88% of health apps could collect your data: how to check yours
Before you log meals in a new app, it is worth asking where that data goes. A 2021 BMJ study looked at code and network traffic in thousands of health-related apps on Google Play, not your food diary specifically, but the category many food trackers sit in.
Short answer
- ~21,000 health and fitness apps from the Australian Google Play store were studied (2019 data).
- 88% contained code that could collect user data, mostly via third-party SDKs.
- 28% had no privacy policy; only 3.9% were seen actually transmitting data in the researchers' dynamic tests.
- Use a quick five-step check on any app you install; this study did not test every app on earth.
What researchers checked in ~21,000 apps
Tangari and colleagues performed a cross-sectional analysis of health and fitness apps available on Google Play in Australia (BMJ 2021).
They used static analysis of app code (what libraries are present) and dynamic analysis (what happened when apps were run in a test environment).
"Could collect" vs "did send": read the numbers right
88% contained code associated with potential data collection, often advertising or analytics libraries bundled by developers.
In dynamic tests, 3.9% of apps were observed transmitting data across the network in the study setup.
Those two numbers answer different questions. "Could" is about risk in the binary; "did send" is about what was seen in limited runs. Neither proves what your installed app does on your phone today after updates.
Third parties and missing privacy policies
61% of the potential data collection was linked to third-party services (analytics, ads, social SDKs).
28% of apps had no privacy policy at all in the store listing, a red flag before you type anything personal.
A 5-minute privacy check for any food or fitness app
- Permissions: does it need location, contacts or microphone for what it claims to do?
- Account required? Can you use core features without signing in?
- Privacy policy: is there a clear policy in the store, and does it name data recipients?
- Data safety label (Google Play) or platform equivalent: read what is collected and shared.
- Delete and export: can you delete your account and data, or only uninstall?
PastePlate-AI was not part of this study. Tip posts do not explain our product; you can still run the same checklist on any app you try.
Limits of the study (Android, Australia store, 2019 data)
- Android apps from one national store snapshot, not iOS, not 2026 policies.
- Automated testing cannot capture every server or consent flow.
- App behaviour changes with updates.
Try it yourself
Open the permissions screen of the app you log food in today and read one paragraph of its privacy policy. Try it free for 7 days.
Sources
- Tangari G., Ikram M., Ijaz K., Kaafar M. A., Berkovsky S. (2021), "Mobile health and fitness apps and privacy: cross sectional study", BMJ 373: n1248. bmj.com
Video transcript
TRANSCRIPT_vid049
PastePlate-AI on your phone
The logbook stays on your device. You bring the chat AI you already use.
This blog does not give medical advice. Health disclaimer.