Mobile App Privacy and Compliance

Why Apps Need Their Own Review

An app's privacy obligations depend on three things that a website review does not always reach: the data the app collects from the device, the partners whose code ships inside it, and what the app stores require it to declare. Most consumer health and wellness apps sit outside HIPAA, but inside the FTC Act, the FTC's Health Breach Notification Rule and state consumer health data laws. Apps that children or teens use face the amended COPPA Rule, state teen rules and new app store age laws.

Scope 1: Privacy Policy and Terms Review

We read the app's privacy policy, terms of service, in-app consent screens and both store declarations against the laws that apply to its users, its data and its audience.

• →Marked-up privacy policy and terms of service
• →A memo of gaps, ranked by risk
• →Corrected store declarations for Apple and Google
• →A short list of questions for the product team

Scope 2: Data Flows and App Partners

Scope 1, plus what the app actually sends and to whom: the SDKs, analytics, advertising networks, crash reporters and processors it uses, the contract with each, and whether any transfer is a sale or sharing under state law.

• →A map of the app's data flows
• →A register of partners, with each one's role, contract status and the store declaration it needs
• →A revised privacy policy
• →Notes on opt-out and consent design

Scope 3: Health Data and Minors

Scope 2, plus the rules for health data (the FTC rule, California's medical information statute, Washington, Nevada and Connecticut, and the app's HIPAA position) and the rules for minors (COPPA, design codes, app store age laws and state teen rules).

• →A written view on which laws apply
• →Consent and age-signal flows
• →Outlines of the written security program and retention policy that COPPA requires
• →An outline of the CCPA risk assessment where sensitive data is processed

What We Ask at Intake

The intake form asks eight questions, so the quote fits the app:

• →What does the app do, and for whom?
• →Could any user be under 13, or under 18?
• →Does it handle health, fitness, reproductive, mental-health or location data?
• →Which SDKs and partners does it use?
• →Where are its users (which states and countries)?
• →Is any data sold, shared for advertising or used to train models?
• →Is a health care provider or health plan behind the app?
• →Where are the current privacy policy, terms and store pages?

How the Work Is Priced

Each request is quoted after a short intake, once we know the app, its audience and its data. The quote states the scope, the fee and the timing before any work starts.