The download number of health-promotion apps from App Stores is increasing every year. These so-called eHealth-Apps are for users a great chance to encourage their health status proactively but also to monitor this continuously. However, the resulting positive properties also entail risks. In particular, when users disclose (in addition to their personally identifiable information) some of their health-related data. Nowadays, general apps are more and more criticized in the media, especially the aspects of privacy and data security of user data are in focus [24,25]. The aim of this study is to analyze what risks may arise through the daily use of Android eHealth-Apps to user data. The security investigation focuses on three basic security relevant aspects.One topic here is the evaluation of required permissions by the providers as well as the transparency towards the users. Furthermore, the data storage of user data will be analyzed, in particular the readability of the stored data in the database and in generated text files. The third critical focus of this study is the monitoring of the data traffic. The background traffic will be checked, i.e. on possible hidden advertising companies, on encrypted or unencrypted communication protocols and on responding provider server.
Mobile phones are constant companions in modern life. More and more users rely on an increasing variety of mobile applications for everyday tasks – an app offers distraction during a long wait at the doctor's, reminds to take an often forgotten medication or monitors current fitness values. While enabling a variety of tasks, every single app has potential access to a multitude of user information. Mobile phones contain an astonishing diversity of personal facts from contacts, call data, calendars to messaging contents or intimate health data. Despite the potential risks, users are reportedly negligent when it comes to the control of apps' access permissions and tend to grant wide access rights without further scrutiny. Does this negligence cause personal information to be leaked to potentially malevolent actors? The presented assessment focuses on the privacy behavior of applications with a scope in user health and well-being, such as the above-mentioned pill reminder. These apps do not only require access to certain data on the mobile device, they also collect potentially sensitive data such as the frequency and type of medication the user wants to be reminded of. The paper at hand presents an analysis of mobile apps offering operational scope in the health sector. Covered elements are the apps' permission profile, their transmission behavior and their compliance with privacy regulation.