Review a health app's privacy and sharing choices

Identify who provides the app

1. Find the app operator and whether the service is provided through a health-care provider or another covered relationship. HHS describes different HIPAA coverage for covered-entity/business-associate services and ordinary personal-use apps. HHS: personal devices and HIPAA scope

Read the collection and sharing notice

1. Use the published privacy notice to list what information the app collects and how it is used or shared. The FTC recommends looking for a plain-language explanation, including reasons for sharing and limits on recipients. FTC: health-app privacy review
2. Review the app's privacy settings for collection and sharing choices. Check their actual scope before selecting an option. The FTC's consumer advice recommends examining these controls rather than relying on default settings. FTC: health-app privacy review

Review permissions against the feature needed

1. Compare location, contact and other requested access with the feature being used. The FTC advises developers to limit access to what is needed and use narrower platform controls where available. Use the linked current permission guides for the applicable phone menus. FTC: app permissions and third parties
2. For location access, review whether it is necessary for the specific feature. HHS recommends limiting unnecessary location permissions and notes that changing them can affect functionality. HHS: personal devices and HIPAA scope

Keep the app and phone updated

1. Keep both the app and phone operating system updated. The FTC's consumer advice notes that updates can include privacy and security fixes. FTC: health-app privacy review

Record what the review actually establishes

Keep the notice date, selected settings and any provider answer about sharing. The FTC's guidance emphasizes privacy promises and responsibility for third-party components. A personal settings review identifies visible choices and claims; it does not establish a complete independent compliance audit. FTC: app permissions and third parties