A practical health data privacy checklist

Updated June 2026

Health data privacy

Why health data is uniquely sensitive

Before the checklist, it's worth being clear about why health data deserves more care than an email address or a shopping history. Three qualities set it apart.

First, it's often permanent. You can change a leaked password in minutes and cancel a compromised card in a day. You cannot change a diagnosis, a lab history, or your genome. Once genetic or medical information is out, it stays out — there is no reset button.

Second, it's deeply revealing. Health records can expose conditions you haven't told anyone about, medications, mental-health history, pregnancy, and fertility. Even data that looks harmless in isolation — resting heart rate, sleep times, step counts — can combine into a surprisingly detailed picture of your life.

Third, in the case of DNA, it implicates people who never consented. Your genome is partly shared with your parents, siblings, and children. Uploading your raw DNA discloses probabilistic information about relatives who had no say in the decision — which is one reason genetic data is treated as a special category under laws like the EU's GDPR.

Health information can also shape how others perceive you — influencing assumptions in insurance, employment, or lending contexts even where explicit discrimination is prohibited. None of this is a reason to panic; it's a reason to be deliberate. The checklist below is the deliberate version.

Know exactly what you're sharing, and with whom

Start by getting concrete. "Sharing my health data" is too vague to act on; the useful question is which data, with which company, for what. Before connecting anything, try to name the specific fields involved — heart rate, sleep, glucose, a full medical record, a raw DNA file — and the specific organization receiving them.

This matters because the receiving party sets the rules. The moment your data reaches a company's servers, it lives under that company's policies, security practices, jurisdiction, and future — including whatever happens if it's acquired or shuts down. Knowing who holds your data is the foundation for every other decision on this list. If you can't tell who ends up with a given piece of information, treat that as a reason to slow down.

Read permissions before you connect any app

The single highest-leverage move is to slow down at the permission prompt. When an app asks for access to your health records, location, or wearable data, it's asking for an ongoing feed — not a one-time peek. Before you tap Allow, ask three questions: what exactly does it read, does it also write data back, and does it send anything off your device?

Grant the narrowest access that makes the feature work. If a sleep app only needs sleep and heart rate, it has no reason to read your full medication list or reproductive health data. On iOS you can toggle individual Health categories on or off per app; on Android, Health Connect lets you do the same. Decline first, enable later — it's far easier than clawing back access after the fact.

Prefer on-device, local processing

Where your data is processed matters as much as who collects it. An app that analyzes your metrics locally on your phone exposes far less than one that uploads everything to a server for "analysis." Local processing means there's no central copy to breach, subpoena, or sell.

When you evaluate a health app, look for language like "processed on your device" or "data stays on your phone." Be skeptical of vague reassurances such as "we take privacy seriously" with no specifics. If you want the deeper reasoning behind this trade-off, see our breakdown of on-device vs. cloud health data privacy.

This is the model Quanome is built on: your DNA file, Apple Health data, lab results, and body metrics are parsed and organized locally on your phone, not uploaded to a server. Stated plainly, there is no central copy of your health timeline for anyone to breach, subpoena, or sell — because it never leaves the device you control.

Check whether your data is sold, shared, or used for ads and research

Once you know where data is stored, look at where it flows. A collected-and-kept model is very different from a collected-and-monetized one. Three flows are worth checking specifically:

• Sold or shared with third parties. Does the policy allow selling your data, sharing it with "partners," or passing it to data brokers? This is the flow most likely to move your health data somewhere you'd never have chosen.
• Used for advertising. Some free apps fund themselves by profiling users for ads. Health data used this way can drive assumptions about you that you never see or get to correct.
• Used for research or model training. Contributing to research can be genuinely valuable — but it should be your explicit, informed choice, not a default buried in the terms. Check whether it's opt-in, whether you can withdraw, and whether the data is de-identified.

The tell is specificity. A trustworthy policy states plainly whether these flows happen and gives you controls; vague language like "we may share data with select partners to improve our services" is doing a lot of quiet work. This matters most for genetic data, since a company's answer can change if it's sold — our guide to what happens to your DNA data when a company is sold walks through that scenario.

Be cautious uploading raw DNA

Your genome is the one piece of health data you can never change, and uploading a raw DNA file is a one-way decision. Once your file sits on a third-party server, it's subject to that company's policies, its security, and whatever happens to it if the company is acquired or goes bankrupt.

Most DNA interpretation tools ask you to upload your raw file. Before you do, check whether the service deletes the file after analysis, whether it shares data with research partners or law enforcement, and whether there's an on-device alternative that reads the file without it ever leaving your phone. If you're unsure, keep your raw data file backed up privately and wait until you find a tool you trust.

Check your deletion and export rights

A trustworthy service makes it easy to leave. Before you commit your data to any app, confirm two rights up front: can you export your data in a usable format, and can you delete it completely?

Read past the marketing to the actual mechanism. Does deletion happen instantly, or is it a support-ticket request that takes weeks? Does it remove backups and copies already shared with partners, or only the active record? "Deletion" that leaves de-identified data in a research pool, or copies with third parties, is not the same as your data being gone. Knowing the exit before you enter means you're never locked in — and a company that hides or complicates deletion is telling you something. If you're doing this for a genetics service specifically, our step-by-step guide on how to delete your 23andMe data shows what a real deletion flow looks like and what to confirm.

Be careful with account linking and "Sign in with"

A quiet source of exposure is how accounts connect to each other. "Sign in with Google" or "Continue with Facebook" is convenient, but it links your health service to a larger identity account and can share profile data between them. When you link a fitness platform, a lab portal, or a DNA service to a social login, you're widening the circle of companies that can associate that data with the real you.

Where it's practical, prefer a standalone account with its own email and password for sensitive health services, so a problem with one login doesn't cascade into your health records. When you do link accounts, review what data the connection shares — the consent screen usually lists it — and revoke links you no longer need.

Review which apps already share your data

Most people accumulate permissions they've long forgotten. Set a recurring reminder — once a quarter is plenty — to audit what has access:

• Open Settings → Privacy → Health (iOS) or Health Connect (Android) and review every app that can read or write each metric.
• Revoke access for anything you no longer use or don't recognize.
• Check connected-account screens in services like fitness platforms and lab portals for third-party integrations you authorized once and forgot.
• Skim the privacy policy of anything still connected for new data-sharing clauses.

This ten-minute sweep often surprises people: a workout app from two phones ago, a one-off challenge tracker, a lab portal linked to a marketing service. Each one is an open door worth closing.

Use strong authentication everywhere

All the careful permission-setting in the world won't help if someone can simply log into your account. Health and genetic accounts deserve your strongest protection:

• Use a unique, long password for every health service — a password manager makes this painless.
• Turn on two-factor authentication wherever it's offered, preferring an authenticator app over SMS codes.
• Lock your phone with a strong passcode and biometric unlock, since that device is the gateway to most of your health data.

Reusing one password across your lab portal, fitness account, and email means a single breach anywhere can cascade into all of them.

Keep your data on devices you control

Favor a setup where your health timeline lives on hardware you own rather than scattered across servers you don't. Local backups you encrypt yourself, an export you keep offline, or an app that keeps all your health records in one place on-device all reduce how many copies of your sensitive data exist in the world. Fewer copies, fewer places for things to go wrong. If you're weighing such tools, our roundup of the best personal health record apps compares them on exactly this point.

Read the privacy policy for the parts that matter

You don't have to read every line — but do search the policy for a few specific things: whether data is sold or shared with advertisers, whether it's used to train models, how long it's retained, and what happens to it in a merger or acquisition. The presence of clear, specific answers is itself a good sign. Evasive or boilerplate language is a reason to look elsewhere.

Know your rights, at a high level

You don't need to be a lawyer, but a rough sense of your rights helps you ask the right questions. Two frameworks come up most often, and it's worth knowing what each does and doesn't cover.

In the EU and UK, GDPR treats health and genetic data as a special category with extra protection. Broadly, it gives you rights to access the data a company holds, correct it, delete it, and in many cases move it elsewhere — and it requires a lawful basis, often your explicit consent, to process it in the first place. If you're in Europe, these rights apply to many consumer apps, not just hospitals.

In the US, HIPAA is narrower than people assume. It governs healthcare providers, insurers, and their business associates — but it generally does not cover most consumer wellness apps, fitness trackers, or direct-to-consumer DNA services. Data you put into a step counter or a genetics app usually sits outside HIPAA, governed instead by that company's own privacy policy and by general consumer-protection or state laws (several US states now have their own health-data rules).

The practical takeaway: don't assume a law is protecting you. Check where you live, check whether the specific app is covered, and lean on the app's own stated commitments — which is exactly why the earlier steps about deletion, sharing, and policies matter.

Treat new connections as decisions, not defaults

Finally, shift your default. Every new app, integration, or upload is a decision about your most personal data, not a formality to click through. Slowing down for ten seconds at each prompt — and applying the checks above — is what separates people who protect their health data from those who only find out where it went after something goes wrong.

Privacy isn't a one-time setup; it's a posture. Run this checklist now, revisit the quick audits each quarter, and you'll keep control of your health data without it ruling your life. For more practical guides, browse the Quanome blog.

Frequently asked questions

What is the most important step for health data privacy?

Reading permissions before you connect any app is the highest-leverage step. Most data sharing starts the moment you tap Allow, so understanding exactly what each app reads, writes, and transmits prevents the majority of avoidable leaks.

Is it safe to upload my raw DNA file to a website?

Uploading raw DNA hands your genome to another company's servers, subject to its policies, breaches, and any future sale. Because genetic data can never be changed, prefer tools that analyze the file on your own device so it never leaves your phone.

How do I check what health data an app is sharing?

Review the app's permissions in your phone settings, then check Apple Health or Health Connect data-access screens to see which apps can read or write each metric. Revoke anything you do not actively use and read the privacy policy for third-party sharing.

Can I delete health data I already shared with an app?

Often yes. Most reputable services offer a deletion request and a data export. Check the app's settings or privacy policy for these rights, and confirm whether deletion removes backups and data already shared with partners.

Why is health data considered more sensitive than other personal data?

Health data is often permanent, deeply revealing, and — in the case of DNA — implicates your blood relatives too. You can change a leaked password, but you cannot change a diagnosis or your genome. It can also shape how insurers, employers, or others perceive you, which is why it deserves stricter handling than everyday personal data.

What does data minimization mean for health apps?

Data minimization means sharing only the data a feature actually needs, for only as long as it's needed. In practice that means granting narrow permissions, choosing apps that process data on your device instead of uploading everything, and revoking access you no longer use. Fewer copies in fewer places means fewer ways for things to go wrong.

Do GDPR or HIPAA protect my consumer health app data?

It depends. In the EU, GDPR gives you rights to access, correct, and delete personal data, including health data as a special category. In the US, HIPAA covers healthcare providers and insurers but generally does not cover consumer wellness apps or DNA services. Check each app's policy rather than assuming a law covers it — coverage varies by where you live and what the app is.

How often should I review my connected health apps?

A quarterly review is a reasonable rhythm for most people. Open your phone's Health or Health Connect settings, revoke access for apps you no longer use, and skim connected-account screens in fitness and lab portals for old integrations. It takes about ten minutes and tends to surface forgotten connections worth closing.

Does Quanome upload my health or DNA data?

No. Quanome parses your DNA file and organizes your Apple Health, lab results, and body metrics on your own device. Your raw genetic file is never uploaded to a server, which removes the central copy that would otherwise be exposed to breaches, sale, or third-party sharing.