{"post":{"slug":"health-data-privacy-guide-2026","title":"Health Data Privacy: What Your Apps Are Not Covered By","excerpt":"Medical privacy law covers your doctor, not your fitness tracker. Here is who holds what health data about you, and what you can actually control.","category":"guides","date":"August 16, 2026","author":"ByteLedger Team","content":"<span class=\"dropcap\">T</span>he common assumption is that health information is legally protected wherever it lives. It is not. Medical privacy frameworks generally regulate specific entities — healthcare providers, insurers, and the businesses that serve them. A fitness tracker, a symptom checker, a meditation app, or a nutrition logger is usually none of those, and the same heart rate data is treated completely differently depending on who holds it.\n\nKnowing where the line falls tells you which controls you actually have.\n\n## What changed in 2026\n\n- **Regional consumer health data laws expanded.** Several jurisdictions enacted rules covering health information held by non-medical entities, which is precisely the gap the traditional framework leaves.\n- **Enforcement against health apps increased.** Regulators pursued cases involving apps sharing sensitive health information with advertising networks, establishing that general consumer protection law reaches this conduct.\n- **Inferred health data drew scrutiny.** Attention shifted toward data that implies a health condition without being labelled as health data — purchase history, search behavior, location patterns.\n- **On-device processing spread in wearables.** More analysis happening locally reduced how much raw health data left devices by default.\n\n## Who holds your health data\n\n| Holder | Typically covered by medical privacy law | Notes |\n| --- | --- | --- |\n| Doctor, hospital, clinic | Yes | The core of the framework |\n| Health insurer | Yes | Included |\n| Pharmacy dispensing records | Yes | Included |\n| Fitness tracker or wearable app | Generally no | Governed by its privacy policy |\n| Symptom checker or wellness app | Generally no | Same |\n| Period or fertility tracker | Generally no | Higher sensitivity, same gap |\n| Direct-to-consumer genetic testing | Generally no | Data can outlive the company |\n| Retailer or search engine | No | Inferred health data lives here |\n| General AI assistant | No | Consumer terms are not health terms |\n\nThe genetic testing row deserves particular thought because the data is permanent, identifies relatives who never consented, and can survive a company's bankruptcy as a transferable asset. Read the terms about what happens to your sample and data if the company is sold.\n\n## What you can actually control\n\nCheck the sharing settings in each health app you use. Most have them, most default to some sharing, and most people have never opened that screen. Turning off research participation, advertising identifiers, and third-party analytics takes a minute per app and is the highest-value action available.\n\nReview the platform-level health permissions on your phone. Both major mobile platforms centralize which apps can read from and write to the health store, and the list typically includes apps you granted access to years ago for a single feature.\n\nDelete accounts you no longer use rather than abandoning them. Dormant health accounts continue holding data, and the company's obligations to it do not improve with time.\n\nBe careful about the inferred category, which you cannot control through health app settings at all — it is assembled from ordinary behavior. A data broker removal pass is the relevant lever, and it is covered in [data broker opt out](/blog/data-broker-opt-out-2026).\n\nAnd treat consumer AI assistants as public for this purpose. Describing symptoms to a general assistant on a free consumer account puts that information under ordinary consumer terms, not medical ones. The settings review in [personal AI privacy checklist](/blog/personal-ai-privacy-checklist-2026) applies directly.\n\n## Common mistakes\n\n- **Assuming health data is always protected.** The framework covers entities, not categories of information.\n- **Never checking app sharing settings.** They exist and default to sharing.\n- **Ignoring inferred data.** Purchases and searches can imply more than you disclosed.\n- **Abandoning rather than deleting accounts.** Dormant is not deleted.\n- **Using consumer AI for sensitive health questions.** No health-specific protections apply.\n\n## FAQ\n\n**Does medical privacy law apply if my doctor recommends an app?**\nUsually not to the app itself unless it is operating on the provider's behalf under a formal arrangement. A recommendation does not extend coverage.\n\n**Can my health app data affect insurance?**\nRules on using such data in underwriting vary considerably by jurisdiction and insurance type. The practical answer is to limit sharing rather than rely on prohibitions.\n\n**What happens to genetic data if a company is acquired?**\nIt is generally a transferable asset subject to the privacy policy in force. Some companies commit to specific handling; read the terms before submitting a sample.\n\n**Is on-device processing meaningfully safer?**\nYes, when analysis genuinely stays local. Whether the underlying data also syncs to a cloud account is a separate setting worth checking.\n\n## Where to go next\n\nFor the broader settings pass, read [personal AI privacy checklist](/blog/personal-ai-privacy-checklist-2026). For reducing your data footprint, [data broker opt out](/blog/data-broker-opt-out-2026), and for AI mental health tools specifically, [AI therapy apps](/blog/ai-therapy-apps-2026).","hue":200,"metaTitle":"Health Data Privacy Guide for 2026","metaDescription":"Why medical privacy law does not cover health apps, which regions added consumer health data protection, how inferred health data works, and what to check.","keywords":["health data privacy","hipaa does not cover apps","fitness tracker data sharing","consumer health data law","inferred health information","period tracker privacy","genetic testing data","wearable data protection","digital privacy 2026"],"tldr":["**Medical privacy rules apply to healthcare providers and insurers, not to apps** — a wellness app is generally outside that framework.","**Consumer health data laws in some regions fill the gap** — protection depends heavily on where you live.","**Inferred health data is the least protected category** — purchases, searches, and location can imply conditions you never disclosed.","**Data sharing is usually a setting, and usually on** — checking it takes minutes per app.","**Skip:** entering sensitive health details into a general-purpose AI assistant on a consumer account. Those terms are not health terms."],"readTime":"4 min read","wordCount":801},"related":[{"slug":"ai-therapy-apps-2026","title":"AI Therapy Apps: What They Help With and What They Cannot","excerpt":"AI mental health tools are available, cheap, and genuinely useful for some things. Here is where the evidence supports them and where the limits are serious.","category":"guides","date":"August 17, 2026","author":"ByteLedger Team","readTime":"4 min read","hue":275},{"slug":"metadata-privacy-explained-2026","title":"Metadata Privacy: What Your Files Say Without the Contents","excerpt":"A photograph records where and when it was taken and on what device. A document records who wrote it and every edit. That information travels with the file unless you remove it.","category":"guides","date":"January 5, 2026","author":"ByteLedger Team","readTime":"4 min read","hue":168},{"slug":"personal-ai-privacy-checklist-2026","title":"Personal AI Privacy Checklist: What to Turn Off","excerpt":"AI features arrived switched on across your phone, browser, and work apps. Here is a concrete pass through the settings that matter and what each one actually controls.","category":"guides","date":"August 18, 2026","author":"ByteLedger Team","readTime":"4 min read","hue":195}],"sameCategory":[{"slug":"energy-bill-optimization-2026","title":"Energy Bill Optimization: Tariff First, Hardware Later","excerpt":"Most advice starts with buying something. The largest savings usually come from your tariff and when you run things. Here is the order that actually works.","category":"guides","date":"August 19, 2026","author":"ByteLedger Team","readTime":"4 min read","hue":152},{"slug":"lease-break-guide-2026","title":"Breaking a Lease Without Wrecking Your Finances","excerpt":"Leaving before the term ends has costs, and they are frequently smaller than tenants fear. Here are the routes out and the duty landlords have.","category":"guides","date":"August 19, 2026","author":"ByteLedger Team","readTime":"4 min read","hue":276},{"slug":"security-deposit-guide-2026","title":"Getting Your Security Deposit Back","excerpt":"Deposit disputes are won at move-in, not at move-out. Here is the documentation that decides them and what landlords can legally deduct.","category":"guides","date":"August 19, 2026","author":"ByteLedger Team","readTime":"4 min read","hue":270},{"slug":"small-claims-court-guide-2026","title":"Small Claims Court: Suing Without a Lawyer","excerpt":"Small claims is designed for people to represent themselves over modest amounts. Here is how to prepare a case and the part nobody plans for.","category":"guides","date":"August 19, 2026","author":"ByteLedger Team","readTime":"4 min read","hue":280}],"newer":{"slug":"database-branching-explained-2026","title":"Database Branching Explained: A Branch Per Pull Request","excerpt":"Copy-on-write database branches give every pull request a real database with real data shape. Here is how it works, what it costs, and the data governance catch.","category":"code","date":"August 16, 2026","author":"ByteLedger Team","readTime":"3 min read","hue":162},"older":{"slug":"subagent-architecture-explained-2026","title":"Subagent Architecture: When to Split One Agent Into Many","excerpt":"Delegating to subagents buys you parallelism and a clean context per task. It also buys you coordination overhead and a harder debugging story. Here is where the trade lands.","category":"ai","date":"August 16, 2026","author":"ByteLedger Team","readTime":"5 min read","hue":199}}