost everyone holds, including people who work in health.

HIPAA does not apply to your fitness app. The FTC's own business guidance is explicit: the HIPAA Rules apply to covered entities — health plans, health care providers who conduct standard electronic transactions, and clearinghouses — and to their business associates. An app company that is none of those falls outside HIPAA entirely, no matter how medical the data feels. Your resting heart rate, your cycle, your sleep, your mood logs: a hospital holding them is bound by HIPAA; an app holding exactly the same numbers generally is not.

What does apply in the US is the FTC Act's prohibition on unfair or deceptive acts and practices, which the FTC says reaches "companies that collect, use, or share health information that aren't required to comply with HIPAA." In practice that means a company is held to the promises it makes. If the privacy policy says one thing and the code does another, that is the violation.

Alongside it sits the Health Breach Notification Rule, which covers vendors of personal health records not covered by HIPAA and requires them to notify you, the FTC, and sometimes the media after a breach of unsecured identifiable health information.

In the EU and UK, the GDPR treats health data as a special category that may only be processed on one of a narrow set of grounds — for a consumer app, normally your explicit consent — and gives you a right of access to a copy (Article 15), a right to a portable copy of what you provided (Article 20) and a right to erasure (Article 17). This is a genuinely stronger position, and it is why many apps' deletion and export flows exist at all.

And in some US states, newer laws have closed part of the gap. Washington's My Health My Data Act, for example, gives consumer health data specific protections that federal law does not.

What the research found when someone actually checked

Privacy policies are promises. Several research groups have gone further and intercepted what apps transmit. The results are consistent and not reassuring.

The largest single finding comes from a 2019 study in JAMA Network Open, which assessed 36 top-ranked apps for depression and smoking cessation and compared what their policies said against what their traffic showed. Only 25 of 36 apps (69%) had a privacy policy at all. Data transmission to third parties was detected in 33 of the 36. And 29 of 36 apps (81%) transmitted data for advertising, marketing or analytics to just two companies, Google and Facebook — but only 43% of the apps sending data to Google, and 50% of those sending data to Facebook, disclosed it.

A 2019 analysis in The BMJ looked at medicines-related apps and found 19 of 24 (79%) shared user data, with 55 distinct entities receiving or processing it; two-thirds of those entities were in the business of collecting and analysing user data, such as analytics and advertising firms.

A 2022 scoping review in JMIR mHealth and uHealth examined 23 popular women's health apps. All 23 collected personal health data. Only 70% displayed a privacy policy, only 52% requested consent, 61% allowed location tracking, and 87% shared user data with third parties.

Enforcement has followed. In February 2023 the FTC took its first action under the Health Breach Notification Rule, against GoodRx, alleging it shared users' health information with Facebook, Google, Criteo, Branch and Twilio despite promising it would not; the proposed order included a $1.5 million civil penalty and a permanent ban on disclosing user health information for advertising.

The pattern across all of this is not that companies are uniquely wicked. It is that the advertising and analytics infrastructure of a mobile app is extensive, mostly invisible to the person using it, and historically under-disclosed.

What a health app can know about you that a hospital cannot

Worth sitting with for a moment, because it is the part that makes this more than an abstract concern.

A hospital sees you at appointments. An app on your phone sees you continuously. From passive data alone it can observe when you wake and when you sleep, how your resting heart rate drifts across a month, when you stop moving for three days, where you were, and what times of day you reach for your phone. None of that is a diagnosis, and all of it is inference material.

That asymmetry — continuous, ambient, and outside medical privacy law — is the actual risk. The breach scenario people imagine (a hacker steals your HRV readings) is less likely to matter than the ordinary one: identifiers linking your health app activity to your advertising profile.

The three questions worth asking any health app

Including this one. These are answerable from a policy in about five minutes, and they separate apps far better than a star rating does.

1. Does it sell data, and does it share data? These are different, and the difference is where most of the confusion lives. "We never sell your data" can be entirely true while identifiers still flow to advertising platforms — under several US state laws that counts as "sharing," which is why policies increasingly use both words. Search the policy for the names: Meta, Google, TikTok, and the analytics vendors.

2. Is health data used to build ad audiences? This is the question that matters most and the one almost nobody asks. There is a real difference between an app that sends an advertising platform "this device installed our app" and one that sends "this person is tracking fertility" or "this person has a stress problem." Look for an explicit statement about whether health or wellness-derived segments are used for targeting.

3. What happens when you leave — and when they do? Two parts. Can you delete everything yourself, and how long until it is actually gone including backups? And what happens to your data if the company is acquired? Almost every policy permits transfer in a merger or asset sale; the question is whether you are told before the terms change.

What Welltory actually collects, and what we deliberately do not

We are one of the apps in this category, so here is our own answer to the three questions, with the uncomfortable parts included. The policy is linked in the references; please check it rather than take this summary on faith.

What we collect. Account details (email, name), profile details (date of birth, gender), device identifiers, usage analytics, payment information excluding full card details, approximate location from IP — and health data, which our policy classifies as special category personal data requiring your explicit consent. That health data is heart rate and the beat-to-beat intervals behind it, sleep, nutrition, and whatever your connected wearables and apps send us.

What we compute from it. The standard HRV metrics, shown openly in Measurement details rather than hidden behind a score: SDNN (overall variability), RMSSD (the parasympathetic, recovery-linked measure), pNN50 (proportion of adjacent intervals differing by more than 50 ms), AMo50 (sympathetic, mobilising activity), Mean RR and MxDMn, plus the frequency-domain values — Total Power, VLF, LF, HF and LF/HF — when you measure in 300-beat mode. We interpret these against a working range derived from an internal analysis of artefact-free RR intervals from over 600 Welltory users who measured for at least 90 days — our own analysis, not externally peer-reviewed — and more importantly against your own baseline. You can export all of it, including the raw intervals, as CSV.

What we do not collect. Medical data. Welltory is not a medical app and not a medical device: there is no diagnosis, no condition, no treatment record in your account, because we do not ask for any and could not act on it if we did.

Do we sell it? No. Our policy states we never sell personal data and do not sell or rent personal data for monetary gain.

Do we share it? Yes, in a specific way you should know about. Our policy discloses that hashed email address, online identifiers, advertising IDs, device information and app or website activity data may be sent to Meta, Google and TikTok for advertising measurement and remarketing — set out explicitly for US users, and governed elsewhere by local law and your privacy choices. Several US state laws classify this as "sharing" even though no money changes hands. Our analytics, attribution and monitoring vendors include Amplitude, AppsFlyer, Google Analytics for Firebase, Kibana, Crashlytics and Sentry; the current full list is in the policy. US users can opt out through the Your Privacy Choices link, and we honour Global Privacy Control signals where applicable.

Is health data used for ad targeting? No — the policy states we do not use health data or health- and wellness-derived audience segments to build advertising audiences. Given what the research above found, that is the specific commitment we would want you to check, and to check in other apps too.

Health platforms you connect are separate. Apple Health and Google Health Connect are separate data controllers with their own policies. What you send us, we hold under our policy; what stays with them is governed by theirs.

What to do if you find something you do not like

Reading a policy properly often turns up something uncomfortable, and the useful response is narrower than "delete everything."

Separate what you can change from what you cannot. Most of what people object to — advertising identifiers, analytics SDKs, third-party sharing for measurement — has an opt-out, and it is usually buried rather than absent. Look for "Your Privacy Choices," "Do not sell or share my personal information," a Global Privacy Control setting in your browser, and the app's own notification and tracking permissions. On iOS, App Tracking Transparency cuts off the advertising identifier at the operating-system level for every app on the phone; on Android, the advertising ID can be deleted in Settings. These are blunter and more effective than anything inside an individual app.

Decide what you actually object to. "This company holds my resting heart rate" and "this company can link my app activity to my advertising profile" are different objections with different remedies. The first is the price of the product working at all; the second usually has a switch.

Then act in the right order. Export first — once an account is deleted the data is gone and a copy cannot be reconstructed. Confirm the file opens and contains what you expected. Then opt out of what you can, and delete only if the result is still unacceptable.

And if the thing you found is that a policy says one thing while the app does another, that is not a preference question. In the US that is what the FTC Act's prohibition on deceptive practices covers, and the FTC accepts consumer reports at reportfraud.ftc.gov.

How do you delete your health data for good?

Deletion is a different right from export, and the order matters: export first, then delete, because deletion is meant to be irreversible.

In Welltory, you can delete your account yourself — in the mobile app, Menu → Account → Delete account; in the web app, Menu → Profile → Delete account. Our policy commits to removing your data within one month, with backup erasure within up to 90 days, keeping only what law requires. One deliberate obstacle: you cannot delete an account while a subscription is still active. That is a safeguard against deleting an account you are still being charged for; either wait for the subscription to lapse or ask support to move you to free first.

You can also delete a category of data without closing your account — for example, data associated with a particular platform — by asking support from inside the app.

Two general points for any app, not just ours. "Delete my account" and "delete my data" are not always the same button, and policies differ on how long backups persist. And deleting the app from your phone deletes nothing from the company's servers.

Before you decide privacy is hopeless

There is a particular kind of fatigue that sets in here: the policies are long, the findings are grim, the opt-outs are buried, and the conclusion feels like this is unknowable, so why bother.

That conclusion is doing more work than the evidence supports. The research above did not find that every app is equally bad — it found a wide spread, and the differences were visible in the policies when anyone bothered to read them. The apps with no policy at all, the ones that tracked location for no functional reason, the ones that built health-derived ad segments: those were identifiable in advance.

Five minutes and three questions is a genuinely effective filter. And the data itself is worth keeping — the whole reason to care about who can see your resting heart rate is that it tells you something real about your own body. Giving up on the privacy question is how people end up giving up on the data too.

Before you decide you can't know, read one policy properly. You will be better at it than you expect.

Start understanding your body

Learn what affects your energy, stress, sleep, and daily state. Get the app.

Explore your data

How Welltory helps — and what it cannot do

What it does. Classifies your health data as special category data requiring explicit consent, and processes it on that basis. States that it never sells personal data, and that health and wellness-derived segments are not used to build advertising audiences. Lets you export everything, including raw beat-to-beat intervals, and delete your account and data yourself. Shows the standard HRV metrics openly rather than only a proprietary score, so you can see what is being derived from your measurements.

What it cannot do. It is not a HIPAA covered entity or a business associate, so HIPAA does not apply to it. Some apps do fall under HIPAA — typically when they are offered through a provider or a health plan — but a direct-to-consumer wellness app generally does not, and an app implying protection it does not have is making a claim the FTC has pursued others for. It cannot control what Apple Health, Health Connect or your device manufacturer do with data on their side. It does not collect medical data and is not a medical device: it does not diagnose, treat or monitor any condition. And it cannot promise that a company's ownership will never change; like essentially every policy in this industry, ours permits transfer in a merger or asset sale, with notice before the terms change.

If something about your health worries you, that belongs with a clinician, who is covered by medical privacy law in a way that an app is not.

Discounts for blog readers: up to 36% off

See what affects your energy, stress, sleep, and daily state with Welltory

Explore your data