Is your health app safe? Seven questions to ask

Health information is some of the most personal data you have. Before you put it into an app, it’s worth a few minutes of questions. Here are seven. We answer each for Kinsu, so you can see what a straight answer looks like.

1. Who makes it, and how can I reach them?

A real app names the company and gives an address or email for questions and complaints. Look for a privacy policy that names a person responsible for your complaints.

Kinsu: it’s made by Kinsu Health, India. Complaints and questions about your data go to kinsu.health@gmail.com, which reaches our grievance officer. See about us.

2. What leaves my phone?

Some apps send everything to a server. Others keep records on the phone. Ask which, and what exactly is sent, to whom.

Kinsu: your records stay on your phone. Two things leave it: your mobile number, which Google Firebase uses to text you a sign-in code, and an encrypted copy of your recovery key. Signing in also sends Firebase technical details such as your IP address.

3. How are my records protected?

Look for plain words, not slogans. “Encrypted” should say where.

Kinsu: records are encrypted on your phone. We don’t say anything grander than that.

4. Who can open them?

If someone picks up your phone, can they read your health records?

Kinsu: the app opens only with your fingerprint, face or screen lock, and won’t set up on a phone without a screen lock. Reminders say only that a dose is due, unless you switch names on.

5. Can I delete everything?

You should be able to delete your account and your data without writing letters.

Kinsu: yes, from Settings, or at kinsu.health/delete-account.

6. What does it say it can’t do?

Honest apps list their limits. A health app that promises to diagnose, cure or predict is making a claim only a doctor can make.

Kinsu: it isn’t a medical device and doesn’t diagnose or treat anything. It doesn’t share records between phones yet, and records can’t move to a new phone. We list this on the site as plainly as what it does do.

7. Does it show ads, or sell my data?

Free apps are often paid for by advertising or data. Ask how the app earns its money, and check the policy for any selling or sharing.

Kinsu: the app has no ads and no analytics, and nothing you put in it is sold.

Read the policy, then decide

A privacy policy is dull, but a few minutes of reading is worth it. Our privacy policy explains each point above in full, and privacy and security puts it in plain words. If an app can’t answer these seven questions, think twice about what you put in it.