The BTS (Behind The
Screens) of Privacy Policies – Health Apps Edition
Screens) of Privacy Policies – Health Apps Edition
Decoding the T&C of Popularly Used Health Applications
In our series of privacy policy analyses, we highlighted how privacy policies are drafted using vague, incomprehensible, and inaccessible language. To put this to the test, we analyzed 12 commonly used applications’ privacy policies, and our findings left us surprised. You can find the analysis here.
In the next edition of this analysis, we picked 6 commonly used health applications and assessed how protective they are of your personal health data. Here’s what we found:
- 2 out of 6 applications do not ask for your prior consent before collecting and processing your health data
- All of the privacy policies were only available in Hindi and English, and none of the regional or Scheduled Languages
- Take-it-or-leave-it: In all the applications, users do not have a say when it comes to accessing their services; they must either consent to all their policies or deactivate their account and stop using their service.
- Whether or not you used any location-based health services (for example, to find a medical practitioner or pathology lab near you), all of the 6 applications required your location.
- As compared to the general applications covered in our previous analysis, the transfer and sharing policies for health applications had broader exemptions and multiple stakeholders involved.
- 5 out of 6 applications anonymized your personal health data for sharing and analytical purposes, however only 3 employed additional cybersecurity measures for encrypting your data while it is stored in their internal servers.
To understand our methodology and how to navigate this analysis, click here
OUR ANALYSIS
-
Ayushman Bharat Health Account (ABHA) Application
What They Collect From You:
Necessary and Legitimate Data Collection Intrusive but has legitimate purpose Unnecessary, Intrusive Data Collection - Basic profile data (that are mandatory) such as name, year of birth, gender, state, district, ABHA Number, geo-coordinates and email
- Non-mandatory data such as date/month of birth, mobile number, and address
- The App uses the mobile devices’ external storage to access files/documents. The App uses the cache memory of the mobile device to enable the user to access medical & health records in the form of PDFs or any other format that can also be downloaded by the user on a mobile device.
- Mobile device information (including hardware model, operating system, mobile network information, etc.)
Where does my data go?Your information may be shared with- Any individual or entity under ABDM with whom the user consents to sharing such data. The consent collected from the user must be free, clear, informed and specific consent.
- With third parties, only if it is required by applicable law of the land. Where appropriate, encryption methods are used to protect sensitive personal data to meet the Central Government’s, State governments’ or ABDM’s obligations under any applicable law.
Are they anonymising/encrypting the sensitive information they collect from me?Where appropriate, encryption methods are used to protect sensitive personal data or any other data that must remain secure in order to meet Central, State government or ABDM’s obligations under applicable law.
However, other security safeguards have been expressly adopted, such as mandating data management protocols to be followed by data processors, data protection impact assessments, maintenance of records, etc.What can I do if I don’t want my data to be collected or if I want to delete this information?The privacy policy expressly grants the user the right to withdraw their consent and the procedure thereunder. In addition to this, the users also have a right to restrict or object to the disclosure of any personal data.
In case of any grievances, a request may be sent through email(gro.ndhm@nha.gov.in) or through the designated Grievance Portal (found at https://grievance.abdm.gov.in). The Grievance Officer can be directly contacted at the Toll-Free Number: 1800-11-4477 / 14477
No mention of the grievance handling timeline or procedure.Data Protection ScoreWhat do they access
Plain Language & Readability3/5
-
ISHT Application (National AIDS Control Organization)
What They Collect From You:
Necessary and Legitimate Data Collection Intrusive but has legitimate purpose Unnecessary, Intrusive Data Collection - Personal information and contact details such as username, password, mobile number and email address.
- Regular server logs, such as pages you visited, and the date and time stamps of your visit.
- Additional server logs, which include IP (Internet Protocol) address, domain name, browser type, operating system and files you downloaded
Where does my data go?Your name and registration details shall remain confidential and will only be shared with authorized application personnel and program implementation and evaluation teams. Information on your usage, frequency of usage, and progress on your training within the ISHTH program will be collected by the system and used for internal analysis by NACO. This data shall not be shared with any third party except with authorized authorities as required by applicable regulations.Are they anonymising/encrypting the sensitive information they collect from me?Industry-standard security measures have been implemented in the application to protect your data, such as encryption protocols and security features to ensure the confidentiality and integrity of your data during transmission.What can I do if I don’t want my data to be collected or if I want to delete this information?Point of contact provided at 011-43509999/011-23731778, however, it is not specified whether they would function as a Grievance Officer. No procedure or timeline has been provided for handling grievances and redressing complaints.Data Protection ScoreWhat do they access
Plain Language & Readability4/5
-
Pradhan Mantri Surakshit Matritva Abhiyan (PMSMA)
What They Collect From You:
Necessary and Legitimate Data Collection Intrusive but has legitimate purpose Unnecessary, Intrusive Data Collection - Personal information and contact details such as username, password, mobile number and email address.
- Regular server logs, such as pages you visited, and the date and time stamps of your visit.
- The documents downloaded from the website
This website logs your visit information for statistical purposes, such as - your server’s address
- the name of the top-level domain from which you access the Internet
- the type of browser you use
- the previous Internet address from which you linked directly to the site.
Where does my data go?Your data will only be shared with third parties with your consent, however, these third parties have not been defined in the privacy policy. Your personal information and browsing activities may be shared with a law enforcement agency on the issuance of a warrant.Are they anonymising/encrypting the sensitive information they collect from me?No specific details have been provided on any cybersecurity measures and whether the data stored in their internal servers would be anonymized or encrypted.What can I do if I don’t want my data to be collected or if I want to delete this information?In case you feel that the privacy policy has not been complied with, then you can contact support@pmsma.nhp.gov.in or 011 26165959. No procedure or timeline has been provided for handling grievances and redressing complaints.Data Protection ScoreWhat do they access
Plain Language & Readability4/5
-
Arogya Setu
What They Collect From You:
Necessary and Legitimate Data Collection Intrusive but has legitimate purpose Unnecessary, Intrusive Data Collection - Name
- Phone Number
- Age
- Sex
- Beneficiary ID and user activity on CoWIN
- ABHA Number
- Aadhar Number
- Profession
Where does my data go?The data can be used by the Government of India or State Governments for- tracking vaccination progress and status,
- generating reports,
- heat maps and other statistical visualizations for the purpose of the management of COVID-19 vaccination in the country,
- generating vaccination certificates,
- and to provide users general notifications pertaining to COVID-19 vaccination as may be required.
- To provide the facilities and services under the ABDM and ABHA ecosystem
The data can also be shared with healthcare providers, medical practitioners, doctors, health information users, etc., only with the consent of the user.
Are they anonymising/encrypting the sensitive information they collect from me?Data is stored in an aggregated and anonymised format to analyse and monitor healthcare programs to aid policy decisions; to generate reports, heat maps and statistical visualizations; and support overall healthcare services provided by the Government of India.
In addition to this, data is encrypted in transit as well as at rest. Personal information provided at the time of registration is encrypted before being uploaded to the server, where it is stored in an encrypted format.What can I do if I don’t want my data to be collected or if I want to delete this information?For any concerns or questions in relation to the privacy policy, users may address the same to support.aarogyasetu@gov.in. No procedure or timeline has been provided for handling grievances and redressing complaints.Data Protection ScoreWhat do they access
Plain Language & Readability2/5
-
eSanjeevani OPD
What They Collect From You:
Necessary and Legitimate Data Collection Intrusive but has legitimate purpose Unnecessary, Intrusive Data Collection - Name
- Gender
- Age
- Health records
- Address
- Mobile number
- Email ID
Where does my data go?Your data will used by the Ministry of Health and Family Welfare for the purpose of generating reports, statistical visualisations, research and academic, public health and health delivery-oriented purposes. No data will be disclosed, transferred or sold to third parties.Are they anonymising/encrypting the sensitive information they collect from me?There are two levels of security measures that are mentioned: all personal information provided is encrypted before uploading and any data that is used for public health purposes is anonymized and/or aggregated.What can I do if I don’t want my data to be collected or if I want to delete this information?Users can register their grievances and account deletion requests here: https://esanjeevani.mohfw.gov.in/#/contact-us. No procedure, timeline or designated grievance officer has been provided for handling grievances and redressing complaints.Data Protection ScoreWhat do they access
Plain Language & Readability3/5
-
Practo
What They Collect From You:
Necessary and Legitimate Data Collection Intrusive but has legitimate purpose Unnecessary, Intrusive Data Collection - Contact data, such as phone and email
- Service data on appointments taken and use of services.
- Demographic data, including gender, age, pin code, etc.
- Credit card information and/or other financial institution information
- Details of the insurance plan and the provider.
- IP Address
- Name and details of the user’s ISP
- Browser details
- Operating System
- Any personal information publicly available on the user
Where does my data go?Your data may be shared for the following:- For commercial purposes and in an aggregated or non-personally identifiable form for research, statistical analysis, marketing, feedback and business intelligence purposes (including analyzing customer behavior)
- For sale or transfer of such research, statistical or intelligence data in an aggregated or non-personally identifiable form to third parties and affiliates
- To process payment instructions including those through independent third party service providers such as payment gateways, banking and financial institutions, pre-paid instrument and wallet providers for processing of payment transaction or deferral of payment facilities.
- Practo may also share and/or disclose some of the aggregate findings (not the specific data) in anonymized form with advertisers, sponsors, investors, strategic partners, and others.
- Practo may allow authorized third parties to place or recognize a unique cookie on the User’s browser
It is not clarified the extent of sharing to third parties, and whether doctors are considered as third parties or part of the company itself. There exists no clear information in this regard. Furthermore, for any other purpose, it is unclear whether any third party.
Are they anonymising/encrypting the sensitive information they collect from me?For commercial and analytic purposes, all data is anonymised. In the collection, processing and handling of financial data, it will be stored in an encrypted form. The app uses data at various levels for marketing purposes and so on, none of which are anonymised or encrypted.What can I do if I don’t want my data to be collected or if I want to delete this information?To delete your information from their servers, you must delete your account by contacting them at support@practo.com. Further, the information may be anonymised and then used in aggregate datasets.
No specifics regarding the timeline are mentioned. However, details of the Grievance Officer/Data Protection Officer have been provided.
Surabhi Patodia
Practo Technologies Pvt Ltd
WeWork Salarpuria Symbiosis,
Arekere Village, Begur Hobli,
Bannerghatta Road,
Bangalore – 560076.
Email: privacy@practo.comData Protection ScoreWhat do they access
Plain Language & Readability1/5
-
Apollo 24*7
What They Collect From You:
Necessary and Legitimate Data Collection Intrusive but has legitimate purpose Unnecessary, Intrusive Data Collection - Contact information: Name, Address, Contact details, Email ID, Phone Number
- Data regarding your usage of the Services – search history and history of the appointments
- Health information – medical records and history provided or is generated on the usage of any of the services availed by you from any entity in the Apollo Group;
- (For Doctors) Data regarding your medical qualifications, registrations, and certifications;
- Information regarding your insurance coverage (such as your insurance carrier and insurance plan)
- Demographic information: Gender, Date of Birth, Nationality
- Financial Information for payments
- Browsing history including the URL of the site that you visited prior to visiting the Website
- Internet Protocol (IP) address of your computer
- Details of your computer operating system
- type of web browser you are using
- ISP details
Where does my data go?Your data is shared with the following parties:- Services providers including :
- website hosting, data storage, software services, email services, marketing, fulfilling customer orders, providing payment-related services including payment aggregation, data analytics, data mining, providing customer services, and conducting surveys
- employees, data processors, consultants, business partners, and technology partners on a need-to-know basis
- Health Services Professionals
- Business Affiliates
- Law enforcement agencies
- And, “other third parties”
Are they anonymising/encrypting the sensitive information they collect from me?Data that may be sent for the purposes of advertising, research firms and other third party partners are anonymised. No security measures are mentioned regarding personal or sensitive dataWhat can I do if I don’t want my data to be collected or if I want to delete this information?Can contact grievance officer Mr. Madhu Aravind at privacy@apollo247.com. Mentions that response will be in reasonable time but no specific timeline has been prescribed.Data Protection ScoreWhat do they access
Plain Language & Readability2/5
-
Eka Care
What They Collect From You:
Necessary and Legitimate Data Collection Intrusive but has legitimate purpose Unnecessary, Intrusive Data Collection - User information: name, address, email, phone number, medical records and medical history, physical, psychological and mental health condition, payment information
- For tele-consultation – camera and audio
- Storage and Photos for specific purposes.
- Google Gmail for syncing health records
- Information, (viz. type of internet browser and operating system used, domain name of the website from which You came, number of visits, average time spent on the site, pages viewed etc.)
Where does my data go?Data is shared with- To contractors, service providers and other third parties for analytics and communications and who are bound by contractual obligations to keep Personal Information confidential;
- For legal purposes which may include court orders, disputes, requests from government or quasi-judicial bodies, for mergers and other similar corporate matters.
Are they anonymising/encrypting the sensitive information they collect from me?User information is stored in an encrypted format. There is no mention of data anonymisation/aggregation.What can I do if I don’t want my data to be collected or if I want to delete this information?For deletion of any data, one has to email to privacy@orbi.healt. There is no mention of a timeline that needs to be adhered to or officer responsible. Further it is vague as elsewhere it is mentioned “ We cannot delete the Personal Information for which We are custodians on behalf of Third Party Service Providers”Data Protection ScoreWhat do they access
Plain Language & Readability2/5
