Evaluating privacy policies of AI-powered mHealth iOS applications

This article evaluates the privacy policies of Artificial Intelligence (AI)-powered mHealth apps, focusing on their availability, readability, transparency, and scope.

We replicate the methodology of Sunyaev et al. 2015 for AI-focused mHealth iOS apps and compile a dataset of 2231 apps.

Our analysis reveals that only 68.04% of these apps have publicly accessible privacy policies. On average, a privacy policy contains 2784.25 words, with a mean readability score of 13.48. Regarding transparency, aspects such as "information collection" and "sharing of information" are more frequently discussed, whereas "rationale for collection" is less commonly discussed. Additionally, only 15% of the apps mention the types of information collected, and 11.2% mention the use of user health data for training AI systems. In terms of scope, over 60% of app privacy policies cover the single app, and 25% cover no app-related scope (indicating a general or boilerplate privacy policy not tailored to the specific app).

Our dataset reflects a post-AI and post-General Data Protection Regulation (GDPR) landscape. Therefore, we contrast that with pre-AI 2015, and compared our findings with those of general iOS mHealth apps studied by Sunyaev et al. 2015. Our dataset showed an increase in the presence of privacy policies. In the original study, 38.3% iOS apps were found to have privacy policies, with the mean length being 1755 words and the mean readability being 16. Our results, however, indicate that 68.04% of AI-powered iOS mHealth apps have privacy policies. Additionally, we found the mean length of a privacy policy to be 2784.25 words and the mean readability to be 13.48 (longer but better readability than the original study). Similarly, Sunyaev et al. found that for iOS mHealth apps, 47.8% of privacy policies cover all developer services. Our data, on the other hand, indicates that over 60% of app privacy policies cover the single app, and 25% cover no app-related scope. Our findings have implications for researchers, companies, developers, and end-users.

Our study highlights the increase in the availability, presence, and length of privacy policies of AI mHealth iOS apps. While progress has been made toward greater transparency in policies, the readability and scope of privacy policies still have significant room for improvement.