A headache app can contain symptoms, medication use, menstrual information and notes about work or sleep. Before entering those details, check what the app collects, where the data goes and how you can remove it. A privacy label or reassuring phrase is a starting point, not a guarantee.
Health-app data is not covered by one universal rule
Legal protection depends on where you live, who provides the app and how the data is handled. In the European Union, data concerning health is a special category of personal data under the GDPR. Processing is generally prohibited unless a specific legal basis and safeguards apply.
In the United States, HIPAA applies to covered health plans, many health care providers and their business associates. The US Department of Health and Human Services says that, in most cases, HIPAA does not protect information entered into a personal-use app unless a covered entity or business associate provides that app.
That does not mean other US rules never apply. The Federal Trade Commission states that its Act applies broadly to health-app developers. Its Health Breach Notification Rule can apply to many health apps outside HIPAA when identifiable health information is disclosed or accessed without authorization.
This article is a practical checklist, not legal advice.
Five questions to ask
1. What data does the app collect?
Read the privacy policy and the store listing. On Apple's App Store, the privacy section shows data types the developer says the app may collect and whether data is linked to you or used for tracking. Apple notes that this information is self-reported by the developer.
On iPhone, App Privacy Report can show how often an app accesses permissions and which network domains it contacts. It starts collecting information only after you enable it.
2. Where is the data stored?
Local storage, cloud sync and a developer-run account have different tradeoffs. Local storage reduces the number of systems holding a copy, but the device still needs a passcode, updates and backups. Cloud storage can provide recovery and synchronization, but adds another service and its settings to review. Server storage is not automatically unsafe, and local storage is not automatically secure.
Look for a plain description of storage location, encryption, account requirements and which service providers can process the data.
3. Is data used for analytics or advertising?
Check whether health entries, device identifiers or app activity go to analytics or advertising providers. The FTC has taken enforcement action where health apps disclosed sensitive information contrary to their promises. Do not assume that an app without visible ads has no analytics, or that every app with analytics sells health records. Read the stated purposes and recipients.
4. Can you export and delete your records?
Test the controls before building a long history. Check whether you can export useful data, delete individual entries and remove the full account or dataset. If sync is enabled, confirm whether deletion covers cloud copies as well as the device. Deleting an app does not necessarily delete a cloud account or backup.
5. Does the policy match the product?
A useful policy names the data, purpose, storage, recipients, retention and contact route. Compare it with account screens, permission prompts and network activity. If a feature needs data to leave the device, the policy should explain where it goes and why.
Checking HeadYogi
HeadYogi's current privacy page states that the app:
- requires no account or login;
- stores headache data locally or, when chosen, in the user's private iCloud;
- has no advertisements or third-party trackers in the app;
- offers optional Face ID lock;
- supports PDF, CSV and Markdown export and a delete-all option.
These are product claims documented in HeadYogi's own policy, not an independent security audit. Review the current App Store privacy information and policy before installing because app features and data practices can change. The HeadYogi website has separate website analytics; statements above refer to the iOS app.
A short pre-install checklist
- Open the privacy policy and App Store privacy section.
- Identify every category of health and identifying data collected.
- Check whether an account is required and where records are stored.
- Look for advertising, analytics and third-party recipients.
- Find export, deletion and contact instructions.
- On iPhone, consider enabling App Privacy Report to inspect permissions and network activity.
No single checkbox proves an app is private. The aim is to understand the data flow well enough to decide whether it matches the sensitivity of what you plan to record.
FAQ
Are all health apps covered by HIPAA?
No. HHS says personal-use apps are generally outside HIPAA unless a covered entity or business associate provides them. Other federal or state rules may still apply.
Does local storage guarantee privacy?
No. It can reduce external data flows, but device security, backups, exports and cloud-sync settings still matter.
Can I rely on an App Store privacy label?
Use it as one source. Apple says developers self-report this information. Compare it with the privacy policy, permission requests and App Privacy Report.
Official sources
- Information for individuals: special categories of personal data (European Commission)
- Protecting the Privacy and Security of Your Health Information When Using Your Personal Cell Phone or Tablet (US Department of Health and Human Services)
- Does your health app protect your sensitive info? (Federal Trade Commission)
- Complying with FTC's Health Breach Notification Rule (Federal Trade Commission)
- About privacy information on the App Store (Apple Support)
- About App Privacy Report (Apple Support)
You can compare this checklist with HeadYogi's privacy page, features and how it works. If the documented approach fits your needs, you can download the app.