Acceptable use vs exploitation with ‘free’ digital health tools

By Wolfgang Hackl, CEO, OncoGenomX Inc., Allschwil, Switzerland

“Free” digital health tools are rarely free. In most cases the user – healthy or patient – pay with something far more valuable than a subscription fee: intimate, high-granularity data about their bodies, behaviours, and vulnerabilities.

As digital health platforms grow into critical infrastructure for care, research and consumer wellness, a central ethical question has become unavoidable: When does data use enable public good – and when does it cross the line into exploitation?

Across global literature, five bright lines consistently separate acceptable data use from irresponsible or predatory practices: transparency, proportionality, patient control, fairness in value sharing, and protection from harmful downstream uses.

When any of these conditions are missing, offering a “free” tool can become a mechanism for extracting disproportionate value from users while outsourcing the risks back onto them.

The ethics of the deal: what healthy users and patients expect from data sharing

Empirical studies continue to show that most people are willing to share health data – but only conditionally.

Individuals support sharing when data clearly contribute to research, treatment innovation, care quality, or public health.

Trust erodes quickly when data are used for insurance underwriting, targeted advertising, pricing segmentation, or other uses that may limit access to care or worsen financial vulnerability.

What users consistently expect is:

• Clarity – Who sees which data, for what purpose, and for how long?
• Control – Granular permissions and an easy, meaningful opt-out—not buried legalese.
• Security – Strong technical safeguards and independent oversight.
• Benefit – A reasonable expectation that sharing data contributes to something of social or personal value.

Several commentaries argue that requesting personal data without a realistic prospect of benefit—not even transparency about outcomes – is itself problematic because it treats contributions as limitless and one-sided.

The ethical legitimacy of data collection depends on demonstrating respect for the individual’s time, autonomy, and moral investment in the health system.

Exploitation risks in the “free” digital health economy

The most serious risks emerge when a free tool’s business model is fundamentally misaligned with users’ health interests.

Technical audits of reproductive health, wellness and symptom-tracking apps show a common pattern: extremely broad data collection, unclear purpose boundaries, permissive permissions, third-party tracking, and vague categories such as “other information.”

These form the architecture of a data extraction engine rather than a health intervention.

Even apps claiming to hold only de-identified data can open the door to harms, because de-identified health behaviour signals are immensely valuable for:

• Risk scoring and pricing (insurance, consumer credit, employment screening)
• Targeted advertising (particularly manipulative or sensitive targeting)
• Behavioural profiling (including in politically or legally hostile environments)
• Opaque algorithmic triage or eligibility decisions

In such cases, the user’s data generate significant commercial value yet expose the individual to disproportionate risks – a classic hallmark of exploitation.

The “paying twice” problem: who benefits from population data?

Growing debate around emerging health data spaces – especially in Europe – frames exploitation not only as a privacy issue but as a structural market failure.

Health data are immensely profitable. When commercial actors derive outsized value from population-level datasets without mechanisms to share those gains back with the public, patients effectively “pay twice”:

1. First with their data, which fuel product development, risk models, or AI systems.
2. Then again through the high prices of those very products and services.

This disconnect – value extracted privately, risk borne publicly – undermines the legitimacy of the entire ecosystem.

Scholars argue that without reciprocity mechanisms (affordability conditions, public-good obligations, reinvestment requirements, open reporting), population data becomes a one-way transfer of wealth from patients to shareholders.

What acceptable data use actually looks like

Across policy, legal, and ethics scholarship, a consistent set of practical markers has emerged to distinguish responsible data practice from exploitation:

1. Transparency and comprehension

Not merely posting a 30-page privacy policy, but communicating data practices in human-readable language.

Dark patterns, forced consent, or ambiguous categories (“other information”) are widely flagged as red flags.

2. Data minimisation and proportionality

Collect only what is needed for the clear, stated purpose. Health apps that request location, contacts, device IDs, access to photos, or continuous background tracking must justify why such access is necessary for patient benefit.

3. Meaningful patient control

Granular consent, revocation options, and controls that do not punish users for refusing unnecessary data sharing.

Users should be able to say “yes to research but no to advertisers” without losing core functionality.

4. Demonstrable public benefit and reciprocity

Data-driven innovation should return value to the communities who generate the data—through equitable access, affordability, improved care pathways, or transparent reinvestment in health systems.

5. Prohibitions on harmful downstream uses

Platforms must enforce technical and contractual safeguards against uses that could lead to discrimination, exclusion, legal jeopardy, or personal harm – especially in sensitive domains such as reproductive health, mental health, and genomics.

6. Strong security and independent governance

Routine audits of algorithms, permissions, data flows and third-party access; oversight bodies empowered to block or penalise inappropriate secondary use; and governance models built around public accountability.

When these markers are present, data use—whether in research, diagnostics, early detection, or population analytics – can be socially valuable and ethically defensible.

When they are absent, value extraction becomes the default.

Where the industry must go from here

For global Health Tech companies, the stakes are high. Trust is not just a compliance objective – it is a competitive advantage.

As jurisdictions develop new frameworks for data spaces, AI governance, and platform accountability, Health Tech innovators must rise to higher ethical standards than the minimal legal baseline.

A responsible future for digital health requires that “free” tools come with:

• Clear limits on what patient data can be used for
• Oversight mechanisms to validate secondary uses
• Fair distribution of the benefits of data-driven innovation
• Design practices that prioritize patient autonomy and safety

Anything less risks widening inequities, damaging public trust, and ultimately undermining the legitimacy of digital health itself.

The real test of the industry is simple: Are we using patient data to empower people – or to exploit them?

The next decade of digital health will be shaped by how honestly and rigorously we answer that question today.