Medical Device and Health App Data Privacy: What Your Glucose Monitor or Sleep Tracker Shares

Your glucose monitor knows you spiked at 11 p.m. Your sleep tracker knows you were restless all week. Your period app knows you might be pregnant. The question isn't whether these devices collect sensitive information. They do. The real question is where that information goes next, and whether you have any say in it.

The answer, for most people, is more complicated than they expect.

What health apps and wearables actually collect

IQVIA's Digital Health Trends 2024 counted roughly 337,000 digital health apps, and the category keeps evolving. Fitness trackers capture heart rate, GPS location, VO2 max, and calories burned. Sleep trackers log your sleep stages, respiratory rate, and body temperature hour by hour. Continuous glucose monitors record blood sugar levels around the clock. Menstrual apps map your cycle, fertility windows, and pregnancy symptoms.

Many also collect what you don't think to flag as sensitive: your age, weight, race, and in some cases your pregnancy status. That last detail is particularly significant given recent legal changes around reproductive rights.

The data these devices generate is highly personal. It maps your daily biology, in real time, and that's exactly what makes it so valuable to people beyond your doctor.

Why HIPAA doesn't protect most of this

Most people assume that anything related to their health is covered by HIPAA. It's not.

HIPAA protects health information held by covered entities: doctors, hospitals, health plans, and their business associates. Consumer health apps and wearables almost never qualify. When you download a sleep tracker or connect a glucose monitor to an app you found in the App Store, that data typically sits outside HIPAA's reach entirely. As HIPAA Journal explains, the majority of health apps are not covered by HIPAA, even when they collect the exact same health data that a covered entity would maintain.

HIPAA mainly applies when an app is run by, or on behalf of, your provider or health plan, in which case the developer is a business associate, usually under a formal Business Associate Agreement. That's uncommon for consumer products. If you bought your Fitbit yourself and set it up yourself, there's no agreement in place.

What fills the gap? Mostly the app's own privacy policy. And as research from the University of Cincinnati Law Review points out, HIPAA's entity-based structure simply wasn't designed with consumer wearables in mind. The result is a significant coverage gap that leaves the most intimate kind of data, real-time health signals, governed mainly by terms of service.

Who gets your data, and how

Here's what actually happens behind the scenes. Many health apps embed third-party tracking software (called SDKs) from advertising and analytics companies. These components can transmit your data to multiple outside parties, sometimes regardless of the privacy settings you've toggled on.

In a 2014 FTC staff snapshot, 12 popular health and fitness apps sent data to 76 third parties. Some of those third parties received device identifiers, consumer-specific identifiers, or details such as exercise, diet, or location. That was over a decade ago, and the ecosystem has grown considerably since. More recent research on Android apps, including period trackers, found that ad and analytics trackers can keep running even after a user declines consent, according to Privacy International.

The GoodRx case shows exactly what this looks like in practice. In February 2023, the FTC charged GoodRx with sharing users' prescription drug and health condition data with Facebook, Google, Criteo, Branch, and Twilio for advertising purposes, despite promising in its privacy policy that it would never do so. GoodRx agreed to a $1.5 million civil penalty and a permanent ban on sharing health data for advertising, as HIPAA Journal reports. A month later, the FTC moved against BetterHelp for sharing therapy users' mental health data with Facebook, Snapchat, Criteo, and Pinterest, and paid $7.8 million that the FTC distributed to consumers as refunds starting in 2024 (California Lawyers Association). The GoodRx case was the FTC's first use of the Health Breach Notification Rule, a regulation that had existed since 2009 but sat unused. BetterHelp was brought under the FTC Act instead. In 2024, the FTC updated that rule to explicitly cover health apps and connected devices. The amendments took effect July 29, 2024.

What makes health data so valuable to outside parties

Demographic data tells an advertiser roughly who you are. Health data tells them what's happening to your body right now.

That specificity is valuable. Someone managing diabetes, dealing with a sleep disorder, or tracking a pregnancy represents a highly targetable consumer with predictable purchasing patterns. Data brokers have been found selling sensitive health information, including mental health data, according to a 2023 Duke University study, and in 2024 the FTC took action against Gravy Analytics for allegedly selling lists of people linked to medical-condition events.

The implications reach beyond advertising. Law enforcement has also obtained wearable data through warrants, including Fitbit heart-rate data used in a murder investigation. When a state subpoenas an app's records, a user who assumed their data was private has little legal recourse unless a specific state law protects them. Washington State's My Health My Data Act (in effect since 2024 and enforceable through private lawsuits as well as by the attorney general) and California's CMIA offer some of the strongest state-level protections. Nevada and Connecticut have similar laws enforced by their attorneys general, so coverage varies significantly depending on where you live, as the University of Cincinnati Law Review notes. A federal bill, the Health Information Privacy Reform Act (S. 3097), would extend HIPAA-style protections to health apps and wearables. It cleared the Senate HELP Committee in July 2026 but hasn’t passed the full Senate and isn’t law.

What you can actually do about it

You don't have to stop using your glucose monitor or sleep ring. But you can make more deliberate choices about how much you share and with whom.

Read the privacy policy before you download. Look for specific language about data sharing. Vague phrases like "partners and affiliates" or "third-party services" are red flags. A trustworthy app names who it shares data with and why.

Decline optional permissions. Most apps ask for more access than they need. Location permissions, contact access, and social login integrations are often optional. Skip them unless there's a clear functional reason to share.

Choose on-device processing where possible. Some apps store and process your data locally rather than sending it to the cloud. This limits how much can be transmitted or shared with third parties.

Audit your connected apps regularly. On iPhone, open Settings > Health > Data Access & Devices to see which apps can read or write your Health data (Apple also documents this in the Health app under your profile > Privacy > Apps). On Android, open Health Connect (Settings > Security and privacy > Privacy controls > Health Connect on Android 14 and up) to review each app's permissions (Google). Revoke anything you don't actively use.

Delete old data. Most health apps let you delete your historical entries. Do this periodically, especially if you stop using an app. In Apple Health, open a category, tap Show All Data, then Edit to delete entries. In Health Connect, use Permissions and data > Data and access > Delete all data. Other apps may keep their own copies, so check each app too.

Watch for "all or nothing" consent. If an app won't let you use its core features without agreeing to broad data sharing, that's a sign the data is the product.

The bottom line

Health data is some of the most sensitive personal information you generate. A glucose reading or sleep pattern, in the wrong hands, can be used to profile you, price your insurance, or target you with ads at your most vulnerable. The law, for now, leaves most of this to the app companies themselves to regulate, and their incentives don't always align with yours.

That doesn't mean you're powerless. It means you need to be deliberate. Read what you agree to. Limit what you share. And know that using a health app does not mean your data is covered by HIPAA.

Conclusion

Your health data tells a detailed story about your body, and the apps that collect it set most of the rules for what happens next. You don't have to give up the tools that help you manage your health. Check what each app shares, keep optional permissions off, and delete what you no longer need.

Guardio doesn't control what health apps do with your data, but it covers a related risk. Browsing protection on your computer and phone blocks phishing sites before they open and explains why, and identity protection monitors your email address and phone number for dark web exposure. No tool catches everything.

Get a free security scan with Guardio today and stay protected.