— — Apps

Opioid addiction treatment apps found sharing sensitive data with third parties – TechCrunch

2 Mins read

A new investigation has found that several widely used opioid treatment recovery apps access and share sensitive user data with third parties.

As a result of the COVID-19 pandemic and efforts to reduce transmission in the U.S, telehealth services and apps offering opioid addiction treatment have surged in popularity. This rise of app-based services comes as addiction treatment facilities face budget cuts and closures, which has seen both investor and government interest turn to telehealth as a tool to combat the growing addiction crisis.

While people accessing these services may have a reasonable expectation of privacy of their healthcare data, a new report from ExpressVPN’s Digital Security Lab, compiled in conjunction with the Opioid Policy Institute and the Defensive Lab Agency, found that some of these apps collect and share sensitive information with third parties, raising questions about their privacy and security practices.

The report studied ten opioid treatment apps available on Android: Bicycle Health, Boulder Care, Confidant Health. DynamiCare Health, Kaden Health, Loosid, Pear Reset-O, PursueCare, Sober Grid, and Workit Health. These apps have been installed at least 180,000 times and have received more than $300 million in funding from investment groups and the federal government.

Despite the vast reach and sensitive nature of these services, the research found that the majority of the apps accessed unique identifiers about the user’s device and, in some cases, shared that data with third parties.

Of the ten apps studied, seven access the Android Advertising ID (AAID), a user-generated identifier linked to other information to provide insights into identifiable individuals. Five of the apps also access the devices’ phone number; three access the device’s unique IMEI and IMSI numbers, which can also be used to identify a person’s device uniquely; and two access a users’ list of installed apps, which the researchers say can be used to build a “fingerprint” of a user to track their activities.

Many of the apps examined are also obtaining location information in some form, which, when correlated with these unique identifiers, strengthens the capability to surveilling a person and their daily habits, behaviors, and interactions. One of the apps’ methods is through Bluetooth; seven apps request permission to make Bluetooth connections. The researchers say this is particularly worrying because this can be used to track users in real-world locations.

“Bluetooth can do what I call proximity tracking, so if you’re in the grocery store, it knows how long you’re in a certain aisle, or how close you are to someone else,” Sean O’Brien, principal researcher at ExpressVPN’s Digital Security Lab who led the investigation, told TechCrunch. “Bluetooth is an area that I’m pretty concerned about.”

Another central area of concern is the use of tracker SDKs in these apps, which O’Brien previously warned about in a recent investigation that revealed that hundreds of Android apps were sending granular user location data to X-Mode, a data broker known to sell location data to U.S. military contractors, and now banned from both Apple and Google’s app stores. SDKs, or software development kits, are bundles of code included with apps to make them work properly, such as collecting location data. Often, SDKs are provided for free in exchange for sending back the app’s cache data.

683 posts

About author
Tristan McCue is a 26-year-old junior programmer who enjoys reading, binge-watching boxed sets, and appearing in the background on TV. He is smart and friendly, but can also be very evil and a bit lazy.He is an Australian Christian. He has a post-graduate degree in computing.
Articles
Related posts
— — Apps

Google abused dominant position of Android in India, antitrust probe finds – TechCrunch

1 Mins read
Google has abused the dominant position of Android in India to illegally hurt competitors in the world’s second-largest internet market, a two-year…
— — Apps

Google’s R&D division experiments with newsletters powered by Google Drive – TechCrunch

2 Mins read
Following entries into the newsletter market from tech companies like Facebook and Twitter, Google is now experimenting with newsletters, too. The company’s…
— — Apps

News aggregator SmartNews raises $230 million, valuing its business at $2 billion – TechCrunch

3 Mins read
SmartNews, a Tokyo-headquartered news aggregation website and app that’s grown in popularity despite hefty competition from built-in aggregators like Apple News, today…
Get All Latest Blog Direct In Your Website

Leave a Reply

Your email address will not be published.