Pulse Oximeter App Privacy Policies During COVID-19: Scoping Assessment

With the increased use of mobile technologies in the health sector, patients are more and more concerned about their privacy protection. Particularly, due to the diversity of actors (physicians, healthcare organizations, Cloud providers…) and the heterogeneity of privacy policies defined by each actor, conflicts among these policies may occur. We believe that negotiation is one of the best techniques for resolving the issue of conflicting privacy policies. From this perspective, we present an approach and algorithm to negotiate privacy policies based on an extension of the bargaining model. Besides, in order to show how our solution can be applied, we present an example of conflicting privacy policies expressed using S4P, a generic language for specifying privacy preferences and policies.

BackgroundWithin the new digital health landscape, the rise of health apps creates novel prospects for health promotion. The market is saturated with apps that aim to increase physical activity (PA). Despite the wide distribution and popularity of PA apps, there are limited data on their effectiveness, user experience, and safety of personal data.ObjectiveThe purpose of this review and content analysis was to evaluate the quality of the most popular PA apps on the market using health care quality indicators.MethodsThe top-ranked 400 free and paid apps from iTunes and Google Play stores were screened. Apps were included if the primary behavior targeted was PA, targeted users were adults, and the apps had stand-alone functionality. The apps were downloaded on mobile phones and assessed by 2 reviewers against the following quality assessment criteria: (1) users’ data privacy and security, (2) presence of behavior change techniques (BCTs) and quality of the development and evaluation processes, and (3) user ratings and usability.ResultsOut of 400 apps, 156 met the inclusion criteria, of which 65 apps were randomly selected to be downloaded and assessed. Almost 30% apps (19/65) did not have privacy policy. Every app contained at least one BCT, with an average number of 7 and a maximum of 13 BCTs. All but one app had commercial affiliation, 12 consulted an expert, and none reported involving users in the app development. Only 12 of 65 apps had a peer-reviewed study connected to the app. User ratings were high, with only a quarter of the ratings falling below 4 stars. The median usability score was excellent—86.3 out of 100.ConclusionsDespite the popularity of PA apps available on the commercial market, there were substantial shortcomings in the areas of data safety and likelihood of effectiveness of the apps assessed. The limited quality of the apps may represent a missed opportunity for PA promotion.

Despite legally binding agreements between users and website owners, users often overlook website privacy policies due to their length and complexity. Transparency in these policies is crucial, particularly in Malaysia, where regulatory agencies face challenges ensuring compliance with the personal data protection act (PDPA) of 2010 due to intricate language and complex legal clauses. Machine learning has been used to analyse privacy policies under various legal frameworks, but no dataset currently exists for the Malaysian PDPA. Thus, to bridge this gap, we introduce a pilot corpus of 50 privacy policies specifically tailored to the Malaysian PDPA. This dataset is analysed and made available for academic research, offering insights into privacy regulations and identifying trends in privacy policy transparency. Our findings pave the way for the development of tools to enhance compliance with PDPA standards and improve policy readability for users. The corpus also serves as a foundation for further research in privacy and data protection, encouraging the exploration of automated approaches for policy analysis and regulatory oversight.

Malaysia E-government had improved the government services and overcome barriers faced by the public in the offline environment. The government initiatives to safeguard the interest of the public had transcended to include privacy protection. The Personal Data Protection Act 2009 is considered as one of the initiatives that had been successfully passed by the Malaysia Government by April 2010. However, the implementation and governance of the Act is still subjected to minister’s decision. This study aims in parallel with the government initiatives by investigating the adoption of privacy policy among the Malaysia's egovernment websites. This study is importance towards examining the current level of awareness for the importance for privacy protection being provided for the public, before the full enforcement of the Act. Samples of 154 websites were selected by using convenient sampling from Malaysia government portal (http://www.malaysia.gov.my), which comprises of federal and state governments. The evaluation process was done by using personal observation through an adopted indicators of privacy policies from Jamal Maier and Sunder in 2002 by observing the links provided for 'privacy policy statements', 'privacy policy notice' and 'privacy policy'. The study revealed several issues pertaining privacy policy adoption among Malaysia e-government site and highlights few recommendations and future works towards conceptualization of e-privacy assessment framework in Malaysia e-government context.

The Quest for Information Privacy in Africa: A Review Essay

Pandemics such as COVID-19 pose serious threats to public health and disrupt the established systems for obtaining healthcare services. Mobile health (mHealth) apps serve the general public as a potential method for coping with these exogenous challenges. However, prior research has rarely discussed the antecedents and effects of mHealth apps and their use as a coping method during pandemics. Based on the technology acceptance model, empowerment theory, and event theory, we developed a research model to examine the antecedents (technology characteristics and event strength) and effects (psychological empowerment) of mHealth apps and their use. We tested this research model through a sequential mixed-method investigation. First, a quantitative study based on 402 Chinese mHealth users who used the apps during the COVID-19 pandemic was conducted to validate the theoretical model. A follow-up qualitative study of 191 online articles and reviews on mHealth during the COVID-19 pandemic was conducted to cross-validate the results and explain the unsupported findings of the quantitative study. The results show that (1) the mHealth app characteristics (perceived usefulness and perceived ease of use) positively affect mHealth app use; (2) mHealth app use positively affects the psychological empowerment of mHealth users; and (3) the characteristics of pandemic events (event criticality and event disruption) have positive moderating effects on the relationship between mHealth app characteristics and mHealth app use. This study explains the role of mHealth apps in the COVID-19 pandemic on the micro-level, which has implications for the ways in which mHealth apps are used in response to public pandemics.

In the era of big data, international trade has gone through a digital transformation and developed into a new stage of digital trade. The gradual prosperity of digital trade and the increasing contribution of digital elements to the economy of countries and the international community also bring about problems such as data abuse, surveillance, privacy infringement, and regulatory difficulties. In order to adapt to the development trend of digital trade, countries are paying more attention to cross-border data flow and data privacy protection, in order to maintain national security and the data security of various entities. Therefore, this article analyzes the current situation and trends of digital trade, considers the security issues of data privacy from the perspective of different entities, links key issues such as cross-border data flow, data rights, and privacy rights, explores the current status of relevant domestic and foreign legal and regulatory systems, and conducts comparative analysis. The analysis results show that due to different values, there are significant differences in policies regarding digital trade and privacy protection among countries. The commonality is that none of them have established appropriate legal protection systems for data elements and privacy rights to promote the development of digital trade. Under the trend of technological development, data privacy will also be impacted by new technologies through digital trade. Therefore, in response to the expanding demand for data regulation, all entities should improve their privacy protection and cross-border data flow policies and standards from both internal and international perspectives.

SummaryObjectives: To survey international regulatory frameworks that serve to protect privacy of personal data as a human right as well as to review the literature regarding privacy protections and data ownership in mobile health (mHealth) technologies between January 1, 2016 and June 1, 2019 in order to identify common themes.Methods: We performed a review of relevant literature available in English published between January 1, 2016 and June 1, 2019 from databases including PubMed, Google Scholar, and Web of Science, as well as relevant legislative background material. Articles out of scope (as detailed below) were eliminated. We categorized the remaining pool of articles and discrete themes were identified, specifically: concerns around data transmission and storage, including data ownership and the ability to re-identify previously de-identified data; issues with user consent (including the availability of appropriate privacy policies) and access control; and the changing culture and variable global attitudes toward privacy of health data.Results: Recent literature demonstrates that the security of mHealth data storage and transmission remains of wide concern, and aggregated data that were previously considered “de-identified” have now been demonstrated to be re-identifiable. Consumer-informed consent may be lacking with regard to mHealth applications due to the absence of a privacy policy and/or to text that is too complex and lengthy for most users to comprehend. The literature surveyed emphasizes improved access control strategies. This survey also illustrates a wide variety of global user perceptions regarding health data privacy.Conclusion: The international regulatory framework that serves to protect privacy of personal data as a human right is diverse. Given the challenges legislators face to keep up with rapidly advancing technology, we introduce the concept of a “healthcare fiduciary” to serve the best interest of data subjects in the current environment.

최근 미국은 트럼프 행정부의 시작과 더불어 종래 오바마 정부의 개인정보 보호정책과 궤를 완전히 달리하여 개인정보 보호보다는 기업친화적인 정보활용에 중점을 두는 방식으로 전환하였다. 따라서 Opt-out을 기조로 하여 개인정보의 보호를 크게 의식하지 않고 무역을 희망하는 미국과 Opt-in을 기조로 하는 유럽지역 국가들 간에는 당연히 마찰이 증가하게 되었으며 이러한 상황은 유럽과 같은 개인정보 보호방식을 따르고 있는 우리나라에도 영향을 미쳐, 미국 기업에게 동일한 수준의 개인정보 보호요청을 강요하는 경우 무역 분쟁이 발생할 소지가 커졌다. 이와 같은 상황에서 유럽과 미국의 개인정보 보호제도의 핵심적인 차이를 파악하고 최근 미국 행정부의 개인정보 보호법제의 변화와 동향을 파악하는 것은 매우 의미 있는 일이라고 할 수 있다. 따라서 이러한 목적 하에 본 논문은 미국의 개인정보 보호법제 제·개정 연혁 및 최근 동향을 분석하였다. 먼저 미국에서도 개인정보 보호법제는 변화를 겪었으므로, 연대기 순으로 정보보호 법제의 흐름을 살펴볼 필요가 있다. 특히 행태정보의 수집·활용 및 규제에 관한 측면을 먼저 검토하고, 오바마 행정부의 소비자 프라이버시 권리장전(2012), FTC의 Protecting Privacy in an Era of Rapid Changing(2012), FCC의 ISP privacy rule(2016) 등 미국의 개인정보 보호관련 법제의 흐름과 최근 동향을 살펴보았다. 그리고 2017년 4월 3일 트럼프 대통령이 FCC 프라이버시규칙을 폐기하는 법안에 서명함에 따라, 미국 내 개인정보보호에 대한 심각한 우려가 발생하게 되었다. 인터넷서비스사업자들에 대한 개인정보 규제 완화로 개인정보 활용 산업의 발전이 기대되는 한편, 개인정보의 무분별한 사용과 프라이버시 침해에 대한 우려도 확산되었다. 따라서 트럼프 행정부의 개인정보 보호 정책의 방향을 분석하여 우리에게 필요한 시사점을 얻기 위하여, 생체정보, 빅데이터, 사물인터넷 등 신기술 관련 미국의 데이터 활용 및 개인정보 보호정책과 EU GDPR 발효에 따른 제약과 이에 대응한 미국 정부, 기업의 대응노력 등을 분석하면서, 제4차 산업혁명의 시기에 개인정보의 보호와 활용을 균형 있고 조화롭게 양립하기 위한 논의가 필요하다는 점을 강조하였다.With the start of the Trump administration, the U.S. recently shifted its focus to business-friendly use of information rather than privacy protection, completely different from the previous Obama administration s privacy policy. Thus, friction between the U.S. and the European countries that want to trade with the U.S. without much awareness of the protection of personal information under the Opt-out stance has naturally increased. Such differences have also affected Korea, and Korea, which is following the Private Privacy Act such as Europe, has increased the possibility of a trade dispute if it forces U.S. companies to ask for the same level Against this backdrop, it is very meaningful to identify the key differences in the privacy protections of Europe and the U.S. and to identify recent changes in the U.S. administration s privacy laws. Therefore, for this purpose, this paper analyzed the years and recent trends of the personal information protection Act of the U.S.. First of all, since the privacy laws have undergone changes in the U.S., we need to look at the trend of the information protection laws in chronological order. In particular, This article first reviewed aspects of the collection, utilization and regulation of behavioral information, and recently reviewed the trends in U.S. privacy laws, including the Obama administration s Consumer Privacy Bill (2012), the FTC s Protecting Privacy in an Era of Rapid Change (2012), and the FCC s ISP Privacy Rule (2016). And as President Trump signed a bill to scrap FCC privacy rules on April 3, 2017, serious concerns arose over privacy in the U.S.. While the development of the personal information utilization industry was expected due to the easing of regulations on personal information for Internet service providers, concerns over the reckless use of personal information and the violation of privacy were also spread. Thus, in order to obtain the necessary implications for Korea by analyzing the direction of the Trump administration s privacy policy, the U.S. data utilization and privacy policy related to new technologies such as biometric information, big data, and the Internet of Things, and the restrictions imposed by the EU GDPR, the U.S. government and corporate efforts to respond to them, stressing the need for a balanced and balanced discussion on the protection and utilization of personal information during the fourth industrial revolution.

Private higher education institutions as data users are subjected to the requirements of the Personal Data Protection Act 2010 (PDPA). These institutions process employee data as well as data of potential students, active students and alumni. They also deal with data of third parties such as vendors, visitors and contractors. Ten years after the coming into effect of the PDPA in 2013, the education sector has yet to develop their personal data protection code of practice as required by the Act. The General Code of Practice (CoP) of Personal Data Protection was introduced in December 2022 with the objective to provide guidelines to the Class of Data Users who have not prepared a Code of Practice and there is no data user forum to develop the relevant Code of Practice for the Class of Data Users. As the General CoP is legally binding, it is an offence punishable under the Act for any data user for failure to comply with any provision of this General CoP. As data users, private higher education institutions need to introduce certain mechanisms to adhere to the requirements such as privacy policy and procedure. This paper aims to compare the data privacy practices of private higher education institutions in Malaysia in order to determine to what extent the law has been complied with. Being a qualitative study, this paper applies content analysis technique. Data privacy policies of four private higher education institutions in Malaysia were examined to attain the objective. The four private higher education institutions are Universiti Tenaga Nasional (UNITEN), Universiti Teknologi PETRONAS (UTP), Taylor’s University and University of Nottingham Malaysia. The data privacy policies of the four institutions are accessible on the official website of the institutions. The study indicates that in the absence of a personal data protection code of practice for the education sector as a guideline, the data privacy practices of the institutions vary from one to another. While some of the privacy policies contain provisions which are general in nature which may lead to confusion to the data subjects, the data privacy policies show that the four institutions have, to a certain extent, complied with the requirements of the PDPA in general.

BackgroundCOVID-19 digital contact-tracing apps were created to assist public health authorities in curbing the pandemic. These apps require users’ permission to access specific functions on their mobile phones, such as geolocation, Bluetooth or Wi-Fi connections, or personal data, to work correctly. As these functions have privacy repercussions, it is essential to establish how contact-tracing apps respect users’ privacy.ObjectiveThis study aimed to systematically map existing contact-tracing apps and evaluate the permissions required and their privacy policies. Specifically, we evaluated the type of permissions, the privacy policies’ readability, and the information included in them.MethodsWe used custom Google searches and existing lists of contact-tracing apps to identify potentially eligible apps between May 2020 and November 2021. We included contact-tracing or exposure notification apps with a Google Play webpage from which we extracted app characteristics (eg, sponsor, number of installs, and ratings). We used Exodus Privacy to systematically extract the number of permissions and classify them as dangerous or normal. We computed a Permission Accumulated Risk Score representing the threat level to the user’s privacy. We assessed the privacy policies’ readability and evaluated their content using a 13-item checklist, which generated a Privacy Transparency Index. We explored the relationships between app characteristics, Permission Accumulated Risk Score, and Privacy Transparency Index using correlations, chi-square tests, or ANOVAs.ResultsWe identified 180 contact-tracing apps across 152 countries, states, or territories. We included 85.6% (154/180) of apps with a working Google Play page, most of which (132/154, 85.7%) had a privacy policy document. Most apps were developed by governments (116/154, 75.3%) and totaled 264.5 million installs. The average rating on Google Play was 3.5 (SD 0.7). Across the 154 apps, we identified 94 unique permissions, 18% (17/94) of which were dangerous, and 30 trackers. The average Permission Accumulated Risk Score was 22.7 (SD 17.7; range 4-74, median 16) and the average Privacy Transparency Index was 55.8 (SD 21.7; range 5-95, median 55). Overall, the privacy documents were difficult to read (median grade level 12, range 7-23); 67% (88/132) of these mentioned that the apps collected personal identifiers. The Permission Accumulated Risk Score was negatively associated with the average App Store ratings (r=−0.20; P=.03; 120/154, 77.9%) and Privacy Transparency Index (r=−0.25; P<.001; 132/154, 85.7%), suggesting that the higher the risk to one’s data, the lower the apps’ ratings and transparency index.ConclusionsMany contact-tracing apps were developed covering most of the planet but with a relatively low number of installs. Privacy-preserving apps scored high in transparency and App Store ratings, suggesting that some users appreciate these apps. Nevertheless, privacy policy documents were difficult to read for an average audience. Therefore, we recommend following privacy-preserving and transparency principles to improve contact-tracing uptake while making privacy documents more readable for a wider public.

The global mHealth app market is rapidly expanding, especially since the COVID-19 pandemic. However, many of these mHealth apps have serious issues, as reported in their user reviews. Better understanding their key user concerns would help app developers improve their apps’ quality and uptake. While app reviews have been used to study user feedback in many prior studies, many are limited in scope, size and/or analysis. In this paper, we introduce a very large-scale study and analysis of mHealth app reviews. We extracted and translated over 5 million user reviews for 278 mHealth apps. These reviews were then classified into 14 different aspects/categories of issues reported. Several mHealth app subcategories were examined to reveal differences in significant areas of user concerns, and to investigate the impact of different aspects of mhealth apps on their ratings. Based on our findings, women’s health apps had the highest satisfaction ratings. Fitness activity tracking apps received the lowest and most unfavourable ratings from users. Over half of users who reported troubles leading them to uninstall mHealth apps gave a 1-star rating. Half of users gave the account and logging aspect only one star due to faults and issues encountered while registering or logging in. Over a third of users who expressed privacy concerns gave the app a 1-star rating. However, only 6% of users gave apps a one-star rating due to UI/UX concerns. 20% of users reported issues with handling of user requests and internationalisation concerns. We validated our findings by manually analysing a sample of 1,000 user reviews from each investigated aspect/category. We developed a list of recommendations for mHealth apps developers based on our user review analysis.

The rapid adoption of Internet of Things (IoT) technologies by startups has intensified concerns related to data governance, privacy protection, and information security risks. This study investigates the effect of IoT data governance quality and data privacy policy on information security risk mitigation and customer trust in IoT-based startups in Bandung, Indonesia. Using a quantitative research approach, data were collected from 150 users of IoT-based startup services through a structured questionnaire measured on a Likert scale. The data were analyzed using Structural Equation Modeling–Partial Least Squares (SEM-PLS 3). The results indicate that IoT data governance quality has a significant positive effect on information security risk mitigation. In addition, data privacy policy and information security risk mitigation both have significant positive effects on customer trust. Furthermore, information security risk mitigation partially mediates the relationship between IoT data governance quality and customer trust. These findings highlight the importance of strengthening data governance frameworks and implementing transparent privacy policies to reduce security risks and enhance customer trust. This study contributes to the growing body of literature on IoT governance and provides practical insights for startup managers and policymakers in fostering secure and trustworthy IoT-based business environments.

BackgroundDespite the importance of the privacy and confidentiality of patients’ information, mobile health (mHealth) apps can raise the risk of violating users’ privacy and confidentiality. Research has shown that many apps provide an insecure infrastructure and that security is not a priority for developers.ObjectiveThis study aims to develop and validate a comprehensive tool to be considered by developers for assessing the security and privacy of mHealth apps.MethodsA literature search was performed to identify papers on app development, and those papers reporting criteria for the security and privacy of mHealth were assessed. The criteria were extracted using content analysis and presented to experts. An expert panel was held for determining the categories and subcategories of the criteria according to meaning, repetition, and overlap; impact scores were also measured. Quantitative and qualitative methods were used for validating the criteria. The validity and reliability of the instrument were calculated to present an assessment instrument.ResultsThe search strategy identified 8190 papers, of which 33 (0.4%) were deemed eligible. A total of 218 criteria were extracted based on the literature search; of these, 119 (54.6%) criteria were removed as duplicates and 10 (4.6%) were deemed irrelevant to the security or privacy of mHealth apps. The remaining 89 (40.8%) criteria were presented to the expert panel. After calculating impact scores, the content validity ratio (CVR), and the content validity index (CVI), 63 (70.8%) criteria were confirmed. The mean CVR and CVI of the instrument were 0.72 and 0.86, respectively. The criteria were grouped into 8 categories: authentication and authorization, access management, security, data storage, integrity, encryption and decryption, privacy, and privacy policy content.ConclusionsThe proposed comprehensive criteria can be used as a guide for app designers, developers, and even researchers. The criteria and the countermeasures presented in this study can be considered to improve the privacy and security of mHealth apps before releasing the apps into the market. Regulators are recommended to consider an established standard using such criteria for the accreditation process, since the available self-certification of developers is not reliable enough.

BackgroundThe rapid expansion of mobile health (mHealth) apps has transformed health care delivery worldwide. Despite their potential to improve epilepsy care, a substantial treatment gap remains, especially in low- and middle-income countries, due to limited resources, stigma, and low adoption of digital technologies. Although mHealth apps can bridge these disparities, their impact depends on acceptance and use by the target population.ObjectiveWe aimed to assess the awareness, feasibility, willingness, perception, and factors influencing these behaviors for the usage of mHealth apps among people living with epilepsy in Pakistan.MethodsWe conducted a cross-sectional analytical survey between March and July 2024 among people living with epilepsy attending the Pakistan Institute of Medical Sciences (PIMS). Participants completed a validated, self-administered questionnaire with 33 items across 5 domains. We recruited 406 participants through convenience sampling and analyzed the data using SPSS version 23.0 (IBM Corp). Through multivariable linear regression analysis, we explored factors associated with people living with epilepsy willingness to use mHealth apps. Correlation analysis was used to elucidate the association among awareness, perception, feasibility, and willingness.ResultsAmong 406 participants, 53.7% (n=218) were male, 64.5% (n=262) were married, and 89.2% (n=362) were identified as Muslim. Although 86.2% (n=350) of participants have heard about mHealth apps for epilepsy management, 78.1% (n=317) expressed negative perceptions of their use. More than half, 69% (n=280), reported concerns about the privacy of their medical information online, and 78.1% (n=317) were not comfortable using mHealth apps on smartphones or tablets. Multivariable linear regression analysis revealed that rural residents (P=.05), those with a college education (P<.001), and participants with a treatment duration of 2-3 years (P<.001) significantly influenced participants’ willingness. Correlation analysis showed a weak negative relationship between awareness and feasibility (ρ=–0.124; P=.01) and a weak positive relationship between awareness and willingness (ρ=0.013; P=.07).ConclusionsTo expand mHealth use for epilepsy care in Pakistan, stakeholders must address concerns about digital literacy, data privacy, and trust. Collaborative efforts involving government, technologists, nongovernmental organizations, academia, and health care providers can improve education, enhance data security, and adapt mHealth tools to local needs, ultimately improving treatment access and outcomes for people living with epilepsy.