Pulse Oximeter App Privacy Policies During COVID-19: Scoping Assessment

Rachele Hendricks-Sturrup

doi:10.2196/30361

Abstract

BackgroundPulse oximeter apps became of interest to consumers during the COVID-19 pandemic, particularly when traditional over-the-counter pulse oximeter devices were in short supply. Yet, no study to date has examined or scoped the state of privacy policies and notices for the top-rated and most downloaded pulse oximeter apps during COVID-19.ObjectiveThe aim of this study was to examine, through a high-level qualitative assessment, the state and nature of privacy policies for the downloaded and top-rated pulse oximeter apps during the COVID-19 pandemic to (1) compare findings against comparable research involving other mobile health (mHealth) apps and (2) begin discussions on opportunities for future research or investigation.MethodsDuring August-October 2020, privacy policies were reviewed for pulse oximeter apps that had either at least 500 downloads (Google Play Store apps only) or a three out of five-star rating (Apple Store apps only). In addition to determining if the apps had an accessible privacy policy, other key privacy policy–related details that were extracted included, but were not limited to, app developer location (country); whether the app was free or required paid use/subscription; whether an ads disclosure was provided on the app’s site; the scope of personal data collected; proportionality, fundamental rights, and data protection and privacy issues; and privacy safeguards.ResultsSix pulse oximeter apps met the inclusion criteria and only 33% (n=2) of the six apps had an accessible privacy policy that was specific to the pulse oximeter app feature (vs the app developer’s website or at all). Variation was found in both the regulatory nature and data privacy protections offered by pulse oximeter apps, with notable privacy protection limitations and gaps, although each app provided at least some information about the scope of personal data collected upon installing the app.ConclusionsPulse oximeter app developers should invest in offering stronger privacy protections for their app users, and should provide more accessible and transparent privacy policies. This is a necessary first step to ensure that the data privacy of mHealth consumers is not exploited during public health emergency situations such as the COVID-19 pandemic, where over-the-counter personal health monitoring devices could be in short supply and patients and consumers may, as a result, turn to mHealth apps to fill such supply gaps. Future research considerations and recommendations are also suggested for mHealth technology and privacy researchers who are interested in examining privacy implications associated with the use of pulse oximeter apps during and after the COVID-19 pandemic.

Highlights

Symptom and health behavior tracking applications or smartphone apps continue to grow in popularity along with government interest and oversight over the privacy practices of such apps [1]
Pulse oximeter apps became of interest to consumers during the COVID-19 pandemic, when traditional over-the-counter pulse oximeter devices were in short supply, as consumers sought to personally monitor themselves for hallmark symptoms of SARS-CoV-2 infection [16,17]
The app developer’s headquarter locations were disclosed for all except one of the six apps (OxyCare-[Pulse Oximeter]); apps were developed in Vietnam, Spain, the United States, China, and Canada

Summary

Introduction

Symptom and health behavior tracking applications or smartphone apps continue to grow in popularity along with government interest and oversight over the privacy practices of such apps [1]. To obtain a pulse oximetry reading, pulse oximeter devices project a light at a specific wavelength that is shined over a specific area of a person’s body while the device measures how much light is absorbed (vs transmitted) by the blood cells within that area of the body This process is somewhat similar to how mobile apps collect these same measurements, and studies have examined the differences in performance between pulse oximeter mobile apps and medical/hospital-grade pulse oximeters [19,20]. Conclusions: Pulse oximeter app developers should invest in offering stronger privacy protections for their app users, and should provide more accessible and transparent privacy policies This is a necessary first step to ensure that the data privacy of mHealth consumers is not exploited during public health emergency situations such as the COVID-19 pandemic, where over-the-counter personal health monitoring devices could be in short supply and patients and consumers may, as a result, turn to mHealth apps to fill such supply gaps. Future research considerations and recommendations are suggested for mHealth technology and privacy researchers who are interested in examining privacy implications associated with the use of pulse oximeter apps during and after the COVID-19 pandemic

Objectives

Methods

Results

Discussion

Conclusion