Popular fertility apps are engaging in widespread data misuse, including on gender, period, and pregnancy

New research reveals critical privacy gaps in fertility apps used by Australian consumers—underscoring the urgent need for reform of the Privacy Act.

The spawn app offers several features. For example, they can help users track their menstrual cycle, identify “conceiving times” if they are trying to conceive, track the different stages and symptoms of pregnancy, and prepare for parenthood until the birth of the baby.

These apps collect deeply sensitive data on consumers’ sex lives, health, emotional states and menstrual cycles. And many of them are intended for children ages 13 and up.

my report published today analyzed Privacy Policymessages and settings of the 12 most popular fertility apps used by Australian consumers (excluding apps that require a connection to a wearable device).

This analysis uncovered a number of disturbing behaviors by these apps, including:

• confusing and misleading Privacy message
• lack of choice in data usage
• inadequate de-identification measures when data is shared with other organizations
• retain data for years even after consumers stop using the app, exposing them to unnecessary risk from potential data breaches.

Collected data

The apps in this study collect intimate data from consumers, such as:

• their pregnancy test results
• when they had sex and whether they had an orgasm
• whether they used condoms or the “withdrawal” method
• when they menstruate
• how their mood changes (including anxiety, panic attacks, and depression)
• and if they have health condition such as polycystic ovary syndrome, endometriosis, or fibroids.

Some ask for unnecessary details, such as when the user smokes and drinks alcohol, their education level, whether they have difficulty paying their bills, whether they feel safe at home and whether they have stable housing.

What do they also monitor? support groups you participate in, what you add to your “to-do list” or “question for the doctor” and the articles you read. All of this creates a more detailed picture of your health, family situation, and intentions.

Misleading or misleading privacy notice

Consumers should expect the clearest information about how that data is collected, used and disclosed. However, we found some messages to be very confusing or misleading.

Some apps say “we will never sell your data.” However, the fine print of the privacy policy has a provision that allows them to sell all of your data as part of an app or database sale to another company.

This possibility is not just theoretical. Of the 12 apps included in the study, one was previously taken over by a pharmaceutical development company and the other two by a digital media company.

Other apps explain privacy settings in language that makes it virtually impossible for consumers to understand what they’re choosing, or obscure privacy settings by placing them multiple clicks and scrolls away from the home screen.

Holding sensitive data for too long

The big data breach over the past six months highlight the risk of companies holding onto personal data longer than necessary.

Violation of very sensitive information about health and sexual activity can lead to discrimination, exploitation, humiliation or extortion.

Most of the apps we analyzed retain user data for at least three years after the user exits the app—or seven years for a brand. Some applications do not indicate when user data will be deleted.

Can’t count on ‘de-identification’

Some apps also don’t give consumers a choice about whether their “unidentified” health data will be sold or transferred to other companies for research or business. Or, by default, they ask consumers to opt-in to these additional uses, forcing the user to opt out.

Furthermore, some of this data is not actually redefined. For example, remove your name and email address and replace it with a unique number that is not de-identified for legal purposes. Someone just needs to figure out the connection between your name and that number to link your entire profile to you.

When the alleged unidentified Medicare records were released in 2016, University of Melbourne researchers showed how only a few data points can connect an unknown record to a single individual.

Need reform

This study highlights the unfair and unsafe practices of data usage faced by consumers when they use fertility apps. And these findings reinforce the need to update Australia’s privacy laws.

We need to improve what data is covered by the Privacy Act, what choices consumers can make about their data, what data is prohibited from use, and which companies There must be a security system.

The government is looking for submit on potential privacy law reforms through March 31.

In the meantime, if you’re using a fertility app, there are a few steps you can take to help reduce some of the privacy risks:

1. When launching the app for the first time, do not consent to your data being tracked or you can restrict ad tracking through your iPhone device settings
2. Do not log in via social media accounts
3. Don’t answer questions or add data you don’t need for your own purposes
4. Do not share your Apple Health or FitBit data
5. If the app offers privacy choices, choose not to track and sell or use your data for research purposes, and delete your data when you stop using the app
6. Remember that every article you read, time you spend on it, any groups you join, and comments you make there can all be added to your profile.

This post was reposted from Conversation under Creative Commons license. Read original article.