Before You Sign Up: A 7-Point Privacy Checklist for Health and Medication Apps
Before You Sign Up: A 7-Point Privacy Checklist for Health and Medication Apps
Read the privacy policy before you hand a health app your email and your records, and look for seven specific answers. Most policies are long, but the parts that matter fit on one page. Below is the checklist, with PeptideMate, a free peptide tracker, used as a real example of what good answers look like.
1. What can you do without an account?
The less an app needs from you up front, the better. Being able to read guides or use tools without signing up means you can judge the app before it has your email at all. PeptideMate's policy says reading guides and using its calculators needs no account, and that the numbers typed into the calculators are not sent to its server.
2. Is your data sold or shared with advertisers?
This should be a clear yes or no, not a paragraph of "partners". Look for a direct sentence. PeptideMate's is: "We do not sell your data, share it with advertisers or use it to recommend anything."
3. Are there ad or analytics trackers?
Trackers on a health site can reveal what you are reading about. Check which pages set cookies and why. PeptideMate states its public pages set no cookies and use no advertising or analytics trackers, while the web app uses session and security cookies that it says are not used for tracking.
4. Can you export your data?
If you can't get your records out, you are locked in. Look for a self-service export in a common format. PeptideMate's settings include "Download my data", which gives CSV files of doses, vials, protocols and check-ins.
5. Can you delete your account yourself?
Deletion should be one action in settings, not an email you have to chase. PeptideMate's "Delete my account" permanently removes the account and every record in it, and you can also request deletion by email.
6. Who at the company can see your records?
Few policies answer this, so it is a good sign when one does. PeptideMate says staff with full admin access can view account details and dose, vial and protocol records, that each access is logged, and that notes and check-ins are not shown in its admin tools. That is honest, and it tells you what to keep in your private notes.
7. What happens when you sign in with Google or Apple?
Social sign-in is convenient, but it shares profile details. Check exactly which ones. PeptideMate's policy lists name, email and profile picture for Google sign-in.
Where temp mail fits in
Run this checklist before you create the account. While you are still deciding, use a temporary email for newsletters, downloads or anything that only needs a one-time confirmation. When you commit to an app that will hold your records, sign up with an address you will still have next year, because export, password reset and deletion all run through it.
The checklist at a glance
- What works without an account?
- Is data sold or shared with advertisers?
- Which trackers and cookies are used?
- Can you export your data?
- Can you delete your account yourself?
- Who at the company can see your records?
- What does social sign-in share?
Want to see a full example? Read PeptideMate's privacy policy with this list next to it.
Policy details are quoted from PeptideMate's published privacy policy at the time of writing. This article is about privacy, not medical advice.
