According to Statistics Canada, 76 per cent of Canadians use smartphones, and almost every Canadian under the age of 45 accesses the internet every single day. In 2015, there were over 60,000 health-related smartphone applications (apps) available in the Google Play and Apple app stores; more than one third of these were disease-specific apps with a mental health focus. By 2015, more than half of all smartphone users had downloaded at least one-health related app.
But how many of those users had read the apps’ privacy policy? How many apps had privacy policies? According to a new study by Dr. Julie Robillard, published this week in the journal Internet Interventions, of the top 100 apps available, only 18 per cent of iPhone apps and 4 per cent of Android apps had privacy policies at all, and of those that did, 71 per cent of iPhone and 46 per cent of Android apps included statements that indicated information may be shared with third parties, including advertisers.
“This was surprising to us, because both Apple and Google require privacy policies as a condition of the app being available in their stores,” said Dr. Robillard. “What this means is that for many apps for mental health monitoring, there isn’t transparency around how users’ data is being collected or if it is being shared with third parties.”
Many people find using mental health-related apps beneficial for symptom tracking and monitoring changes in mood. Mobile mental health apps can help users feel a sense of autonomy, and can provide novel benefits including real-time disease monitoring in between appointments with their healthcare teams. However, the nature of these types of tools means that users are asked to provide sensitive information, including names, contact information, and data specific to their personal mental health.
“Part of the issue is that where there are privacy policies in place, they are often full of complex language and legal jargon and are not easily understood by the lay person,” said Dr. Robillard. “The privacy policies we reviewed often require a reading level equivalent to second or third year university education, but these apps are often targeted to teenagers who may find the policies too technical or not read them at all.”
Thirty-nine per cent of the privacy policies Dr. Robillard and her team evaluated stated that use of the services implied consent to the privacy policy, whether users had read it or not.
“Implied consent is not informed consent, which is the standard we apply to in-person healthcare experiences,” said Dr. Robillard. “Whether online or in-person, it is crucial that an individual engaging in mental health treatment is able to understand what they are consenting to.”
The availability of flexible, portable tools such as mental health-related smartphone apps to aid in management of depression, bipolar disorder, and other conditions can be helpful to many people looking to take control over their day-to-day health. Convenience of use, however, should not override privacy concerns.
“Moving forward, we’d like to see more transparency from app developers,” said Dr. Robillard. “It should be easier for smartphone users to find credible apps, and to understand how their data is being used and where it is stored. We’d like to see informed consent become the standard for all healthcare interactions, even the ones that happen on our phones.”
