69% of Health Apps Ask for Access They Don't Explain

Health apps know a lot about us. They can hold glucose readings, heart rates, medications, sleep patterns and mental health notes.

So it’s worth asking: what else are they asking to access?

A new study of more than 10 000 Android health apps found that about 69% requested at least one permission that nothing in their own description explained. Location, camera and microphone were among the most common.

Researchers scanned more than 10 000 Android health apps

Ethan Myers and Indrakshi Ray of Colorado State University, with colleagues at the New Jersey Institute of Technology, the University of Calgary and Stony Brook University, built an automated system to examine health apps on the Google Play Store. Their findings were posted as a preprint on arXiv on 16 October 2026 and haven’t yet been peer reviewed.

They first trained a language model to pick out genuine health apps, such as those for monitoring health, managing a disease, telemedicine or medication tracking, from 500 000 app descriptions. That gave 10 688 apps, downloaded in 2024.

For each app, they compared two things:

• What the app declares it may access, listed in its technical setup file
• What its Play Store description justifies, judged by a second language model trained to spot when a description implies a need for, say, the camera or location

Any permission the app requested that its description didn’t account for was flagged as a “permission gap”.

They also ran apps on test phones to see whether a consent screen appeared when the app first opened, and checked network traffic for identifiers such as the phone’s advertising ID.

69% asked for permissions their descriptions didn’t explain

Most apps had a permission gap. Of the 10 036 apps still available for analysis, about 69% requested at least one permission their description didn’t justify, typically two. Among the unexplained requests:

• Location: about 53% of apps
• Camera: about 50%
• Microphone: about 35%

One fitness-tracking app with more than 160 million downloads requested access to call logs and contacts, though nothing it described doing needed them.

Smaller apps asked for more. Apps with fewer than 10 000 installs had nearly three unexplained permissions on average, compared with just over one for apps with more than a million. But well-known developers weren’t immune.

Consent was rare. Of the 3 599 apps that ran successfully on the test phones, only about 7% showed any consent screen when first opened. Among apps without one, the most common identifier sent was the phone’s advertising ID.

Consent wasn’t always respected. About 1 in 14 apps that did show a consent form collected an identifier the form didn’t mention.

Permissions are broader than they look

On Android and iPhone, apps must ask before accessing sensitive features such as your location, camera, microphone or contacts. You usually see a pop-up the first time an app wants them.

But permissions are broad. If you grant location access to a health app for one feature, the app may be able to use it more widely. And many people tap “Allow” without thinking about whether the app really needs it.

With health apps, the stakes are higher. Combining where you go with what health conditions you track can reveal a lot, for example visits to clinics or pharmacies.

A few minutes in the settings can close the gap

Review the permissions your health apps have, and switch off anything that isn’t needed for features you use. This is a reasonable step based on the findings, not something the study tested.

• Check your settings. On Android, go to Settings, then Privacy or Apps, then Permission manager. On iPhone, go to Settings, then Privacy & Security.
• Ask whether it makes sense. Does a medication reminder need your microphone? Does a symptom diary need your location?
• Choose “only while using the app” for location where possible, and consider approximate location instead of precise.
• Deny and test. If a feature you use stops working, you can always turn the permission back on.
• Read the data section in the app store. Both Google Play and the App Store show what data an app says it collects.
• Delete apps you no longer use.

What the study doesn’t show

• An unexplained permission isn’t proof of misuse. An app may need a permission for a legitimate feature its description simply doesn’t mention.
• Requesting isn’t the same as using. The permission analysis looked at what apps declare, not what they actually collect.
• Many apps couldn’t be tested. Two-thirds crashed or failed to run in the consent test, and only the first screen, before account creation, was checked.
• It’s a preprint. The automated method hasn’t been independently checked, and language models can misjudge descriptions.
• Only Android apps on Google Play were examined. iPhone apps weren’t included.

Health apps often ask for more than they explain

These apps can hold glucose readings, medications and mental health notes, so what else they can reach matters.

Check what your health apps can access, and switch off anything they don’t need.