gms | German Medical Science

Introduction: Fitness trackers are increasingly used worldwide since the last five years [1]. People track their physical activity and body functions [2] to aim for a healthier lifestyle and body [3], [4]. However, collected data contains sensitive personal information that needs to be protected [5], [6], [7], [3], [4], [8], [9]. As these personal health measures are now ubiquitous and easy to produce, there is increasing interest in such systems integrated into medical care and may drastically change the health insurance system.

We present an overview about the data collected by selected fitness tracking applications and evaluate their behavior as well as compliance before and after the GDPR became effective.

Methods: The following models were chosen with appropriate applications: Fitbit Charge (Fitbit App), Xiaomi Mi Band 2 (Mi Fit App), Mpow (VeryFit 2.0 App), Polar Loop (Flow App), Huawei Honor Band 3 (Huawei Wear App). The application tests were conducted on Android and iOS devices. To evaluate the data that was synchronised between host device and app the Man-in-the-Middle test was performed with the help of Mitmproxy toolkit (https://mitmproxy.org). The Privacy Policy of each manufacturer was analyzed regarding agreement with the transferred data.

Results: All apps gather information about host and mobile settings by default. This includes International Mobile Equipment Identity (IMEI), mobile brand, model, OS version, system type, cookies, user agent information (for example, iPad, iOS 12.0, Scale/2.00), app name and version, country, language, time zone, and unique app token. They all establish connections with multiple servers that are hosted in manufacturer country. All apps use transport encryption, except Mpow, that uses an unknown end-to-end encoding. Analyzing tools such as Mixpanel (https://mixpanel.com) are present in the Fitbit App and Google Analytics (https://analytics.google.com) in the Flow App that collect usage data of the application and also personal data such as user session ID, events (app actions, trainings), and duration of the events. All tested applications, except Huawei Wear, store personal information on remote servers (weight, age, profile picture, date of birth, name, e-mail, gender, trainings and nutrition logs). Fitbit, Polar, Mpow and Xiaomi transfer more data than mentioned in their privacy policy. The connection with Xiaomi servers is active in background. Huawei Honor Band 2 has GDPR-compliant security settings and saves data only locally on the device. The only connection observed was to graph.facebook.com during usage of the app. Only general device information such as device name and operating system are transferred.

Discussion: The experiment shows that for most of the examined devices compliance with data protection according to Federal Data Protection Act (BDSG) and EU-GDPR is not given. Information about personal data collection (Art. 13 GDPR) is missing and most apps incorporate Google and Facebook SDKs tracking. Custom security settings in Apps are poor or missing completely.

The test shows that there are many apps gather the user’s personal data and personal profile can be created.

The authors declare that they have no competing interests.

The authors declare that an ethics committee vote is not required.