Metrics

Low Data Risk

Data risk determines the level at which data can be threatening or damaging to the user27,28. Wearables, in particular, provide detailed health information such as sleep quality29, physical activity30, blood glucose levels31 as well as information about an individual’s surroundings32,33. This category of data is often deemed the most confidential of all personal data13 and can be characterized as highly sensitive. Improper management of wearables data could inflict tremendous harm to the user. Previous studies justify privacy risks by determining the privacy calculus of wearables–that is, whether the risk in privacy is in proportion to the benefit obtained25,34–37. Improper management of such data could inflict tremendous harm to the user. As such, risk can be determined by understanding two distinct categories of data.

Data risk can be reliably characterized by primary data (data collected directly by the wearable device). Wearables that map more sensitive data such as sleep quality, physical activity, blood glucose levels at frequent intervals. This category of data is often deemed the most confidential of all personal data and is a relatively straightforward measure to quantify the data risk incurred from using that wearable device.

On the other hand, the data risk posed by secondary data (data that can be inferred or predicted from primary data) is less apparent and more difficult to quantify. As prediction methods mature, highly sensitive information can increasingly be inferred from less sensitive information38. This concern is the chief reason why data can never truly be anonymized39,40. Ideally, vendors and manufacturers should collect any data that could be utilized to predict highly sensitive information. However, the benefit of most health-monitoring wearables stems from being able to track personal health information, which serves as a proxy for more sensitive information. As a result, while a distinction between wearables that collect moderately sensitive versus not sensitive information is made, most modern-day wearables have the potential to track or predict highly sensitive information.

A list of data types, potential harm to the user, and links to relevant studies are provided in the table below.

Data type Potential harm Citation
Body temperature Period cycle tracking, pregnancy tracking 38
Heart rate COVID-19 41
Location data Domestic abuse, stalking 42,43
Location data Workplace harassment 44,45

Recommended Performance

Vendor does not collect any data that is potentially harmful. Harmful data is categorized as any information that falls under the following categories:

  • Physiological data

  • Health status data

  • Sleep data

  • Health risk assessment data

  • Predictive health insights data

Performance Explanation

The following are data categories and examples of data that may be collected from wearable devices. This list is by no means exhaustive and should serve as a guideline of what data wearables may collect.
Primary:

  • Physical activity data: Steps count, distance covered, floors climbed, type of physical activity (walking, running, swimming, biking, etc), calories burned, pace, speed, cadence, elevation gain, activity duration, move minutes, MET minutes

  • Physiological data: Heart rate, heart rate variability, blood pressure, blood oxygen levels, respiratory rate, skin temperature, electro-dermal activity, galvanic skin response, pulse wave velocity, oxygen uptake, minute ventilation

  • Sleep data: Total sleep time, sleep stages, sleep interruptions, sleep quality, sleep efficiency, snoring data, bedtime, wake-up time, sleep latency, sleep movement, sleep events (apneas, hypopneas)

  • Health status data: Menstrual cycle tracking, glucose levels, blood coagulation levels, hydration levels, sweat analysis, body temperature, basal metabolic rate, body mass index, body composition, lung function, cholesterol levels

  • Environmental exposure: UV exposure, noise levels, air quality, allergen exposure, ambient temperature, humidity, light exposure, pollution exposure

Secondary:

  • Health risk assessment: Likelihood of health issues (cardiovascular disease, sleep apnea, diabetes, hypertension, chronic stress, metabolic syndrome, COPD, risk of falling in elderly, stroke risk, atrial fibrillation risk, cancer risk)

  • Physical fitness level: Estimated VO2 max, fitness age, recovery time, body composition, lactate threshold, functional threshold power, muscle load, training load, training effect, training status, anaerobic training effect, power-to-weight ratio

  • Lifestyle habits: Sleep habits, physical activity habits, sedentary time, screen time, dietary habits, hydration habits, stress management habits, medication adherence, smoking habits, alcohol consumption

  • Behavioral patterns: Regularity and consistency of physical activity, sleep patterns, circadian rhythm, changes in heart rate variability, social interaction patterns, occupational activity patterns, travel patterns, shopping habits

  • Predictive health insights: Predicted onset of conditions like the flu or a cold, risk of burnout, risk of depression, risk of anxiety, risk of heat stroke, cognitive performance, cognitive decline, fatigue prediction, mood prediction, seizure prediction

  • Demographic data (weight, height, etc – find some study that cites this)

  • Voluntary health data (what medicine is being taken? etc)

Despite most wearable devices not being covered under HIPAA and GDPR only being applied in Europe, they provide the crucial foundational frameworks to determine what kind of data may introduce health privacy risks16,46. Of the categories and examples listed above, the following data categories could cause a privacy risk based on data sensitivity:

  • Physiological data

  • Health status data

  • Sleep data

  • Health risk assessment

  • Predictive health insights

Other categories may present health data violations depending on the user and what their understanding of consent is, but based on the HIPAA and GDPR frameworks, these data categories present the largest risks to most users. Any wearables that collect data that fall under these categories can pose a problem.

Physiological data such as heart rate and blood pressure, along with health status data like glucose levels, can reveal underlying health conditions that, if mishandled, might lead to discrimination in areas such as employment or insurance47,48. Sleep data provides insights into personal lifestyle and potential sleep disorders, compromising privacy and potentially leading to psychological distress49. Health risk assessments, drawing on primary data to evaluate the likelihood of health problems, may result in unjust discrimination or unwarranted anxiety, especially if used improperly in contexts like insurance risk modeling50. Predictive health insights, which involve analyzing various data to forecast future health conditions, carry similar risks and can also lead to higher premiums or denial of coverage based on predicted health risks. In total, these categories highlight the potential misuse of sensitive health information, potentially leading to tangible harms such as discrimination, social stigma, psychological distress, and financial loss.

Summary

Privacy Metrics

Summary

The need for privacy protections is on the rise, driven by increased susceptibility to privacy invasions and loss of control over private information. Privacy has evolved over time to match the growing needs of society–despite numerous attempts to define privacy1–6, the inherent ambiguity of the concept remains a challenge. However, the ambiguity of privacy should not hinder efforts to study its manifestations and to establish regulations to protect it. A general consensus for more privacy regulation is apparent, and maintaining privacy with other fundamental values like autonomy and liberty is critical7.

Wearables pose a unique privacy threat as adoption increases rapidly across consumer, medical, and research sectors. Wearables have been described as ubiquitous by multiple studies8,9. About 30% of adults in the United States use wearables10. However, this surge in popularity has also brought new privacy considerations11,12. Privacy is especially critical for wearables, as they are increasingly used to measure and record health information (categorized as “most confidential”)13,14. Unfortunately, regulatory bodies like the U.S. Food and Drug Administration do not regulate these devices15 and few legal protections exist to safeguard the privacy of wearables users. Comprehensive health-specific legal frameworks such as the Health Insurance Portability and Accountability Act of 199616 are not applicable to wearables, engendering a significant lapse in health data protection17.

A privacy criterion for health-monitoring wearables is critical. Top scholars and research efforts on wearables privacy have identified the impact of numerous wearables privacy issues. The current landscape for wearable devices is mired by problems such as the consentless exchange of highly sensitive information18,19, real-time collection of data from users20, legal challenges12,17,21–23, perceived privacy concerns by users24,25, and lax security practices and software/hardware vulnerabilities12,26.

De-identification

Public datasets have become exceedingly common, as there are major benefits to higher volumes of data being made available. However, this typically comes at the cost of privacy, and organizations have opted to de-identify data to combat these risks. De-identification strips privacy-sensitive information from the dataset while maintaining other information66. Many opt to de-identify data at time of collection, as it reduces the risk of exposing potentially sensitive data of individuals. De-identification of data is a worthwhile endeavor, as it limits the sensitivity of data being collected–and subsequently, places higher protections of the privacy of users.

It is important to note that re-identification of anonymized data is becoming a serious limiter to de-identification as a method of preventing privacy threats. A report in 2016 found a 320% increase in hacking attacks on healthcare providers75, and the volume and quality of wearable data exacerbated the negative impact of possible hacking efforts by malicious actors. Current methods of de-identification such as K-anonymity55,76, L-diversity69,77, and T-closeness69,76 each present unique challenges when combating re-identification techniques.

Recommended Performance

Vendor de-identifies data.

Performance Explanation

By nature of the request, it would be impossible to determine what de-identification method is utilized by vendors.

Any data that can be tied to health data should be de-identified before sharing.

Data Sharing with Third Parties

Most wearable manufacturers include clauses about sharing data with third-party vendors, who in turn may use the data for purposes outside the extent of the explicit consent provided by users. Numerous service policies of wearables evaluated in this review include general third-party data-sharing provisions, including major vendors such as Apple and Google’s Fitbit78–80. Additionally, few vendors discuss which and why third-party services gain access to users’ personal data; broad, all-encapsulating language is common to account for probable actions (e.g. sharing of data to additional, undisclosed third parties) or possible actions without the need for amendment (e.g. acquisition of data by a merger)81. Furthermore, many include the language of sharing identifiable information if required by law, which could result in harmful legal repercussions to the user. Tech policy researchers in the United States warn on the repercussions of period-tracking apps invading individual privacy due to Roe v. Wade being overturned82–85. As such, sharing data with third parties could be detrimental to a user’s privacy.

Recommended Performance

Vendor does not share data with third parties.

Performance Explanation

None.

Transparency in third-party sharing

Vendors should seek to inform users of any and all data that is shared, along with intent.86 claims that it is becoming increasingly harder to identify and regulate third parties as they are largely not beholden nor obligated to respect the initial privacy agreement between a user and the vendor. The paper suggests a solution where particular types of information should remain confidential, regardless of who may acquire the data. Unfortunately, this requires users and regulators to know which third parties are provided access–supporting the full transparency and disclosures of all third parties provided with user data. A vendor who does not choose to share data with a third party would automatically receive full marks.

Recommended Performance

Vendor discloses all third parties that receive user data.

Performance Explanation

Any language of data sharing with vague or unspecified third parties is not transparent. In one study, human annotators determined the top 5 vague words in privacy policies to be “may”, “personal information”, “information”, “other”, and “some”87. Another study analyzed mobile health and fitness apps to find that privacy policies were frequently not applied to third party links and services88. One researcher goes as far to coin the term “Incognito Problem” to refer to users being provided little to no information on which third parties obtain user data89.

If vendor does not share data with third parties, vendor is awarded this metric automatically.

HIPAA Compliance

The Health Insurance Portability and Accountability Act (HIPAA) is a United States federal law passed in 1996 to protect the health information of patients16. While initially met with criticism, HIPAA has proved capable in practice because of its comprehensive and detailed nature51. With the addition of the 2009 Health Information Technology for Economic and Clinical Health Act amendment to account for electronic health records, HIPAA is an effective and comprehensive legal framework to regulate privacy concerns52. The rise in the popularity of wearables has caused critics to call for further addenda to the existing framework, including a broader range of data types and an update of provisions53,54.

Wearables data should be covered under HIPAA. Under HIPAA, 18 critical identifiers (information specific to an individual that may identify that individual) should be suppressed to maintain the anonymity of de-identified data. The dissemination of data to the public is becoming increasingly common for research or general information purposes55, especially with the unbridled adoption of technology to combat issues in health56–58. Massive, anonymized public health datasets such as NHANES59 are made available by major institutions and collective efforts by scientists. In its infancy, masking HIPAA identifiers proved sufficient in protecting health information52 and should serve as a benchmark for wearables data as well.

HIPAA states that all identifiers must be removed from a dataset and the HIPAA’s Privacy Rule requires patient consent before revealing identifiable health information16. Similarly, wearables should limit the number of HIPAA identifiers collected from individuals. These identifiers serve as one of the simplest ways to associate health information with an individual. And while vendors may argue that any data released will be stripped of any identifying information (including HIPAA identifiers), privacy protections are best afforded when wearables refuse to collect such identifying information in the first place. However, the conclusions made by this metric serve only as a baseline. Numerous peer-reviewed studies reveal that anonymized health data can be re-identified60–63, primarily through the pairing of data from other public sources64–66. Efforts to de-anonymizing datasets are prevalent–the Netflix prize dataset67, AOL web search queries68, and Group Insurance Company anonymized medical dataset (spawning the k-anonymity model to protect privacy)69–71 are three of numerous successfully re-identified datasets previously thought anonymous, leading to speculations as to whether any publicized data can reliability be considered private52. Wearables data is also subject to these vulnerabilities and may pose an even greater risk due to the volume and detail of the data collected. Researchers have raised similar concerns with wearables data65,72–74. Still, limiting access to identifying information bodes well for privacy initiatives.

Recommended Performance

No HIPAA identifiers.

Performance Explanation

Any data that falls under what is outlined as a HIPAA identifier would make a device non-HIPAA compliant. While most wearable devices are not covered under HIPAA, this law provides a comprehensive legal framework to determine what may be important identifying data that wearable devices should collect with explicit consent.

  • Name

  • Address

  • All elements of dates related to an individual

  • Telephone numbers

  • Fax number

  • Email address

  • Social security number

  • Medical record number

  • Health plan beneficiary number

  • Account number

  • Certificate or license number

  • Vehicle identifiers and serial numbers

  • Device identifiers and serial numbers

  • Web URL

  • Internet protocol address

  • Finger or voice print

  • Photographic image

  • Any other characteristic that could uniquely identify the individual.

References
1.
Martin, K. D. & Murphy, P. E. The role of data privacy in marketing. Journal of the Academy of Marketing Science 45, 135–155 (2017).
2.
Westin, A. F. Privacy and freedom. Washington and Lee Law Review 25, 166 (1968).
3.
Altman, I. The environment and social behavior: Privacy, personal space, territory, and crowding. (1975).
4.
Rosenberg, R. S. The social impact of computers. (Elsevier, 2013).
5.
Nissenbaum, H. Privacy in context: Technology, policy, and the integrity of social life. (2020).
6.
Warren, S. D. & Louis, D. Brandeis, the right to privacy, 4 harv. L. rev 193, 1321160 (1890).
7.
Gavison, R. Privacy and the limits of law. The Yale law journal 89, 421–471 (1980).
8.
Ravi, D., Wong, C., Lo, B. & Yang, G.-Z. A deep learning approach to on-node sensor data analytics for mobile or wearable devices. IEEE journal of biomedical and health informatics 21, 56–64 (2016).
9.
Greiwe, J. & Nyenhuis, S. M. Wearable technology and how this can be implemented into clinical practice. Current allergy and asthma reports 20, 1–10 (2020).
10.
Chandrasekaran, R., Katthula, V. & Moustakas, E. Patterns of use and key predictors for the use of wearable health care devices by US adults: Insights from a national survey. Journal of medical Internet research 22, e22443 (2020).
11.
Motti, V. G. & Caine, K. Users’ privacy concerns about wearables: Impact of form factor, sensors and type of data collected. in Financial cryptography and data security: FC 2015 international workshops, BITCOIN, WAHC, and wearable, san juan, puerto rico, january 30, 2015, revised selected papers 231–244 (Springer Berlin Heidelberg, 2015).
12.
Perez, A. J. & Zeadally, S. Privacy issues and solutions for consumer wearables. It Professional 20, 46–56 (2017).
13.
Mehraeen, E., Ghazisaeedi, M., Farzi, J. & Mirshekari, S. Security challenges in healthcare cloud computing: A systematic review. Global journal of health science 9, 157 (2016).
14.
Bansal, G., Gefen, D., et al. The impact of personal dispositions on information sensitivity, privacy concern and trust in disclosing health information online. Decision support systems 49, 138–150 (2010).
15.
Banerjee, S., Hemphill, T. & Longstreet, P. Wearable devices and healthcare: Data sharing and privacy. The Information Society 34, 49–57 (2018).
16.
Act, A. Health insurance portability and accountability act of 1996. Public law 104, 191 (1996).
17.
Theodos, K. & Sittig, S. Health information privacy laws in the digital age: HIPAA doesn’t apply. Perspectives in health information management 18, (2021).
18.
Di Pietro, R. & Mancini, L. V. Security and privacy issues of handheld and wearable wireless devices. Communications of the ACM 46, 74–79 (2003).
19.
Kapoor, V., Singh, R., Reddy, R. & Churi, P. Privacy issues in wearable technology: An intrinsic review. in Proceedings of the international conference on innovative computing & communications (ICICC) (2020).
20.
Thierer, A. D. The internet of things and wearable technology: Addressing privacy and security concerns without derailing innovation. Adam Thierer, The internet of things and wearable technology: Addressing privacy and security concerns without derailing innovation 21, (2015).
21.
Daly, A. The law and ethics of’self quantified’health information: An australian perspective. International Data Privacy Law (2015) 5, 144–155 (2015).
22.
Karale, A. The challenges of IoT addressing security, ethics, privacy, and laws. Internet of Things 15, 100420 (2021).
23.
Saa, P., Moscoso-Zea, O. & Lujan-Mora, S. Wearable technology, privacy issues. in Proceedings of the international conference on information technology & systems (ICITS 2018) 518–527 (Springer International Publishing, 2018).
24.
Gao, Y., Li, H. & Luo, Y. An empirical study of wearable technology acceptance in healthcare. Industrial Management & Data Systems 115, 1704–1723 (2015).
25.
Li, H., Wu, J., Gao, Y. & Shi, Y. Examining individuals’ adoption of healthcare wearable devices: An empirical study from privacy calculus perspective. International journal of medical informatics 88, 8–17 (2016).
26.
Ching, K. W. & Singh, M. M. Wearable technology devices security and privacy vulnerability analysis. International Journal of Network Security & Its Applications 8, 19–30 (2016).
27.
Gibson, V. The problems of researching sensitive topics in health care. (1996).
28.
Johnson, B. & Clarke, J. M. Collecting sensitive data: The impact on researchers. Qualitative health research 13, 421–434 (2003).
29.
Peake, J. M., Kerr, G. & Sullivan, J. P. A critical review of consumer wearables, mobile applications, and equipment for providing biofeedback, monitoring stress, and sleep in physically active populations. Frontiers in physiology 9, 743 (2018).
30.
Henriksen, A. et al. Using fitness trackers and smartwatches to measure physical activity in research: Analysis of consumer wrist-worn wearables. Journal of medical Internet research 20, e110 (2018).
31.
Kim, J., Campbell, A. S. & Wang, J. Wearable non-invasive epidermal glucose sensors: A review. Talanta 177, 163–170 (2018).
32.
Jain, S. H., Powers, B. W., Hawkins, J. B. & Brownstein, J. S. The digital phenotype. Nature biotechnology 33, 462–463 (2015).
33.
Arias, O., Wurm, J., Hoang, K. & Jin, Y. Privacy and security in internet of things and wearable devices. IEEE transactions on multi-scale computing systems 1, 99–109 (2015).
34.
Miltgen, C. L., Popovič, A. & Oliveira, T. Determinants of end-user acceptance of biometrics: Integrating the ‘big 3’ of technology acceptance with privacy context. Decision support systems 56, 103–114 (2013).
35.
Li, Y. The impact of disposition to privacy, website reputation and website familiarity on information privacy concerns. Decision support systems 57, 343–354 (2014).
36.
Dinev, T. et al. Privacy calculus model in e-commerce–a study of italy and the united states. European Journal of Information Systems 15, 389–402 (2006).
37.
Xu, H., Teo, H.-H., Tan, B. C. & Agarwal, R. The role of push-pull technology in privacy calculus: The case of location-based services. Journal of management information systems 26, 135–174 (2009).
38.
Grant, A. & Smarr, B. Feasibility of continuous distal body temperature for passive, early pregnancy detection. PLOS Digital Health 1, e0000034 (2022).
39.
De Montjoye, Y.-A., Radaelli, L., Singh, V. K. & Pentland, A. “Sandy”. Unique in the shopping mall: On the reidentifiability of credit card metadata. Science 347, 536–539 (2015).
40.
Rocher, L., Hendrickx, J. M. & De Montjoye, Y.-A. Estimating the success of re-identifications in incomplete datasets using generative models. Nature communications 10, 1–9 (2019).
41.
Alavi, A. et al. Real-time alerting system for COVID-19 and other stress events using wearable data. Nature medicine 28, 175–184 (2022).
42.
Bowles, N. Thermostats, locks and lights: Digital tools of domestic abuse. The New York Times 23, (2018).
43.
Woodlock, D. The abuse of technology in domestic violence and stalking. Violence against women 23, 584–602 (2017).
44.
Boorstein, M., Iati, M. & Shin, A. Top US catholic church official resigns after cellphone data used to track him on grindr and to gay bars. The Washington Post (2021).
45.
Ajunwa, I. Algorithms at work: Productivity monitoring applications and wearable technology as the new data-centric research agenda for employment and labor law. Louis ULJ 63, 21 (2018).
46.
GDPR, E. EU general data protection regulation (GDPR): Regulation (EU) 2016/679 of the european parliament and of the council of 27 april 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing directive 95/46/EC (general data protection regulation). EC (General Data Protection Regulation) OJ L 119 1, (2016).
47.
Mittelstadt, B. D. & Floridi, L. The ethics of biomedical big data. vol. 29 (Springer, 2016).
48.
Cohen, I. G., Amarasingham, R., Shah, A., Xie, B. & Lo, B. The legal and ethical concerns that arise from using complex predictive analytics in health care. Health affairs 33, 1139–1147 (2014).
49.
Kay, M. et al. Lullaby: A capture & access system for understanding the sleep environment. in Proceedings of the 2012 ACM conference on ubiquitous computing 226–234 (2012).
50.
Crawford, K. & Schultz, J. Big data and due process: Toward a framework to redress predictive privacy harms. BCL Rev. 55, 93 (2014).
51.
Solove, D. J. HIPAA mighty and flawed: Regulation has wide-reaching impact on the healthcare industry. Journal of AHIMA 84, 30–31 (2013).
52.
Cohen, I. G. & Mello, M. M. HIPAA and protecting health information in the 21st century. Jama 320, 231–232 (2018).
53.
Lecher, C. The FDA doesn’t want to regulate wearables, and device makers want to keep it that way. The Verge (2015).
54.
Papandrea, P. Addressing the HIPAA-potamus sized gap in wearable technology regulation. Minn. L. Rev. 104, 1095 (2019).
55.
Samarati, P. Protecting respondents identities in microdata release. IEEE transactions on Knowledge and Data Engineering 13, 1010–1027 (2001).
56.
Budd, J. et al. Digital technologies in the public-health response to COVID-19. Nature medicine 26, 1183–1192 (2020).
57.
McCall, B. COVID-19 and artificial intelligence: Protecting health-care workers and curbing the spread. The Lancet Digital Health 2, e166–e167 (2020).
58.
Ting, D. S. W., Carin, L., Dzau, V. & Wong, T. Y. Digital technology and COVID-19. Nature medicine 26, 459–461 (2020).
59.
Fain, J. A. NHANES: Use of a free public data set. The Diabetes Educator vol. 43 151–151 (2017).
60.
Curfman, G. D., Morrissey, S. & Drazen, J. M. Prescriptions, privacy, and the first amendment. New England Journal of Medicine vol. 364 2053–2055 (2011).
61.
Gellman, R. The deidentification dilemma: A legislative and contractual proposal. Fordham Intell. Prop. Media & Ent. LJ 21, 33 (2010).
62.
Narayanan, A. & Shmatikov, V. Myths and fallacies of” personally identifiable information”. Communications of the ACM 53, 24–26 (2010).
63.
Rothstein, M. A. Is deidentification sufficient to protect health privacy in research? The American Journal of Bioethics 10, 3–11 (2010).
64.
Malin, B. Re-identification of familial database records. in AMIA annual symposium proceedings vol. 2006 524 (American Medical Informatics Association, 2006).
65.
Na, L. et al. Feasibility of reidentifying individuals in large national physical activity data sets from which protected health information has been removed with use of machine learning. JAMA network open 1, e186040–e186040 (2018).
66.
Garfinkel, S. et al. De-identification of personal information:. (US Department of Commerce, National Institute of Standards; Technology, 2015).
67.
Narayanan, A. & Shmatikov, V. Robust de-anonymization of large sparse datasets. in 2008 IEEE symposium on security and privacy (sp 2008) 111–125 (IEEE, 2008).
68.
Barbaro, M., Zeller, T. & Hansell, S. A face is exposed for AOL searcher no. 4417749. New York Times 9, 8 (2006).
69.
Samarati, P. & Sweeney, L. Protecting privacy when disclosing information: K-anonymity and its enforcement through generalization and suppression. (1998).
70.
Sweeney, L. Simple demographics often identify people uniquely. Health (San Francisco) 671, 1–34 (2000).
71.
Sweeney, L. K-anonymity: A model for protecting privacy. International journal of uncertainty, fuzziness and knowledge-based systems 10, 557–570 (2002).
72.
McCoy, T. H. & Hughes, M. C. Preserving patient confidentiality as data grow: Implications of the ability to reidentify physical activity data. JAMA network open 1, e186029–e186029 (2018).
73.
Alam, M. A. U. Person re-identification attack on wearable sensing. arXiv preprint arXiv:2106.11900 (2021).
74.
Li, J., Zhang, J., et al. Privacy-preserving sports wearable data fusion framework. Computational Intelligence and Neuroscience 2022, (2022).
75.
CynergisTek, R. BREACH REPORT 2016: Protected health information (PHI). (2017).
76.
Li, N., Li, T. & Venkatasubramanian, S. T-closeness: Privacy beyond k-anonymity and l-diversity. in 2007 IEEE 23rd international conference on data engineering 106–115 (IEEE, 2006).
77.
Machanavajjhala, A., Kifer, D., Gehrke, J. & Venkitasubramaniam, M. L-diversity: Privacy beyond k-anonymity. ACM Transactions on Knowledge Discovery from Data (TKDD) 1, 3–es (2007).
78.
Pinchot, J., Cellante, D., et al. Privacy concerns and data sharing habits of personal fitness information collected via activity trackers. JISAR 14, 4 (2021).
79.
Haley, T. D. Illusory privacy. Ind. LJ 98, 75 (2022).
80.
Karanasiou, A. P. & Kang, S. My quantified self, my FitBit and i: The polymorphic concept of health data and the sharer’s dilemma. Digital Culture & Society 2, 123–142 (2016).
81.
Reidenberg, J. R., Bhatia, J., Breaux, T. D. & Norton, T. B. Ambiguity in privacy policies and the impact of regulation. The Journal of Legal Studies 45, S163–S190 (2016).
82.
Dong, Z., Wang, L., Xie, H., Xu, G. & Wang, H. Privacy analysis of period tracking mobile apps in the post-roe v. Wade era. in Proceedings of the 37th IEEE/ACM international conference on automated software engineering 1–6 (2022).
83.
Campanella, S. T. Menstrual and fertility tracking apps and the post roe v. Wade era. (2022).
84.
Lewandowska, M. The fall of roe v wade: The fight for abortion rights is universal. bmj vol. 377 (2022).
85.
Spector-Bagdady, K. & Mello, M. M. Protecting the privacy of reproductive health information after the fall of roe v wade. in JAMA health forum vol. 3 e222656–e222656 (American Medical Association, 2022).
86.
Ard, B. Confidentiality and the problem of third parties: Protecting reader privacy in the age of intermediaries. Yale JL & Tech. 16, 1 (2013).
87.
Lebanoff, L. & Liu, F. Automatic detection of vague words and sentences in privacy policies. arXiv preprint arXiv:1808.06219 (2018).
88.
McCarthy, M. Experts warn on data security in health and fitness apps. BMJ: British Medical Journal (Online) 347, (2013).
89.
Asay, C. D. Consumer information privacy and the problems (s) of third-party disclosures. Nw. J. Tech. & Intell. Prop. 11, 321 (2012).