Fertility app creators are selling information on their users while simultaneously promising to “protect their privacy”, according to a review of the category’s most popular apps in Australia.
In doing so, companies behind the apps may be exposing their users to data breach risks or reidentification of supposedly anonymised data while potentially misleading them.
On Wednesday, consumer advocacy organisation CHOICE released a privacy analysis from UNSW faculty of law and University of Chicago consumer antitrust studies institute non-resident research fellow Dr Katharine Kemp of the 12 most popular fertility apps in Australia, including Clue, Flo Health, Glow and Ovia Fertility.
Fertility apps are smartphone applications that people use to track ovulation, menstrual cycles and other personal health data, typically while they are trying to conceive.
Kemp’s analysis looked at the privacy policies, app messages and settings to understand how the fertility apps treated user data. She found that the apps collect sensitive information that is often kept for too long or shared with others, and that users are shown confusing or misleading claims that obscure how data is shared or collected from other companies.
CHOICE consumer data advocate Kate Bower said Kemp’s results were shocking.
“The thing that makes privacy for pregnancy and fertility applications so important is just how sensitive and personal the information is,” she told Crikey. “Anyone who’s gone through it knows that. The idea of a data breach like Optus or Medibank for fertility data is quite shocking.”
One way fertility apps can promise privacy while also monetising their users is by selling information which correlates but is not their health data, such as how often a user uses the app and if they’ve bought a subscription to the app.
“It’s quite sneaky the way they can say they’re not selling your data but then extract information like the fact that you’ve downloaded it,” Bower said. “If you’re an active user, that indicates that you’re currently pregnant, so there’s things they can infer.”
Although Kemp’s analysis recommends improvements for all 12 tested applications, she recommended steering away from some completely, including BabyCentre, What to Expect and Glow and Ovia apps.
She called on privacy and consumer regulators to scrutinise the fertility apps over their claims and for the government to enact reforms recommended in the Privacy Act review that include stricter security obligations, the “fair and reasonable” test for data collection, and defining technical identifiers and usage data are included under the act.
Bower echoed these calls: “Looking at it, you can see how the power has swung towards businesses in privacy matters. That’s why the Privacy Act review is so important. We need those reforms to protect consumers.”
Appalling but not surprising in the slightest. I want the EU’s privacy legislation.