CoChat
Sign Up
Cited by 109Privacy, Security, and Data ProtectionPrivacy-Preserving Technologies in DataMobile Health and mHealth Applications

On the privacy of mental health apps: An empirical investigation and its implications for app development

Open access
Iwaya, Leonardo Horn, Babar, M. Ali, Rashid, Awais, Wijayarathna, Chamila·2023·Empirical Software Engineering
DOI 10.1007/s10664-022-10236-0PMC PMC9643945
Open this paper in CoChat — free accountOpen PDF

Abstract

An increasing number of mental health services are now offered through mobile health (mHealth) systems, such as in mobile applications (apps). Although there is an unprecedented growth in the adoption of mental health services, partly due to the COVID-19 pandemic, concerns about data privacy risks due to security breaches are also increasing. Whilst some studies have analyzed mHealth apps from different angles, including security, there is relatively little evidence for data privacy issues that may exist in mHealth apps used for mental health services, whose recipients can be particularly vulnerable. This paper reports an empirical study aimed at systematically identifying and understanding data privacy incorporated in mental health apps. We analyzed 27 top-ranked mental health apps from Google Play Store. Our methodology enabled us to perform an in-depth privacy analysis of the apps, covering static and dynamic analysis, data sharing behaviour, server-side tests, privacy impact assessment requests, and privacy policy evaluation. Furthermore, we mapped the findings to the LINDDUN threat taxonomy, describing how threats manifest on the studied apps. The findings reveal important data privacy issues such as unnecessary permissions, insecure cryptography implementations, and leaks of personal data and credentials in logs and web requests. There is also a high risk of user profiling as the apps’ development do not provide foolproof mechanisms against linkability, detectability and identifiability. Data sharing among 3rd-parties and advertisers in the current apps’ ecosystem aggravates this situation. Based on the empirical findings of this study, we provide recommendations to be considered by different stakeholders of mHealth apps in general and apps developers in particular. We conclude that while developers ought to be more knowledgeable in considering and addressing privacy issues, users and health professionals can also play a role by demanding privacy-friendly apps.

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Integrity signals

Registry

Crossref · 10.1007/s10664-022-10236-0

Cites

8 of 8 references verified0 citation errors · 0 not checkable

Statistics

Claims the paper makes

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Claims other papers make about this one

Each is checked against this paper’s own text: does it say what the citing paper says it does?

Self-check

Percentages, sums and reported differences re-computed from the paper’s own numbers.

The self-check needs the paper’s full text.

Cites

Flagged first, then by citations

Research works printed but not linked: 46

  1. Adhikari R, Richards D, Scott K (2014) Security and privacy issues related to the use of mobile health apps. In: 25th Australasian conference on information systems, ACIS 2014, ACIS, pp 1–11
  2. Alepis E, Patsakis C (2017) Hey doc, is this normal?: Exploring Android permissions in the post marshmallow era. In: International conference on security, Privacy, and Applied Cryptography Engineering. Springer, pp 53–73
  3. Aljedaani B, Ahmad A, Zahedi M, Babar MA (2020) An Empirical study on developing secure mobile health apps: The developers’ perspective. In: 2020 27Th asia-pacific software engineering conference (APSEC). IEEE, pp 208–217
  4. Aljedaani B Babar MA Challenges with developing secure mobile health applications: Systematic review JMIR Mhealth and Uhealth 2021 9 6 e15654 10.2196/15654 34152277 PMC8277314 · DOI
  5. Ament C (2017) The ubiquitous security expert: Overconfidence in information security. In: Proceedings of the 38th international conference on information systems (ICIS)
  6. Arzt S Rasthofer S Fritz C Bodden E Bartel A Klein J Le Traon Y Octeau D McDaniel P Flowdroid: Precise context, flow, field, object-sensitive and lifecycle-aware taint analysis for Android apps Acm Sigplan Notices 2014 49 6 259 269 10.1145/2666356.2594299 · DOI
  7. Aviram N, Schinzel S, Somorovsky J, Heninger N, Dankel M, Steube J, Valenta L, Adrian D, Halderman JA, Dukhovni V et al (2016) DROWN: Breaking TLS using SSLv2. In: 25Th USENIX security symposium (USENIX) security, vol 16, pp 689–706
  8. Bal G, Rannenberg K (2014) User control mechanisms for privacy protection should go hand in hand with privacy-consequence information: The case of smartphone apps. In: Proceedings of W3C workshop on privacy and user-centric controls, pp 1–5
  9. Blenner SR Köllmer M Rouse AJ Daneshvar N Williams C Andrews LB Privacy policies of Android Diabetes Apps and Sharing of Health Information JAMA 2016 315 10 1051 1052 10.1001/jama.2015.19426 26954415 · DOI
  10. Deng M Wuyts K Scandariato R Preneel B Joosen W A privacy threat analysis framework: supporting the elicitation and fulfillment of privacy requirements Requir Eng 2011 16 1 3 32 10.1007/s00766-010-0115-7 · DOI
  11. Durumeric Z, Li F, Kasten J, Amann J, Beekman J, Payer M, Weaver N, Adrian D, Paxson V, Bailey M et al (2014) The matter of heartbleed. In: Proceedings of the 2014 conference on internet measurement conference, pp 475–488,
  12. Egele M, Brumley D, Fratantonio Y, Kruegel C (2013) An empirical study of cryptographic misuse in Android applications. In: Proceedings of the 2013 ACM SIGSAC conference on computer & communications security, pp 73–84
  13. Enck W Gilbert P Han S Tendulkar V Chun BG Cox LP Jung J McDaniel P Sheth AN Taintdroid: an information-flow tracking system for realtime privacy monitoring on smartphones ACM Transactions on Computer Systems (TOCS) 2014 32 2 1 29 10.1145/2619091 · DOI
  14. European Commission Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) Official Journal of the European Union 2016 119 April 1 88
  15. Gardiner J, Chowdhury PD, Halsey J, Tahaei M, Elahi T, Rashid A (2021) Building A privacy testbed: Use cases and design considerations. In: Proceedings of 4th international workshop on security and privacy requirements engineering (SECPRE)
  16. He D Naveed M Gunter CA Nahrstedt K Security concerns in Android mhealth apps AMIA Annual Symposium proceedings AMIA Symposium 2014 2014 645—654 25954370 PMC4419898
  17. Howard M, Lipner S (2006) The security development lifecycle, vol 8. Microsoft Press Redmond
  18. Huang HY, Bashir M (2017) Android app permission and users’ adoption: a case study of mental health application. In: Tryfonas T (ed) Human aspects of information security, privacy and trust. Springer International Publishing, Cham, pp 110–122
  19. Hussain M Al-Haiqi A Zaidan AA Zaidan BB Kiah M Iqbal S Iqbal S Abdulnabi M A security framework for mhealth apps on Android platform Computers & Security 2018 75 191 217 10.1016/j.cose.2018.02.003 · DOI
  20. Hutton L Price BA Kelly R McCormick C Bandara AK Hatzakis T Meadows M Nuseibeh B Assessing the privacy of mhealth apps for self-tracking: heuristic evaluation approach JMIR Mhealth and Uhealth 2018 6 10 e9217 10.2196/mhealth.9217 PMC6231850 30348623 · DOI · Paper page
  21. Iwaya LH Fischer-Hübner S RM Åhlfeldt Martucci LA Mobile health systems for community-based primary care: Identifying controls and mitigating privacy threats JMIR Mhealth and Uhealth 2019 7 3 e11642 10.2196/11642 30892275 PMC6446152 · DOI · Paper page
  22. Krüger S, Nadi S, Reif M, Ali K, Mezini M, Bodden E, Göpfert F, Günther F, Weinert C, Demmler D et al (2017) Cognicrypt: Supporting developers in using cryptography. In: 2017 32nd IEEE/ACM international conference on automated software engineering (ASE), IEEE, pp 931–936
  23. LaMalva G, Schmeelk S (2020) MobSF: Mobile health care Android applications through the lens of open source static analysis. In: 2020 IEEE MIT Undergraduate Research Technology Conference (URTC), IEEE, pp 1–4
  24. Lee J (2019) Identifying and mitigating misuse of secrets in Android with dynamic analysis techniques. PhD thesis, Rice University
  25. Lippi M Pałka P Contissa G Lagioia F Micklitz HW Sartor G Torroni P CLAUDETTE: an automated detector of potentially unfair clauses in online terms of service Artificial Intelligence and Law 2019 27 2 117 139 10.1007/s10506-019-09243-2 · DOI
  26. Mantovani E Antokol J Hoekstra M Nouwt S Schutte N Zilgalvis P Castro Gómez-Valadés JP Prettner C Towards a Code of Conduct on Privacy for mHealth to Foster Trust Amongst Users of Mobile Health Applications 2017 Cham Springer International Publishing 81 106
  27. Marvel CL Paradiso S Cognitive and neurological impairment in mood disorders Psychiatric Clinics 2004 27 1 19 36 15062628 PMC2570029
  28. Momen N (2020) Measuring apps’ privacy-friendliness: Introducing transparency to apps’ data access behavior. PhD thesis, Karlstads universitet
  29. Muchagata J, Ferreira A (2019) Mobile apps for people with dementia: Are they compliant with the general data protection regulation (GDPR)?. In: Proceedings of the 12th International Joint Conference on Biomedical Engineering Systems and Technologies -Volume 5: HEALTHINF, INSTICC, SciTePress, pp 68–77
  30. O’Loughlin K Neary M Adkins EC Schueller SM Reviewing the data security and privacy policies of mobile apps for depression Internet Interventions 2019 15 110 115 10.1016/j.invent.2018.12.001 30792962 PMC6371412 · DOI · Paper page
  31. Parker L Halter V Karliychuk T Grundy Q How private is your mental health app data? an empirical study of mental health app privacy policies and practices Int J Law Psychiatry 2019 64 198 204 10.1016/j.ijlp.2019.04.002 31122630 · DOI · Paper page
  32. Powell AC Singh P Torous J The complexity of mental health app privacy policies: a potential barrier to privacy JMIR Mhealth and Uhealth 2018 6 7 e158 10.2196/mhealth.9871 30061090 PMC6090172 · DOI · Paper page
  33. Ranganath VP Mitra J Are free Android app security analysis tools effective in detecting known vulnerabilities? Empir Softw Eng 2020 25 1 178 219 10.1007/s10664-019-09749-y · DOI
  34. Rosenfeld L Torous J Vahia IV Data security and privacy in apps for dementia: An analysis of existing privacy policies The American Journal of Geriatric Psychiatry 2017 25 8 873 877 10.1016/j.jagp.2017.04.009 28645535 · DOI · Paper page
  35. Samhi J, Bartel A, Bissyandé TF, Klein J (2021) Raicc: Revealing Atypical inter-component communication in Android apps. In: 2021 IEEE/ACM 43rd international conference on software engineering (ICSE), IEEE, pp 1398–1409
  36. Sampat BH Prabhakar B Privacy risks and security threats in mhealth apps Journal of International Technology and Information Management 2017 26 4 126 153
  37. Shipp L Blasco J How private is your period?: a systematic analysis of menstrual app privacy policies Proc Priv Enhancing Technol 2020 2020 4 491 510 10.2478/popets-2020-0083 · DOI
  38. Solomos K, Ilia P, Ioannidis S, Kourtellis N (2019) TALON: An automated framework for cross-device tracking detection. In: 22nd International Symposium on Research in Attacks, Intrusions and Defenses (RAID 2019), USENIX Association, Chaoyang District, Beijing, pp 227–241
  39. Sunyaev A Dehling T Taylor PL Mandl KD Availability and quality of mobile health app privacy policies J Am Med Inform Assoc 2014 22 e1 e28 e33 10.1136/amiajnl-2013-002605 25147247 PMC11888337 · DOI · Paper page
  40. Timpson S The importance of a layered privacy policy on all mobile internet sites and mobile marketing campaigns International Journal of Mobile Marketing 2009 4 1 57 61
  41. Wagner A, Mesbah N (2019) Too confident to care: Investigating overconfidence in privacy decision making. In: Proceedings of the 27th European conference on information systems (ECIS)
  42. Wei F Roy S Ou X Amandroid: A precise and general inter-component data flow analysis framework for security vetting of Android apps ACM Transactions on Privacy and Security (TOPS) 2018 21 3 1 32 10.1145/3183575 · DOI
  43. Wong MY, Lie D (2016) Intellidroid: a targeted input generator for the dynamic analysis of Android malware. In: NDSS, vol 16, pp 21–24
  44. Zaeem RN, Barber KS (2020) The effect of the gdpr on privacy policies: Recent progress and future promise. ACM Transactions on Management of Information Systems
  45. Zaeem RN German RL Barber KS Privacycheck: Automatic summarization of privacy policies using data mining ACM Trans Internet Technol (TOIT) 2018 18 4 1 18 10.1145/3127519 · DOI
  46. Zaeem RN, Anya S, Issa A, Nimergood J, Rogers I, Shah V, Srivastava A, Barber KS (2020) PrivacyCheck v2: A tool that recaps privacy policies for you. In: Proceedings of the 29th ACM international conference on information & knowledge management, pp 3441–3444

Cited by

Sorted by citations

Authors
Iwaya, L. H., Babar, M. A., Rashid, A., & Wijayarathna, C.
Affiliations
  • Karlstad University (SE)
  • The University of Adelaide (AU)
  • University of Bristol (GB)
Corresponding author
Iwaya, Leonardo Horn
ORCID
Venue
Empirical Software Engineering
Publisher
Springer Science and Business Media LLC
Published
2022-11-08
Volume
28
Issue
1
ISSN
  • 1382-3256 (ISSN-L)
  • 1573-7616
DOI
10.1007/s10664-022-10236-0
PMC
PMC9643945
OpenAlex
W4308514785
Cited by
109
References
8
Citations by year
2026: 40 · 2025: 41 · 2024: 18 · 2023: 10
FWCI
24.82
Type
journal article
Language
en
Open access
Licence
Locations
  • Empirical Software Engineering (publishedVersion, cc-by)
  • arXiv (Cornell University) (submittedVersion)
  • Diva portal (Dalarna University Library) (submittedVersion, other-oa)
  • Bristol Research (University of Bristol) (submittedVersion, cc-by)
  • Explore Bristol Research (submittedVersion, cc-by)
  • arXiv (Cornell University)
Funders
  • Cyber Security Cooperative Research Centre
  • Horizon 2020 Framework Programme (830929)
  • Stiftelsen för Kunskaps- och Kompetensutveckling
  • Region Värmland (RV2018-678)
  • Engineering and Physical Sciences Research Council (EP/V011189/1)
  • Karlstad University
Topics
  • Social Sciences › Sociology and Political Science › Privacy, Security, and Data Protection
  • Physical Sciences › Computer Science › Artificial Intelligence › Privacy-Preserving Technologies in Data
  • Health Sciences › Health Professions › General Health Professions › Mobile Health and mHealth Applications
Keywords
mental health apps, mobile health, data privacy, privacy impact assessment, credential leakage, user profiling, third-party data sharing, privacy policy evaluation, mobile application security

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review