# Metadata-Based Privacy Assessment for Mobile mHealth

## TL;DR

This paper introduces App-PI, a system that helps users and researchers assess privacy risks in mobile health apps using collected metadata.

## Contribution

The novel contribution is the development of App-PI, an ecosystem for collecting and analyzing privacy metadata from mobile health apps.

## Key findings

- App-PI automates the collection and analysis of privacy-related metadata from mobile health apps.
- The system integrates heterogeneous data sources into a unified repository for privacy risk assessment.
- A popular mHealth app was used to demonstrate the effectiveness of the data flow design in App-PI.

## Abstract

The widespread adoption of mobile health applications has increased the volume of sensitive personal and physiological data processed through interconnected devices. Ensuring privacy compliance in this context remains a challenge, as existing app stores and privacy labeling systems rely heavily on self-declared information. App-PI is a data-driven ecosystem designed to offer end users with tools they can easily manage and privacy researchers with structured and reliable app metadata. It is designed to automate the collection, analysis, and visualization of privacy-related metadata from mobile applications. Heterogeneous data sources are integrated into a unified repository (App-PIMD), enabling the empirical assessment of privacy risks. The data flow design is critical to ensure that the data used to assess privacy impact is of good quality, as well as the privacy indicators that end users will be offered. It is shown on a popular mHealth application, demonstrating the importance of data flow design in order to be able to obtain, from documents and files created for consumption by an operating system, a set of data and tools ready for consumption by the true recipients of health apps: people.