Our health data, a coveted treasure

Health tracking apps, smartwatches, fitness bands, sleep, menstrual cycle, nutrition, meditation apps, health websites, and medical connected devices: today, we produce a considerable amount of HEALTH DATA. These data—heart rate, sleep, weight, activity, symptoms, sometimes pathologies—are among the most INTIMATE and most SENSITIVE that exist. Yet they are also highly DESIRED: by companies that would like to exploit them (targeted advertising, resale), potentially by insurers or employers, or by hackers. Many share them without thinking, seduced by the practicality of wellness apps. Yet a leaked or exploited health data point can have far more serious consequences than an ordinary data point. Understanding why these data are so sensitive and desired, without paranoia, allows us to better protect them. Let’s see what these data are, why they are desired, and how to protect them.

Health data: what is it?

First, let’s understand what our health data encompasses, often broader than we think. A BROAD definition: health data is not just medical records; it’s anything related to your body, health, and well-being; a broad set; more than you think. MEDICAL data: medical records, diagnoses, treatments, analyses, pathologies; health data in the classic sense; very sensitive; obvious. WELL-BEING data: but also; physical activity, sleep, heart rate, weight, diet, mood tracked by apps and connected devices; health data too; less obvious but real. SMARTWATCHES and fitness bands: smartwatches and fitness bands continuously measure heart rate, activity, and sleep; a goldmine of health data; worn on the wrist permanently; very rich. SPECIALIZED apps: sleep, menstrual cycle, nutrition, meditation, and disease tracking apps; they collect intimate data; sometimes very sensitive (cycle, pathologies); to be monitored. INFERRED data: from your data, you can INFER health information (a cycle app reveals a pregnancy, searches reveal medical concerns); inference broadens the scope; sneaky. MASSIVE production: today, we produce a huge amount of health data (connected devices, apps, websites); a considerable volume; without always realizing it; massive. Very INTIMATE data: these data touch on the intimate (body, health, possible illnesses); among the most personal that exist; their sensitivity is maximal (we’ll come back to this); intimate. Shared WITHOUT thinking: many share these data without thinking, seduced by the practicality of apps; you give your intimacy in exchange for comfort; often unconsciously; to be questioned. An UNDERESTIMATED issue: the sensitivity and desirability of these data are underestimated; you protect your bank password, less your health data; a gap; be aware. The key idea: health data are far broader than we think. There are the MEDICAL data in the classic sense (records, diagnoses, treatments, analyses, pathologies), obviously very sensitive. But there are also all the WELL-BEING data that we massively produce via apps and connected devices: physical activity, sleep, heart rate, weight, diet, mood, menstrual cycle, meditation… SMARTWATCHES and fitness bands, worn permanently, continuously measure a wealth of information about our bodies; SPECIALIZED apps (sleep, cycle, nutrition, disease tracking) collect sometimes extremely intimate data. Worse, you can INFER health information from seemingly innocuous data (a cycle app reveals a pregnancy; online searches reveal medical concerns). These data touch on the most INTIMATE aspects (our body, our health, our possible illnesses) and are among the most sensitive that exist. Yet, many share them WITHOUT thinking, seduced by the practicality of apps—a largely underestimated issue, while we protect our bank password far more willingly than our health data.

Why are these data so sensitive and desired?

Let’s understand why health data are worth their weight in gold and attract covetousness. Among the most SENSITIVE: health data are among the most sensitive because they touch on the intimate and can have serious consequences if exploited; their sensitivity is maximal; to be particularly protected. The risk of DISCRIMINATION: knowing your health could be used to discriminate against you (insurance adjusting rates, wary employer); a serious and concrete risk; the worst-case scenario; to be prevented. INTERESTED insurers: insurers might be tempted to use your health data (rate according to risks, refuse); a particularly problematic use; regulated by law, but desired; be vigilant. EMPLOYERS too: an employer aware of your health could discriminate (hiring, career); a risk to your professional life; to be protected; sensitive. TARGETED advertising: companies exploit health/well-being data for targeted advertising (products related to your condition); your intimacy becomes a commercial argument; intrusive; to be limited. DATA resale: some apps resell or share data (to third parties, data brokers); your health data circulate; an opaque trade; be wary. The DEFINITIVE nature: a leaked health data point cannot be “changed” (unlike a password); a revealed illness is revealed forever; irreversibility worsens; protect in advance. SERIOUS consequences: an exploited or leaked health data point can have far more serious consequences than an ordinary data point (discrimination, violated intimacy); the stakes are high; hence the vigilance. HACKERS too: health data also interest hackers (blackmail, resale, identity theft); a prime target; security matters; protect. GENERAL covetousness: between companies (ads, resale), insurers, potential employers, and hackers, health data are HIGHLY desired; they’re worth their weight in gold; hence the importance of protecting them; the key finding. In summary, health data are so sensitive and desired for serious and concrete reasons. Their sensitivity stems from the risk of DISCRIMINATION: knowing your health status could be used to disadvantage you. INSURERS might be tempted to adjust their rates or refuse coverage based on risks; an EMPLOYER aware of your health could discriminate in hiring or career advancement—problematic uses (fortunately regulated by law, but the desire exists). On the commercial side, companies exploit these data for TARGETED ADVERTISING (your intimacy becomes a selling point), and some apps RESELL or share data with third parties (an often opaque trade). HACKERS also covet them (blackmail, resale, identity theft). Two characteristics worsen everything: the DEFINITIVE nature (a leaked health data point cannot be “changed” like a password: a revealed illness is revealed forever) and the SERIOUS consequences (far more serious than an ordinary data point). Between companies, insurers, potential employers, and hackers, your health data are therefore extremely desired—they’re worth their weight in gold, which makes their protection crucial.

Before installing a health or wellness app, ask yourself the right questions about your data. Health and wellness apps (activity tracking, sleep, cycle, nutrition, meditation…) are practical and often useful: it’s not about rejecting them, but choosing and using them INFORMEDLY, as you’re entrusting them with your most intimate data. Before installing and using such an app, get into the habit of asking yourself a few simple questions—a reflex that changes everything. First question: WHO is behind this app, and is it serious? Prefer recognized apps from serious and transparent publishers, rather than the first free app that comes along, whose creators and data practices you don’t know. Second question: what does it do with my DATA? Take a quick look at its privacy policy and settings: does it collect more than necessary? Does it share or resell data to third parties? Does it store data securely? A transparent and respectful app states this clearly; a vague app or one that requests unjustified access should raise suspicion. Third question: do I REALLY need to share everything? Many apps ask for more information and permissions than necessary; only give what’s useful for the service you want, and refuse unnecessary access (permanent location, contacts, etc. when not justified). Fourth question: does the benefit outweigh sharing my intimacy? For a very intrusive app (tracking particularly sensitive data like menstrual cycle, a pathology, health location), weigh the real benefit against the intimacy entrusted: do you really need it, and from this publisher? Then, a few usage habits: explore the app’s PRIVACY SETTINGS (disable sharing, personalized ads, unnecessary synchronization), limit the PERMISSIONS granted, and regularly sort through unused health apps (uninstall them, and if possible request deletion of your data). Finally, keep in mind the distinction: a public wellness app does not offer the same guarantees as a medically supervised health service—be all the more careful with the most sensitive data. In summary, before installing a health or wellness app, ask yourself the right questions: WHO is behind it (prefer seriousness and transparency), what does it do with my DATA (privacy policy, sharing/resale?), do I need to share EVERYTHING (only give what’s useful, refuse unnecessary access), and does the benefit outweigh the shared intimacy (especially for very sensitive data)? Then, master the PRIVACY SETTINGS, limit permissions, and sort through unused apps. This simple reflex allows you to enjoy useful apps while protecting your health data—the most intimate you have.

Protecting your health data on a daily basis

Here are the concrete steps to protect these precious data, without giving up useful tools. Treat health as SENSITIVE: consider your health data as (at least) as sensitive as your banking data; protect them with the same care; change your perspective; health deserves this vigilance. Choose SERIOUS apps: prefer recognized, transparent, and data-respectful health apps; avoid dubious free apps that exploit; seriousness first; choose well. READ (a little) the terms: take a look at what the app does with your data (privacy, sharing); even a quick glance sheds light; consult our privacy guides; inform yourself. LIMIT what you share: only give the data useful for the service; refuse unnecessary access (unjustified location, etc.); the minimum necessary; share little. Master the SETTINGS: explore the privacy settings (disable sharing, personalized ads, unnecessary synchronization); take back control; adjust; master. Sort through: uninstall unused health apps, request deletion of your data if possible; don’t leave your data lying around; clean up. SECURE accounts: protect health-linked accounts (strong passwords, two-factor authentication); prevent hackers from accessing them; secure; like for banking. Be cautious with the VERY sensitive: for the most sensitive data (cycle, pathologies), double down on caution with the chosen app and sharing; the very intimate deserves maximum care; reinforced vigilance. Beware of INFERENCES: keep in mind that even seemingly innocuous data can reveal your health (searches, purchases); global vigilance on your digital traces; think about inferences; awareness. Without PARANOIA: no total renunciation (health apps have utility); just conscious and cautious use; the balance between utility and protection; serenely. Know your RIGHTS: you have rights over your health data (access, deletion, enhanced protection by law); inform yourself and exercise them; consult our guides on your rights; act. In summary, to protect your health data daily, the first change is MINDSET: treat them as (at least) as sensitive as your banking data, and protect them with the same care. Concretely: CHOOSE serious, recognized, and transparent apps (avoid dubious free apps that exploit data), TAKE A LOOK at what they do with your data (privacy, sharing), LIMIT what you share (only give what’s useful, refuse unnecessary access), and MASTER privacy settings (disable sharing, personalized ads, unnecessary synchronization). Regularly SORT (uninstall unused apps, request deletion of your data), SECURE health-linked accounts (strong passwords, two-factor authentication—like for banking), and double down on CAUTION with the most sensitive data (cycle, pathologies). Also keep in mind possible INFERENCES (even seemingly innocuous data—searches, purchases—can reveal your health), and KNOW your rights (access, deletion—the law particularly protects health data). All this without PARANOIA: it’s not about renouncing useful apps, but using them consciously and cautiously. Protecting your health data is protecting your deepest intimacy: it deserves the same attention as what you hold most precious.

Warning: free health apps may exploit your data, a leaked health data point cannot be “changed,” and beware of what your data may reveal. Three essential points of vigilance regarding your health data. First point: FREE health and wellness apps may exploit your data. This is a general principle of the digital world, particularly crucial here: when a service is free, you should ask how it’s financed—and most often, the answer is: thanks to your data. Applied to health, this is particularly problematic: a free activity, sleep, cycle, or nutrition tracking app may collect your most intimate data to exploit (targeted ads) or share/resell to third parties (data brokers, advertisers). Not all free apps are dishonest, but free services should raise your vigilance on the business model: prefer serious and transparent apps (even if you have to pay for a service that respects your data), read what they do with your information, and be wary of those that request a lot of data or permissions without a clear reason. Second point, fundamental: a leaked health data point cannot be “changed.” This is what distinguishes health data from others. A compromised password? You change it. A hacked credit card? You get a new one. But a leaked HEALTH data point—a disease, a pathology, a pregnancy, a psychological state—is revealed DEFINITIVELY: you cannot “reset” information about your body. This irreversibility makes the potential consequences lasting (discrimination, violation of intimacy, blackmail) and requires protecting these data IN ADVANCE, as once exposed, you can’t undo it. This is precisely why it’s better to prevent: think before entrusting a health data point, rather than trying (in vain) to fix it afterward. Third point: beware of what your data may REVEAL, even indirectly. The risk isn’t limited to explicitly “health” data: many seemingly innocuous information points can reveal your health status through INFERENCE. A cycle tracking app may reveal a pregnancy; your online searches about symptoms or a disease reveal medical concerns; your purchases (pharmacy, specific products) betray a condition; your location (regular visits to a healthcare facility) says a lot. Companies know how to cross-reference these traces to infer health information you never explicitly shared. Therefore, maintain GLOBAL vigilance on your digital traces, not just on apps labeled “health.” In summary, three vigilances: FREE health apps may exploit your data (free services should raise suspicion about the business model: prefer seriousness and transparency, even if you have to pay), a leaked health data point cannot be “CHANGED” (unlike a password: this irreversibility requires protecting in advance), and beware of INFERENCES (seemingly innocuous data—cycle, searches, purchases, location—can reveal your health: be globally vigilant). These three realities explain why health data, more than any other, deserve particular and anticipatory protection.

Frequently asked questions

Does my fitness band or smartwatch transmit my health data?

Very likely, your data are collected and sent to the manufacturer’s servers (and sometimes shared); this isn’t necessarily malicious, but you should know what’s collected, where it goes, and adjust privacy settings accordingly. Let’s see. YES, PROBABLY: a fitness band/smartwatch collects data (heart rate, activity, sleep) and generally sends them to the manufacturer’s servers (for the app, synchronization); transmission is almost systematic; it’s how it works. To FUNCTION: this transmission often serves the service (display your data in the app, analyze, synchronize); it’s not necessarily malicious; part of it is legitimate; nuance. But WHERE to: your health data go to the manufacturer’s servers; the question is: what do they do with it? Do they protect it? Do they share it? Do they exploit it? To verify; know where it goes. Possible SHARING: depending on the manufacturer, data may be shared/exploited (ads, third parties); it all depends on their practices; hence the importance of choosing a serious manufacturer; verify. KNOW what’s collected: you should know what your device collects (often a lot: heart, activity, sleep, sometimes location); awareness first; inform yourself; educate yourself. ADJUST privacy: explore the app/device’s privacy settings; disable what’s unnecessary, limit sharing; take back control; adjust. Choose a SERIOUS manufacturer: prefer serious manufacturers, transparent about data usage; their policy matters for your health data; seriousness protects; choose well. SECURE the account: secure the linked account (strong password, two-factor authentication); prevent unauthorized access to your health data; secure; protect access. No PANIC, but awareness: no need to throw away your watch; just know what’s happening and adjust accordingly; conscious use; balance; serenely. The ADVICE: yes, your fitness band/smartwatch probably transmits your health data to the manufacturer’s servers (and sometimes shares them); know what’s collected, choose a serious manufacturer, adjust privacy, secure the account; conscious use rather than renunciation or carelessness. In summary, yes: very likely, your fitness band or smartwatch collects your health data (heart rate, physical activity, sleep, sometimes location) and TRANSMITS them to the manufacturer’s servers. This is the normal functioning of these devices: transmission partly serves the service itself (displaying and analyzing your data in the app, synchronizing between your devices), and is therefore not necessarily malicious. But the real question is: what does the manufacturer do with these data once on their servers? Do they protect them correctly? Do they share or exploit them (ads, third parties)? This entirely depends on their practices—hence the importance of choosing a SERIOUS and transparent manufacturer. What you can do: first, KNOW what your device collects (often a lot) and where these data go; then, explore the app and device’s PRIVACY SETTINGS to disable what’s unnecessary and limit sharing; finally, SECURE the associated account (strong password, two-factor authentication) to prevent any unauthorized access to your health data. It’s not about throwing away your watch in panic (these devices have real utility), but having a CONSCIOUS use: knowing what happens with your data, choosing respectful manufacturers, and adjusting privacy accordingly. Your health data being among the most intimate, this vigilance is really worth it.

Is a free health tracking app risky?

It can be: if the service is free, it often finances itself through your data (exploitation, sharing, resale), which is particularly sensitive for health; not all are dishonest, but free services should raise your vigilance. Let’s see. The BUSINESS MODEL question: when a service is free, ask how it’s financed; often, the answer is: thanks to your data; free services have a “hidden” price; question the model. Particularly sensitive for HEALTH: for health, this model is particularly problematic (ultra-intimate data exploited/shared); the stakes are higher than elsewhere; double down on vigilance. Possible EXPLOITATION: a free app may exploit your health data (targeted ads) or share/resell them to third parties (brokers, advertisers); your intimate data become merchandise; a real risk; be wary. Not ALL dishonest: be careful, not all free apps are dishonest (some have other models); don’t demonize them all; but vigilance is required; nuance and caution. Check PRIVACY: look at what the app says it does with your data (privacy policy, sharing); a transparent app reassures, a vague app worries; verify before installing. Beware of EXCESSIVE access: be wary of an app that requests a lot of data or permissions without a clear reason; a warning sign; refuse the superfluous; vigilance. Prefer SERIOUSNESS: prefer recognized, serious, transparent apps, even if you have to PAY for a service that respects your data; paying can be worth the protection; seriousness first; choose. The real “PRICE”: with a free app that exploits, you “pay” with your intimacy (health data); a price sometimes more expensive than a subscription; weigh the real cost; think. LIMIT and adjust: if you use a free app, limit what you share, adjust privacy, be wary; reduce exposure; protect yourself; master. The ADVICE: a free health app can be risky (it often finances itself through your data, particularly sensitive for health); not all are dishonest, but free services should raise vigilance; verify privacy, be wary of excessive access, and prefer seriousness (even if you have to pay). In summary, yes, a free health tracking app CAN be risky, and you should approach free services with vigilance. The fundamental principle: when a digital service is free, you should ask how it’s financed—and most often, it’s thanks to YOUR DATA. Applied to health, this model is particularly problematic: a free app may collect your most intimate health data to EXPLOIT (targeted ads) or SHARE/RESELL to third parties (data brokers, advertisers). Your most personal information then becomes merchandise. That said, you shouldn’t demonize them all: not all free apps are dishonest (some have other business models). But free services should make you VIGILANT: verify what the app says it does with your data (a transparent privacy policy reassures; an app that’s vague or requests a lot of data and permissions without a clear reason should worry), and prefer RECOGNIZED, serious, and respectful apps—even if you have to PAY for a service that truly protects your data. Because with a free app that exploits your health data, you “PAY” in reality with your INTIMACY, a price often far higher than a modest subscription. If you use a free app, limit as much as possible what you share, carefully adjust privacy, and stay wary. In health more than elsewhere, free isn’t really free: seriousness and respect for your data are worth their price.

Does the law protect my health data?

Yes, health data benefit from enhanced legal protection (they are considered particularly sensitive) and you have rights over them; but this protection does not exempt you from remaining vigilant, especially with public wellness apps. Let’s see. YES, enhanced protection: health data are legally considered particularly sensitive and benefit from enhanced protection; the law protects them more than ordinary data; a framework exists; reassuring. RIGHTS over your data: you have rights (access to your data, correction, deletion, opposition depending on the case); you’re not powerless; know and exercise your rights; act. REGULATED use: the use of health data (by professionals, insurers, etc.) is regulated and limited by law; certain abusive uses are prohibited; a safeguard; protective. MEDICAL secrecy: medical secrecy protects your medical data with healthcare professionals; an old and strong protection; reassuring on the medical side; solid. But LIMITS: legal protection doesn’t make everything perfect; data circulate, apps circumvent, leaks happen; the law protects but doesn’t exempt from vigilance; stay attentive. WELLNESS apps: be careful, public wellness apps don’t necessarily offer the same guarantees as a medically supervised health service; protection varies; hence all the more vigilance; nuance. VIGILANCE remains necessary: the law is a foundation, but your vigilance (app choices, settings, caution) remains indispensable; law + personal vigilance; both; protect yourself too. EXERCISE your rights: in case of problems (abusive use, access refusal), you can exercise your rights, contact data protection authorities; remedies exist; consult our guides on your rights; act. The BLURRED line: the line between medical data (well protected) and wellness data (less regulated) is blurred; hence the importance of your caution with apps; vigilance on the blur; attention. The ADVICE: yes, the law protects your health data (enhanced protection, rights, regulation, medical secrecy), but this protection does not exempt you from vigilance—especially with public wellness apps, less regulated than medical services; know your rights AND stay cautious. In summary, yes, the law protects your health data, and rather well: they are legally considered particularly SENSITIVE data and benefit from this enhanced protection, superior to that of ordinary data. You have RIGHTS over these data (access, correction, request deletion, oppose certain uses depending on the case), their use by third parties (professionals, insurers…) is REGULATED and limited by law—certain abusive uses, such as discrimination based on health, being prohibited—and MEDICAL SECRECY has long protected your medical data with healthcare professionals. It’s a solid and reassuring foundation. BUT this legal protection does not exempt you from remaining vigilant, for two reasons. On the one hand, no law makes the system perfect: data circulate, leaks happen, some apps circumvent or operate in gray areas. On the other hand, and this is essential, you must distinguish MEDICAL data (well protected, medical secrecy) from WELLNESS data collected by public apps and connected devices, which do NOT necessarily offer the same guarantees—the line often being blurred. The law is therefore a precious support, to know and use (don’t hesitate to exercise your rights or contact data protection authorities in case of problems), but it comes as a COMPLEMENT to your own vigilance (choice of serious apps, privacy settings, caution about what you share), not a replacement. Law AND personal vigilance, together, best protect your health data.

What to remember

Today, we produce a considerable amount of HEALTH DATA, far beyond just medical records: activity, sleep, heart rate, weight, cycle, nutrition, mood… collected by our apps and connected devices (watches, fitness bands, specialized apps). These data touch on the most INTIMATE aspects and are among the most SENSITIVE that exist—all the more so because you can even INFER health information from seemingly innocuous data (searches, purchases, location). Yet they are highly DESIRED, for serious reasons: risk of DISCRIMINATION (insurers tempted to adjust their rates, employers who could discriminate), commercial exploitation (TARGETED ADVERTISING, RESELLING to third parties), and interest from HACKERS (blackmail, identity theft). Two characteristics worsen everything: a leaked health data point cannot be “CHANGED” (unlike a password: a revealed illness is revealed forever), and its consequences are far more SERIOUS than an ordinary data point. Hence the importance of protecting them IN ADVANCE. The first change is MINDSET: treat your health data as (at least) as sensitive as your banking data. Concretely: before installing a health or wellness app, ask yourself the right questions (WHO is behind it? what does it do with my data? do I need to share EVERYTHING? does the benefit outweigh the shared intimacy?). Choose SERIOUS and transparent apps (beware of FREE apps, which often finance themselves by exploiting your data—even if you have to pay for the respect of your intimacy), LIMIT what you share, MASTER privacy settings, sort through unused apps, and SECURE linked accounts (strong passwords, two-factor authentication). Good news: the law PROTECTS these data (enhanced protection, access and deletion rights, regulation of uses, medical secrecy)—but this protection does not exempt you from vigilance, especially with public wellness apps, less regulated than medical services. In short, your health data are your most intimate information, they are desired, and what leaks is irreversible: protect them with the same care as what you hold most precious—without paranoia, but with awareness and caution commensurate with their sensitivity.