Experts call for ‘robust’ data protection standards after damning report

Experts have called for more “robust” cybersecurity measures after a damning report revealed that femtech apps are “coercing” users into entering sensitive information that could put them at risk.

New research has found that women’s health apps are exposing users to “unnecessary” privacy and safety risks through their poor data-handling practices

The study, conducted by researchers from King’s College London and University College London (UCL), analysed 20 of the most popular female health apps on the US and UK Google Play Store and found instances of covertly gathering sensitive user data, inconsistencies across privacy policies and privacy-related app features, as well as flawed data deletion mechanisms.

Now, in an effort to address these concerns, experts have called for improved data protection and governance standards.

Ron De Jesus, privacy compliance professional and field chief privacy officer of data privacy platform Transcend, said: “Many apps have incredible access to users’ sensitive health data and they often bury their data collection terms and conditions in a wall of legal text, causing users to gloss over them.

“The implications of this kind of sensitive data collection are enormous. If it falls into the wrong hands, it could threaten users’ physical safety, or lead to workplace discrimination.

“The solution isn’t to stop collecting this data entirely— not when some apps need user data for their intended function. But it is critical that users understand what data apps collect and how they use it,” he told Femtech World.

“It’s table stakes for apps to have robust data protection and governance standards in place. But they must also present transparent data collection policies at the point of download and should always offer users an easy opportunity to delete their data.”

Christophe Van de Weyer, CEO of identity solutions company Telesign, said the UK study, which found that only one app the researchers reviewed addressed the sensitivity of menstrual data with regard to law enforcement in their privacy policies, is a stark reminder of the “urgent” need for robust cybersecurity measures.

“In an era where ransomware gangs leverage advanced technologies like generative AI to exploit vulnerabilities, it is crucial for app developers to implement robust cybersecurity measures, and key personnel, including IT support staff, need to be regularly trained on the latest threats and organisational policies to protect against them,” he said.

Chaitra Vedullapalli, founder of Women in Cloud, said explicit consent with stronger data governance must be a priority.

“Users need to be fully informed about what data is collected for, how it will be used and sold, and who it will be shared with or sold to. This transparency allows users to make informed decisions about their financial and health data privacy,” Vedullapalli explained.

“Additionally, implementing robust data management governance, such as clear and consistent privacy policies and reliable data deletion mechanisms, is crucial.”

Mona Schroedel, specialist data protection lawyer at national law firm Freeths, noted: “In the UK, the rules and regulations specifically single out health data as a special category of personal information that requires particularly stringent protection.

“Companies should have appropriate safeguards in place to protect such sensitive information from being accessible by third parties and/or used in a way that is not compatible with what the users of the apps signed up to.”

Schroedel said the reasoning behind putting health data in a special category is that it can easily lead to discrimination.

“For example, if a female user is trying to get pregnant and feeds information into the app and her employers gain access, there is a risk that this could influence the employer’s decision to give a long-term project to that individual,” she explained.