The Open UniversitySkip to content

Assessing the Privacy of mHealth Apps for Self-Tracking: Heuristic Evaluation Approach

Hutton, Luke; Price, Blaine A.; Kelly, Ryan; McCormick, Ciaran; Bandara, Arosha K.; Hatzakis, Tally; Meadows, Maureen and Nuseibeh, Bashar (2018). Assessing the Privacy of mHealth Apps for Self-Tracking: Heuristic Evaluation Approach. JMIR mHealth and uHealth, 6(10), article no. e185.

Full text available as:
PDF (Version of Record) - Requires a PDF viewer such as GSview, Xpdf or Adobe Acrobat Reader
Download (1MB) | Preview
DOI (Digital Object Identifier) Link:
Google Scholar: Look up in Google Scholar


Background: The recent proliferation of self-tracking technologies has allowed individuals to generate significant quantities of data about their lifestyle. These data can be used to support health interventions and monitor outcomes. However, these data are often stored and processed by vendors who have commercial motivations, and thus, they may not be treated with the sensitivity with which other medical data are treated. As sensors and apps that enable self-tracking continue to become more sophisticated, the privacy implications become more severe in turn. However, methods for systematically identifying privacy issues in such apps are currently lacking.
Objective: The objective of our study was to understand how current mass-market apps perform with respect to privacy. We did this by introducing a set of heuristics for evaluating privacy characteristics of self-tracking services.
Methods: Using our heuristics, we conducted an analysis of 64 popular self-tracking services to determine the extent to which the services satisfy various dimensions of privacy. We then used descriptive statistics and statistical models to explore whether any particular categories of an app perform better than others in terms of privacy.
Results: We found that the majority of services examined failed to provide users with full access to their own data, did not acquire sufficient consent for the use of the data, or inadequately extended controls over disclosures to third parties. Furthermore, the type of app, in terms of the category of data collected, was not a useful predictor of its privacy. However, we found that apps that collected health-related data (eg, exercise and weight) performed worse for privacy than those designed for other types of self-tracking.
Conclusions: Our study draws attention to the poor performance of current self-tracking technologies in terms of privacy, motivating the need for standards that can ensure that future self-tracking apps are stronger with respect to upholding users' privacy. Our heuristic evaluation method supports the retrospective evaluation of privacy in self-tracking apps and can be used as a prescriptive framework to achieve privacy-by-design in future apps.

Item Type: Journal Item
Copyright Holders: 2018 The Authors
ISSN: 2291-5222
Project Funding Details:
Funded Project NameProject IDFunding Body
Monetize Me? Privacy and the Quantified Self in the Digital EconomyEP/L021285/1EPSRC (Engineering and Physical Sciences Research Council)
Not Set3/RC/2094Science Foundation Ireland
Adaptive Security and Privacy291652-ASAPEuropean Research Council
Keywords: privacy; usable security and privacy; mHealth apps; mobile phone
Academic Unit/School: Faculty of Science, Technology, Engineering and Mathematics (STEM) > Computing and Communications
Faculty of Science, Technology, Engineering and Mathematics (STEM)
Faculty of Business and Law (FBL) > Business > Department for Strategy and Marketing
Faculty of Business and Law (FBL) > Business
Faculty of Business and Law (FBL)
Item ID: 57500
SWORD Depositor: Jisc Publications-Router
Depositing User: Jisc Publications-Router
Date Deposited: 12 Nov 2018 11:29
Last Modified: 02 May 2019 11:31
Share this page:


Altmetrics from Altmetric

Citations from Dimensions

Download history for this item

These details should be considered as only a guide to the number of downloads performed manually. Algorithmic methods have been applied in an attempt to remove automated downloads from the displayed statistics but no guarantee can be made as to the accuracy of the figures.

Actions (login may be required)

Policies | Disclaimer

© The Open University   contact the OU