P i acy in Mobile Heal h Applica ions o B eas Cance Pa ien s
Jaime Benjumea, En ique Do onzo o, Jo ge Rope o, Oc a io Ri e a-Rome o, Alejand o
Ca asco
Uni e sidad de Se illa
Depa men o Elec onic Technology
Se ille, Spain
[email p o ec ed], [email p o ec ed], [email p o ec ed], [email p o ec ed], [email p o ec ed]
Abs ac —P i acy is a majo conce n o b eas cance
pa ien s. When pa ien s use mobile heal h applica ions
(mHeal h apps), many sensi i e da a a e handled by he
applica ion de elope s. Gene al Da a P o ec ion Regula ion
(GDPR) a ises as a solu ion o p i acy issues. In his pape , we
analyze he p i acy policy o a sample o mHeal h apps o
b eas cance pa ien s, de eloping a scale o check i GDPR is
complied. Despi e p i acy is a key ac o in he adop ion o he
use o mHeal h apps, he low le el o compliance wi h he
GDPR o he analyzed applica ions was qui e su p ising. Thus,
applica ion de elope s mus be conce ned abou his ma e .
Keywo ds: b eas cance , p i acy, GDPR; mHeal h; mobile
applica ions.
I. INTRODUCTION
B eas cance (BC) is he mos common cance in women
[1,2]. Nowadays, he ea ly BC de ec ion and ad ancemen s
in ea men s ha e esul ed in an inc eased su i o ship [3-
5]. Howe e , BC su i o s li e wi h he e ec s o hose
ea men s and possible complica ions [6], equi ing hem o
be p oac i e in he ca e o hei heal h. They mus add ess
medical and psychological conce ns and needs in he pos -
ea men pe iod [7]. Technological solu ions may p o ide
e ec i e ools o heal h educa ion, sel -moni o ing,
communica ion, e c., suppo ing hem in he sel -
managemen o hose su i o ship issues.
Connec ed Heal h, whe e hese solu ions may be
included, is a echnology-enabled heal hca e deli e y model
aimed o maximize heal hca e esou ces [8]. Mobile Heal h
(mHeal h), a subdomain o Connec ed Heal h, is de ined as
he deli e y o heal hca e o heal h ela ed se ices using
po able de ices [9]. Among po able de ices, sma phones
a e pa icula ly in e es ing due o hei inc eased global use,
ubiqui y, high cos -e ec i eness, and capabili ies, such as
acking use s’ beha io s and p o iding hem eal- ime
eedback. The use o mobile heal h applica ions (mHeal h
apps) o heal h and well-being p omo ion has inc eased
apidly in ecen yea s [10]. In he case o BC, Giun i e al.
e iewed BC mHeal h apps a ailable in he leading
sma phones app s o es (Apple S o e and Google Play)
inding 454 mHeal h apps in ended o pa ien s [11]. 114 o
hose mHeal h apps we e ocused on disease managemen .
Common ea u es included in hose BC mHeal h apps o
disease managemen such as ac i i y acking, heal h dia ies,
o pa ien epo ed ou comes, equi e pa ien o en e da a
in o he app. Some o hose mHeal h apps e en allow
pa ien s o sha e hei da a wi h o he s. Mos o BC pa ien s
a e willing o sha e hei da a wi h a heal hca e eam, bu
hey may be eluc an o sha e hem wi h o he s [12-14].
Da a p i acy is a common conce n among pa ien s ega ding
he use o mHeal h apps o sel -manage hei heal h [15, 16].
P i acy and secu i y o use in o ma ion con ained in he
mHeal h apps has been epo ed as a ele an issue in he
e alua ion o hei sa e y and quali y [17].
In his pape , we assess he p i acy policies o a sample
o BC mHeal h apps. Wi h his aim, we in oduce a no el
scale o assessing p i acy. The scale is based on he Gene al
Da a P o ec ion Regula ion (GDPR), applicable since 2018
ac oss he Eu opean Union (EU). Ou scale de ines a sco e
o e e y mHeal h app based on se e al GDPR i ems ha
mus be complied. We analyzed a sample o 9 mHeal h apps
o BC sel -managemen , applying ou no el p i acy
assessmen scale.
The pape is o ganized as ollows. Sec ion 2 deals wi h
he legal and echnical backg ound. Legal backg ound
includes some GDPR ea u es and de ini ions ha a e use ul
o ou esea ch. Resea ch backg ound p esen s a b ie
desc ip ion o ela ed wo k p e iously published in bo h
gene al and eHeal h p i acy policy assessmen s. Sec ion 3
desc ibes he p i acy scale designed based on i s p i acy
policy and we de ine he sc eening me hod o selec ion o
he BC mHeal h apps. In Sec ion 4, we show he main esul s
o ou s udy. Finally, Sec ion 5 shows ou main conclusions
abou he analysis.
II. BACKGROUND
A. Legal backg ound
Regula ion 2016/679 o he Eu opean Pa liamen and o
he Council, also known as Gene al Da a P o ec ion
Regula ion (GDPR) [18], was published in he O icial
Jou nal o he Eu opean Union on 27 Ap il 2016. GDPR is
applicable o all membe s a es since 25 May 2018.
GDPR ha monizes he legisla ion ac oss he whole
Eu opean Union. I is an 88-page documen and con ains 99
a icles. Some o he mos impo an ea u es a e he
ollowing:
•Ha moniza ion: I applies o all Membe S a es
di ec ly, wi hou needing o be ansla ed i in o a
na ional law.
•I applies o all he es ablishmen s in he EU,
con olle s o p ocesso s – see de ini ions below -,
e en i p ocessing occu s ou side he EU. (A icle
3.1).
•I applies o EU people’s da a, e en i he
con olle o p ocesso is no om he EU, bu i
o e s goods o se ices o people in he EU (A icle
3.2) o i moni o s use s’ beha io s.
•Accoun abili y: he con olle shall be esponsible
o he compliance wi h GDPR. GDPR allows a
con olle o adhe e o codes o conduc o
ce i ica ion, so ha he compliance can be easily
e i ied. (A icle 5.2)
•Coe cion: Coe ci e measu es a e s onge . A
supe iso y au ho i y may ine he con olle wi h up
o 20,000,000 EUR. Also, a supe iso y au ho i y
may adop p o isional measu es in case he e is an
u gen need o ac o p o ec da a subjec s’ igh s.
(A icles 83 and 66)
Mo eo e , GDPR de ines some impo an concep s o
egula ion. Mos de ini ions can be ound in a icle 4, excep
o he wise indica ed. We a e using he ollowing in his
pape :
•Da a subjec : iden i ied o iden i iable na u al
pe son whose pe sonal da a a e being p ocessed.
Any da a ha makes someone iden i ied o
iden i iable is pe sonal da a, acco ding o GDPR.
•Con olle : “ he na u al o legal pe son, public
au ho i y, agency o o he body which de e mines
he pu poses and means o he p ocessing o
pe sonal da a”
•P ocesso : “a na u al o legal pe son, public
au ho i y, agency o o he body which p ocesses
pe sonal da a on behal o he con olle ”
•Recipien : is o whom pe sonal da a a e eleased.
This includes p ocesso s.
•Thi d pa y: is someone di e en om he da a
subjec , con olle o p ocesso who is au ho ized o
p ocess pe sonal da a.
•Rep esen a i e: a na u al o legal pe son designa ed
by a con olle o p ocesso , no es ablished wi hin
he EU.
•Da a P o ec ion O ice (DPO): is a pe son ha
mus be designa ed unde some ci cums ances
(A icle 37). Wi hin i s du ies, DPO ad ise he
con olle o he p ocesso , and moni o compliance
wi h GDPR. (A icle 39).
B. Resea ch backg ound
The assessmen o p i acy policies has been a big
conce n in ecen yea s in he heal h domain, pa icula ly in
mHeal h due o i s apid g ow h.
Con issa e al. [19] p esen a GDPR-based me hodology
o assess p i acy policies. This me hodology checks i a
p i acy policy includes all he in o ma ion equi ed by he
a icles 13 and 14 o he GDPR, i i is ai , and i i can be
easily unde s ood. The pape assesses 14 online pla o ms
using his me hodology and ies o au oma e he assessmen .
Howe e , hey do no de elop a scale.
GDPR’s equi emen s and ecommenda ions om he
In o ma ion Commissione ’s O ice o Uni ed Kingdom a e
used by [20] o design a p i acy policy based on icons and
highligh ed ex (called “GDPR label”). Thei pu pose is o
compa e a ex -only GDPR wi h a GDPR label e sion. The
labels cap u e all he in o ma ion ha is equi ed o be
included in p i acy policies. This su ey sugges s ha GDPR
label e sion is p e e ed o ex -only e sion.
Machine lea ning and na u al language p ocessing
echniques a e used in [21] o classi y p i acy policies. They
use di e en GDPR a icles o build a lis o i ems o be
assessed. A le el o isk is associa ed o each i em,
depending on how a p i acy aspec is add essed by he
p i acy policy. They ha e de eloped an applica ion ha
ecei es a p i acy policy as an inpu and hen summa ize his
policy using a g aphical use in e ace, so ha use s can
easily iden i y po en ial isks in he p i acy policy.
Renaud and Shephe d [22] make an exhaus i e s a e-o -
he-a esea ch and a syn hesis o GDPR equi emen s o
p o ide a guide o w i e p i acy policies. They ocus on
usabili y.
The a icles abo e a e e e ed o gene al p i acy.
Howe e , p i acy is especially impo an in he mHeal h
con ex . Some p i acy pape s ocused on mHeal h a e
discussed below.
A heu is ic assessmen app oach is p oposed in [23] o
assess mHeal h applica ions o sel - acking. They use
di e en sou ces (such as GDPR o usabili y) o build a lis
o 26 heu is ics in ou ca ego ies (no ice o awa eness;
choice o consen ; access o pa icipa ion; and social
disclosu e usabili y). Then hey analyze 64 sel - acking
applica ions o check i hey comply wi h hei heu is ics.
They de elop a sco ing me hod, bu hey a e no exclusi ely
based on GDPR as a sou ce o he heu is ics.
On he o he hand, [24] assess p i acy isks on 79
applica ions ce i ied as sa e by he UK Na ional Heal h
Sys em. Unlike o he assessmen s, hey enume a e a se ies o
opics o p i acy policies, based on In o ma ion
Commissione ’s O ice o Uni ed Kingdom and he Da a
P i acy Ac o 1998 ( epealed nowadays). Then hey analyze
i e e y opic has been add essed o no in he p i acy policy
o he assessed applica ions.
An analysis o he 600 mos used mHeal h applica ions as
o May 2013 is p esen ed in [25]. I shows ha only 30% o
he applica ions had a p i acy policy on ha da e. They also
analyze he a e age leng h o he p i acy policies and assess
he anspa ency o he p i acy policies based in i ems
conside ed mos impo an by use s.
A compa ison o diabe es and men al heal h Indian
applica ions is p esen ed in [26]. They use eadabili y es s
and o he eadabili y me ics (such as wo d coun and wo ds
pe sen ence) o conclude he e is no signi ica i e di e ence
be ween he wo ypes o applica ions.
III. METHODOLOGY
A. P i acy scale design
Analyzing p i acy in mobile applica ions is no a simple
ask. The e a e many ac o s ha a ec p i acy. Some o
hem can be analyzed by audi ing he app i sel , while o he s
equi e audi ing he applica ion’s p o ide ( o example, o
check i i s in e nal p ocedu es comply wi h GDPR).
In he one hand, audi ing he applica ion includes
analyzing secu i y measu es o e i y i he applica ion
con ains any known ulne abili y o checking i he
eques ed da a a e necessa y o he pu pose o he
applica ion. On he o he hand, audi ing he applica ion’s
p o ide is ela ed wi h he concep o accoun abili y
desc ibed abo e. Thus, he con olle mus implemen a
secu i y policy in o de o p o ec pe sonal da a, mus deploy
a p i acy policy, mus keep eco ds o p ocessing ac i i ies
and, when necessa y, mus ca y ou a da a p o ec ion impac
assessmen be o e p ocessing da a.
In his pape we ocus on he documen ha desc ibes he
p i acy policy since i is he i s poin o con ac be ween
he use (known as ‘da a subjec ’ in he GDPR) and he
applica ion p o ide . P i acy policy is one o he pilla s o
p i acy. This way, GDPR pu s emphasis on he p i acy
policy and he in o ma ion ha mus be p o ided o he da a
subjec , when p ocessing pe sonal da a. Ou objec i e in his
pape is o analyze any p i acy policy in a sys ema ic way so
ha we can ob ain a sco e o assess he quali y o p i acy.
A icle 13 o GDPR es ablishes he kind o in o ma ion
ha mus be p o ided o he da a subjec i he app collec s
da a om him/he . Mo eo e , pe sonal da a mus be
p ocessed in a anspa en manne , acco ding o a icle 5.
The e o e, i is essen ial o e i y ha in o ma ion gi en is
cohe en wi h he obliga ion o anspa ency. We also
conside he ecommenda ions o he Spanish supe iso y
au ho i y on p i acy policies [27, 28]. This way, we de ine a
scale ha builds a p i acy sco e based on some o he
ea u es o he applica ion p i acy policy. The conside ed
i ems and he sco e o all o hem a e he ollowing:
•Iden i y o he da a con olle : 0 poin s i he
iden i y is omi ed, 0.5 poin s i only pa ial
in o ma ion is gi en and 1 poin i ull da a is
p o ided (including name o he da a con olle ,
pos al add ess and elec onic add ess).
•Iden i y o he ep esen a i e when he con olle
is ou side he EU. 0 poin s i no ep esen a i e is
iden i ied and 1 poin i i is. This i em is no
applicable (N/A) i he da a con olle is inside he
EU.
•Con ac de ails o he DPO: 0 poin s i no
in o ma ion is p o ided and 1 poin i con ac
in o ma ion is p o ided. In la ge scale mHeal h
applica ions, we mus be awa e o a icle 37 o
GDPR, as i manda es ha a DPO mus be
designa ed in his case.
•Pu poses o he p ocessing: 0 poin s i no pu pose
is p o ided, 0.5 poin s i he in o ma ion p o ided is
oo gene ic and 1 poin i speci ic in o ma ion is
gi en.
•Legal basis o he p ocessing: Possible legal bases
a e enume a ed in a icle 6 o GDPR. 0 p s i no
legal bases a e p o ided, 1 poin i hey a e.
•Legi ima e in e es s: i he p ocessing is based on
legi ima e in e es om he con olle . 0 poin s i no
in o ma ion is p o ided, 1 poin i i is. This i em
does no apply (N/A) i he legal bases o he
p ocessing a e di e en om legi ima e in e es .
•The ecipien s o ca ego ies o ecipien s o he
pe sonal da a: 0 poin s i he ecipien s a e no
p o ided, 1 poin i hey a e. We conside ha his
in o ma ion mus be gi en e en i he e a e no
ecipien s o he collec ed da a.
•T ans e s o pe sonal da a o a hi d coun y
(ou side he Eu opean Union): 0 poin s i no
in o ma ion is p o ided, 0.5 poin s i he in o ma ion
p o ided is oo gene ic, and 1 poin i speci ic
in o ma ion is gi en ( o example, i ecipien holds
a ecognized ce i ica ion such as P i acy Shield
[29]). We conside ha his in o ma ion mus be
gi en e en i he e a e no ans e s.
•Da a s o age pe iod: 0 poin s i no in o ma ion is
p o ided, 0.5 poin s i he in o ma ion p o ided is
oo gene ic and 1 poin i he pe iod is gi en o , a
leas , he c i e ia o de e mine ha pe iod.
•Exis ence o da a subjec ’s igh s: 0 poin s i no
igh s a e poin ed ou , 0.5 poin s i he in o ma ion
p o ided is oo gene ic and 1 poin i speci ic igh s
and a me hod o exe cise hese igh s a e
enume a ed.
•Exis ence o he igh o wi hd aw consen a any
ime: 0 poin s i no in o ma ion is p o ided and 1
poin i i is. This i em does no apply (N/A) i da a
subjec ’s consen is no a legal base o p ocessing.
•Righ o lodge a complain wi h a supe iso y
au ho i y: 0 poin s i no in o ma ion is p o ided, 0.5
poin s i in o ma ion p o ided is oo gene ic and 1
poin i speci ic in o ma ion is gi en (such as he
con ac o he supe iso y au ho i y).
•Obliga ion o p o iding da a: whe he he
p o ision o pe sonal da a is a con ac ual
equi emen , o a equi emen necessa y o en e in o
a con ac . This i em also conside s whe he he da a
subjec is obliged o p o ide he pe sonal da a and
he possible consequences o ailing o p o ide such
da a. 0 poin s i no in o ma ion is p o ided, 1 poin
i i is.
•Exis ence o au oma ed decision-making,
including p o iling: 0 poin s i no in o ma ion is
p o ided, 0.5 poin i in o ma ion p o ided is oo
gene ic, 1 poin i speci ic in o ma ion abou he
logic used and he possible consequences o he da a
subjec is p o ided. Also 1 poin i he e is no
p o iling and i is men ioned.
Table I shows a summa y o all he de ined i ems. We
also include an i em numbe o u u e e e ences in his
pape .
TABLE I.
ITEMS IN THE PRIVACY ASSESSMENT
I em I em
No. Sco e
Iden i y o da a con olle 1 0: no in o; 0.5: pa ial; 1: ull
Iden i y o he ep esen a i e 2 0: no in o; 1: In o p o ided;
N/A: no applicable
DPO de ails 3 0: no in o ; 1: In o p o ided
Pu poses o he p ocessing 4 0: no in o; 0.5: gene ic; 1:
speci ic
Legal basis o he p ocessing 5 0: no in o; 1: In o p o ided
Legi ima e in e es s om
con olle 6 0: no in o; 1: in o p o ided;
N/A: no applicable
Recipien s (o ca ego ies) o he
pe sonal da a 7 0: no in o; 1: in o p o ided
In e na ional ans e s o da a 8 0: no in o; 0.5: gene ic; 1:
ull de ails o no in e na ional
ans e s
Pe iod o which da a will be
s o ed 9 0: no in o; 0.5: gene ic; 1:
speci ic
Exis ence o da a subjec ’s igh s 10 0: no in o; 0.5: gene ic; 1:
ull
Exis ence o igh o wi hd aw
consen 11 0: no in o; 1: in o p o ided;
N/A: no applicable
Righ o lodge a complain wi h a
supe iso y au ho i y 12 0: no in o; 0.5: gene ic; 1:
speci ic
Obliga ion o p o ide pe sonal
da a 13 0: no in o; 1: in o p o ided
Exis ence o au oma ed decision-
making o p o iling 14 0: no in o; 0.5: gene ic; 1:
speci ic o no
p o illing/au oma ed decision
done
B. Me hods
A sys ema ic sea ch was ca ied ou on 30
h
Janua y
2019, in he Spanish e sion o he wo leading mobile app
s o es: Apple S o e and Google Play. All ele an mHeal h
apps o BC we e iden i ied using he keywo ds “b eas
cance ”.
Fi s ly, duplica es we e emo ed. Fo hose apps
de eloped o bo h ope a ing sys ems, iOS and And oid,
only And oid e sion was selec ed. Ti les and desc ip ions o
he esul ing mHeal h apps we e e iewed and assessed o
eligibili y agains he selec ion c i e ia.
Inclusion c i e ia:
•App is in ended o BC pa ien s
•App is ocused exclusi ely on BC
•App con ains use in o ma ion o allows use o
sha e hei opinions/da a
Exclusion c i e ia:
•Desc ip ion is no w i en in English
•P i acy policy is no w i en in English no in
Spanish i a ailable
•App is no ocused on BC
•App is ocused on cance in gene al, al hough
BC is men ioned in he s o e desc ip ion.
•App is no ocused on BC sel -managemen o
suppo
•Apps in ended o o he s han BC pa ien s
IV. RESULTS
App s o es sea ches esul ed in 154 mHeal h apps bo h in
Apple S o e (24.7%; n=38) and Google Play (75.3%;
n=116). A e emo ing duplica es, i les and desc ip ions o
148 mHeal h apps we e assessed o eligibili y by wo
esea che s. Disc epancies we e esol ed by consensus.
Finally, 10 mHeal h apps me he selec ion c i e ia. One o
hem was excluded due o no being eely a ailable. The
emaining 9 mHeal h apps we e downloaded o assess he
p i acy policy applying he p oposed scale. Ano he one was
excluded a e ins alling i due o ailu e in he equi ed
egis e p ocess. Table II shows he selec ed applica ions
conside ing he inclusion/exclusion c i e ia. Fo con enience
when analyzing he esul s, applica ions we e agged om
app1 o app8.
TABLE II. S
ELECTED APPLICATIONS
App name De elope Ope a ing
Sys em Label
Becca – Suppo and
Guidance B eas Cance Ca e And oid App1
My B eas Cance
Coach Genomic Heal h,
Inc. And oid App2
B eas Cance Suppo MyHeal hTeams And oid App3
OWise B eas Cance Px Heal hCa e B.V. And oid App4
Booby app – The
B eas Cance App Booby app And oid App5
B eas Cance Manage @Poin o Ca e iOS App6
B eas Cance Ally The Uni e si y o
Michigan iOS App7
B eas Cance Su i o Po able Medical
Technology iOS App8
To ob ain he p i acy policies o he applica ions, we
i s downloaded hem using he link p o ided in he
applica ion page in he co esponding applica ion s o e
(Google Play o App S o e om Apple). I no link was
p o ided, we looked o a p i acy link in he de elope ’s
web. Then, we ins alled he applica ions in a sma phone,
used i , and checked i he p i acy policy was he same as he
one shown in he de elope ’s websi e.
Mos o applica ions (5 ou o 8) did no p esen any
p oblem wi h hei p i acy policies. Howe e , app1 p i acy
policy in he applica ion s o e was di e en om he one
a ailable when using he applica ion. Thus, he la e was
analyzed. In addi ion, we we e no able o use app7 because
i asked o a PIN om a doc o o hospi al. In his case, we
ha e used he policy a ailable in he de elope ’s web page.
Finally, app8 does no ha e an a ailable p i acy policy,
nei he in he de elope ’s web (p i acy policy is applied o
all he se ices p o ided by he de elope ) no in he app
i sel . Thus, we decided no o conside his applica ion.
Some bad in en ion was obse ed in some o he
applica ions. App3 p i acy policy is ambiguous abou he
pe sonal da a ha hey p ocess. Thei de elope s claim ha
hey do no collec use -speci ic iden i ying in o ma ion, jus
o say a e wa ds o whom hey do sha e pe sonal
in o ma ion. Mo eo e , app5 de elope s claim ha hey do
no hold any pe sonal iden i iable da a, bu hey allow s o ing
pho os and audio, which migh be used o iden i y people.
Besides, hey decla e ha hey comply wi h GDPR, wha is
illogical wi h no p ocessing pe sonal da a.
Table III shows he sco es ob ained a e assessing he
p i acy policies o he 7 apps. We de ined a pe cen ual sco e.
A sco e o 100 means a o al accomplishmen o GDPR. I
an i em is no applicable, i is no conside ed in he inal
sco e.
TABLE III. P
RIVACY SCORES
App name Label Ope a ing
Sys em Sco e
Becca – Suppo and Guidance App1 And oid 57.7
My B eas Cance Coach App2 And oid 25.0
B eas Cance Suppo App3 And oid 78.6
OWise B eas Cance App4 And oid 31.8
Booby app – The B eas Cance App App5 And oid 29.2
B eas Cance Manage App6 iOS 71.4
B eas Cance Ally App7 iOS 34.6
The i s issue we no ice is he low le el o compliance
wi h he GDPR in gene al. Only 3 ou o 7 p i acy policies
sco e a 50% o highe . The highes sco e eaches 78.4% and
he lowes one only sco es 25.0%.
All p i acy policies gi e ull o pa ial in o ma ion abou
he iden i y o he da a con olle and do speci y he
ca ego ies o ecipien s o pe sonal da a (I ems 1 and 7). We
conside ha his is posi i e aspec . In addi ion, all
applica ions excep one explain he pu poses o he
p ocessing (I em 4). This con as s wi h he ac ha none o
he 5 applica ions whose da a con olle is ou side he EU
iden i ies a ep esen a i e (I em 2). No in o ming abou he
iden i y o he ep esen a i e is conside ed a se ious
in ingemen unde he Spanish da a-p o ec ion law [30].
Al hough he Da a P o ec ion O ice (DPO) is
compulso y when p ocessing special ca ego ies o da a a
la ge scale (such as da a conce ning heal h), only 2
applica ions ha e designa ed a DPO (I em 3).
P i acy policies do no in o m p ope ly abou use ’s
igh s, such as he igh s o access, co ec o dele e
in o ma ion (I em10). Only 3 o he applica ions gi e enough
in o ma ion abou use ’s igh s, 1 o hem gi es only pa ial
in o ma ion and 3 o he policies do no e en men ion hese
igh s. Fu he mo e, only 3 apps men ion he da a subjec ’s
igh o lodge a complain wi h a supe iso y au ho i y (I em
12). Mo eo e , hey do no de ail some aspec s, such as how
o ind con ac in o ma ion o he supe iso y au ho i y.
P i acy policies also su e om lack o in o ma ion
ega ding he exis ence o no o p o iling echniques. Only 3
policies in o m use s abou he exis ence o p o iling, bu
hey do no gi e much in o ma ion abou he p ocess,
ega dless GDPR s a emen s (I em 14). Besides, 4 o he
policies gi e some in o ma ion abou how long pe sonal da a
will be s o ed (I em 9). 3 o he policies do no poin ou he
legal basis o he p ocessing (I em 5). I em 5 is impo an ,
since ha ing a legal basis o he p ocessing is he i s i em
ha should be accomplished, and no conside ing i is a e y
nega i e aspec .
Rega ding he in o ma ion abou ans e s o a hi d
coun y, only 2 applica ions ully in o m use s abou he
ans e s ou side he EU (I em 8). 2 o hem in o m abou he
loca ion o he da a ea men bu do no desc ibe he
measu es p esc ibed by GDPR. Finally, 3 applica ions do no
poin ou whe e he da a a e s o ed.
We did no ind any ele an conclusions o I ems 6 and
11. Table IV summa izes he esul s ha ha e been explained
abo e.
TABLE IV. A
CCOMPLISHMENT OF
GDPR
ITEMS SUMMARY
I em
No. Full
in o ma ion Pa ial
in o ma ion No
in o ma ion No
applicable
1 5 2 0 0
2 0 0 5 2
3 2 0 5 0
4 5 1 1 0
5 4 0 3 0
6 2 0 1 4
7 7 0 0 0
8 2 2 3 0
9 2 2 3 0
10 3 1 3 0
11 3 0 1 3
12 0 3 4 0
13 1 0 6 0
14 0 3 4 0
V. CONCLUSIONS
Since p i acy is one o he main conce ns o b eas
cance (BC) pa ien s, i is impo an o analyze whe he
mobile applica ions comply wi h he ecommenda ions o he
au ho i ies. In his pape , we ha e analyzed he p i acy
policy o 8 mobile applica ions o BC pa ien s o check i
hey comply wi h he Gene al Da a P o ec ion Regula ion
(GDPR). Wi h his aim, we designed a scale o assess some
o he i ems ha mus be complied by he apps.
Ou scale builds a p i acy sco e based on some o he
ea u es o he applica ion p i acy policy. We de ined a
pe cen ual sco e, whe e a 100-poin sco e means a o al
accomplishmen o GDPR. The low le el o compliance wi h
he GDPR was qui e su p ising, as only 3 ou o 7 p i acy
policies eached a 50-poin sco e.
As posi i e aspec s, all p i acy policies gi e ull o
pa ial in o ma ion abou he da a con olle . Nea ly all o
hem explain he pu poses o he p ocessing, and mos o
hem speci y how long hey s o e he da a.
As nega i e ea u es, only 2 apps ha e designed a Da a
P o ec ion O ice , only 3 o hem in o m he use s abou all
hei igh s, jus 3 o hem epo abou he exis ance o
p o iling echniques, and ano he 3 do no poin ou whe e
he da a a e s o ed. Legal bases a e also o en o go en.
Fu he mo e, when he apps a e ou side he EU, none o
hem iden i y a ep esen a i e in he EU, while only 2 ully
in o m he use s abou he ans e s ou side he EU.
Thus, we conclude ha he e is s ill a long way o he
whole compliance o GDPR. App de elope s mus be
conce ned abou his ma e .

REFERENCES
[1] Wo ld Heal h O ganiza ion. “Global S a us Repo on
Noncommunicable Diseases 2014”, ISBN 9789241564854, 2014.
[2] R.L. Siegel, K. D. Mille , and A. Jemal, “Cance s a is ics, 2016”. CA
Cance J. Clin, ol. 66(1), 2016, pp. 7-30.
[3] A. K. A ing on, L. Golds ein, L. K upe , C. Vi o, J. Yim, and S.L.
Chen. “Li e expec ancy a e cu a i e-in en ea men o b eas
cance : Impac on long- e m ollow-up ca e”. Am. Su g, ol. 80(6),
2014, pp- 604-609.
[4] S.P. Leong, Z.-Z. Shen, T.-J. Liu, G. Aga wal, T. Tajima, N.-S. Paik,
K.Sandelin, A. De ossis, H. Cody, and W.D. Foulkes. “Is b eas
cance he same disease in Asian and Wes e n coun ies?”. Wo ld J.
Su g, ol 34(10), 2010, pp. 2308-2324.
[5] R. De Angelis, M. San , M. P. Coleman, e al., and EUROCARE-5
Wo king G oup, “Cance su i al in Eu ope 1999–2007 by coun y
and age: esul s o EUROCARE-5—a popula ion-based s udy”
Lance Oncol., ol. 15 (1), Jan. 2014, pp. 23-34.
[6] J. Cho, S.-Y. Jung, J. E. Lee, E.-J. Shim, e al. “A Re iew o B eas
Cance Su i o ship Issues om Su i o s’ Pe spec i es” J. B eas
Cance , ol. 17 (3), Sep. 2014, p.189.
[7] M.E. Hewi , A. Bamundo, R. Day, and C. Ha ey. “Pe spec i es on
pos - ea - men cance ca e: quali a i e esea ch wi h su i o s,
nu ses, and physicians”. J Clin Oncol, ol. 25, 2007, pp. 2270-3.
[8] B. Caul ield, and S. Donnelly. “Wha is Connec ed Heal h and why
will i change you p ac ice”, QJM, ol. 106(8), 2013, pp. 703-7.
[9] R. Whi ake . “Issues in mHeal h: indings om key in o man
in e iews”, J. Med. In e ne Res, ol. 14 (5), 2012, e129, a ailable
a : h p://dx.doi.o g/10.2196/jmi .1989. Las consul ed: Feb ua y
2019
[10] W.T. Riley, D.E. Ri e a, A.A. A ienza, W. Nilsen, S.M. Allison, and
R. Me mels ein. “Heal h beha io models in he age o mobile
in e en ions: a e ou heo ies up o he ask?”. T ansl Beha Med,
ol. 1, Ma ch 2011, pp. 53-71 [FREE Full ex ] [doi: 10.1007/s13142-
011-0021-7] [Medline: 21796270]
[11] G. Giun i, D.H. Giun a, E. Guisado-Fe nandez, J.L. Bende , and L.
Fe nandez-Luque. “A biopsy o B eas Cance mobile applica ions:
s a e o he p ac ice e iew”. In e na ional Jou nal o Medical
In o ma ics, ol. 110, 2018, pp. 1–9, a ailable a :
h ps://doi.o g/10.1016/J.IJMEDINF.2017.10.022. Las consul ed:
Feb ua y 2019
[12] S. M. Phillips, D. E. Con oy, S. K. Keadle, C. A. Pelleg ini, G. R.
Lloyd, F. J. Penedo, and B. Sp ing. “B eas cance su i o s’
p e e ences o echnology-suppo ed exe cise in e en ions”.
Suppo . ca e cance O . J. Mul ina l. Assoc. Suppo . Ca e Cance ,
May 2017.
[13] N. H. Nguyen, N. T. Hadg a , M. M. Moo e, D. E. Rosenbe g, C.
Lynch, M. M. Ree es, and B. M. Lynch. “A quali a i e e alua ion o
b eas cance su i o s’ accep ance o and p e e ences o consume
wea able echnology ac i i y acke s”, Suppo . Ca e Cance , ol. 25
(11), 2017, pp. 3375–3384.
[14] N. Ribei o, L. Mo ei a, A. Ba os, A.M. Almeida, and F. San os-
Sil a. “Guidelines o a cance p e en ion sma phone: A mixed-
me hods s udy”, In e na ional Jou nal o medical In o ma ics, ol. 94
(1), Oc obe 2016, pp. 134-142.
[15] M. C. Robe son, E. Tsai, E. J. Lyons, S. S ini asan, M. C. Swa z,
M. L. Baum, and K. M. Basen-Engquis , “Mobile Heal h Physical
Ac i i y In e en ion P e e ences in Cance Su i o s: A Quali a i e
S udy,” JMIR mHeal h uHeal h, ol. 5, no. 1, p. e3, 2017.
[16] G. Giun i, J. Kool, O. Ri e a Rome o, and E. Do onzo o Zubie e.
“Explo ing he Speci ic Needs o Pe sons wi h Mul iple Scle osis o
mHeal h Solu ions o Physical Ac i i y: Mixed-Me hods S udy”,
JMIR mHeal h uHeal h, ol. 6 (2), Feb. 2018, e37.
[17] S. R. S oyano , L. Hides, D. J. Ka anagh, O. Zelenko, D.
Tjond onego o, and M. Mani. “Mobile app a ing scale: a new ool
o assessing he quali y o heal h mobile apps.”, JMIR mHeal h
uHeal h, ol. 3 (1), Ma . 2015, e27.
[18] Eu opean Pa liamen and Council, “Regula ion (EU) 2016/679 o he
Eu opean Pa liamen and o he Council o 27 Ap il 2016 on he
p o ec ion o na u al pe sons wi h ega d o he p ocessing o pe sonal
da a and on he ee mo emen o such da a, and epealing Di ec i e
95/46/EC (Gene al Da a P o ec ion Regula ion)”, EUR-Lex, a ailable
a : h ps://eu -lex.eu opa.eu/eli/ eg/2016/679/2016-05-04. Las
consul ed: Feb ua y 2019.
[19] G. Con issa, K. Doc e , F. Lagioia, M. Lippi, H.-W. Mickli z, P.
Palka, G. Sa o , and P. To oni. “Au oma ed p ocessing o p i acy
policies unde he EU gene al da a p o ec ion egula ion”. 31s
In e na ional Con e ence on Legal Knowledge and In o ma ion
Sys ems, JURIX 2018, He Kas eelG oningen, Ne he lands, Volume
313, pp. 51-60, doi: 10.3233/978-1-61499-935-5-51.
[20] G. Fox, C. Tonge, T. Lynn, and J. Mooney. “Communica ing
compliance: De eloping a GDPR p i acy label”. 24 h Ame icas
Con e ence on In o ma ion Sys ems 2018: Digi al Dis up ion,
AMCIS 2018, Hya Regency New O leans, Uni ed S a es.
[21] W.B. Tes ay, P. Ho mann, T. Nakamu a, S. Kiyomo o, and J. Se na,
“P i acyguide: Towa ds an implemen a ion o he EU GDPR on
in e ne p i acy policy e alua ion”, IWSPA 2018 - P oceedings o he
4 h ACM In e na ional Wo kshop on Secu i y and P i acy Analy ics,
2018, pp. 15-21, Tempe, Uni ed S a es, doi:
10.1145/3180445.3180447
[22] K. Renaud, and L.A. Shephe d. “How o make p i acy policies bo h
GDPR-complian and usable”, 2018 In e na ional Con e ence on
Cybe Si ua ional Awa eness, Da a Analy ics and Assessmen , 2018,
A icle numbe 85514422018, Glasgow; Uni ed Kingdom, doi:
10.1109/Cybe SA.2018.8551442.
[23] L. Hu on, BA. P ice, R. Kelly, C. McCo mick, AK. Banda a, T.
Ha zakis, M. Meadows, and B. Nuseibeh, “Assessing he P i acy o
mHeal h Apps o Sel -T acking: Heu is ic E alua ion App oach”,
JMIR Mheal h Uheal h 2018;6(10):e185, doi: 10.2196/mheal h.9217.
[24] K. Huck ale, J.T. P ie o, M. Tilney, P-J. Benghozi, and J. Ca .
“Unadd essed p i acy isks in acc edi ed heal h and wellness apps: a
c oss-sec ional sys ema ic assessmen ”, BMC Medicine201513:214,
doi: 10.1186/s12916-015-0444-y.
[25] A. Sunyae , T. Dehling, P.L. Taylo , KD. Mandl, “A ailabili y and
quali y o mobile heal h app p i acy policies”, J Am Med In o m
Assoc. 2015 Ap ;22(e1):e28-33, doi: 10.1136/amiajnl-2013-002605.
[26] A. Powell, P. Singh, and J. To ous, “The Complexi y o Men al
Heal h App P i acy Policies: A Po en ial Ba ie o P i acy”, JMIR
Mheal h Uheal h 2018;6(7):e158, doi: 10.2196/mheal h.9871.
[27] Spanish da a p o ec ion agency, “In o me sob e polí icas de
p i acidad en In e ne . Adap ación al RGPD”, a ailable a :
h ps://www.aepd.es/media/es udios/in o me-poli icas-de-p i acidad-
adap acion-RGPD.pd . Las upda ed: Sep embe 2018. Las
consul ed: Feb ua y 2019.
[28] Spanish da a p o ec ion agency, “Decálogo pa a la adap ación al
RGPD de las polí icas de p i acidad en In e ne ”, a ailable a :
h ps://www.aepd.es/media/es udios/decalogo-poli icas-de-
p i acidad-adap acion-RGPD.pd . Las upda ed: Sep embe 2018.
Las consul ed: Feb ua y 2019.
[29] Eu opean Comission, “Commission Implemen ing Decision (EU)
2016/1250 o 12 July 2016 pu suan o Di ec i e 95/46/EC o he
Eu opean Pa liamen and o he Council on he adequacy o he
p o ec ion p o ided by he EU-U.S. P i acy Shield (no i ied unde
documen C(2016) 4176)”, a ailable a : h ps://eu -
lex.eu opa.eu/eli/dec_impl/2016/1250/oj. Las upda ed: July 2016.
Las consul ed: Feb ua y 2019.
[30] Spanish O icial S a e Gaze e, “Ley o gánica de p o ección de da os
y ga an ía de de echos digi ales”, a ailable a :
h ps://www.boe.es/eli/es/lo/2018/12/05/3. Las upda ed: Sep embe
2018. Las consul ed: Feb ua y 2019.