Abstract
Background:
Mental Health apps (MH apps) could help address the huge unmet mental health care need of developing countries. This study aimed to explore potential ethical, data safety, and privacy issues associated with using MH apps for depression.
Methods:
A cross-sectional assessment of the top 50 MH apps (by Google Play store search result ordering) for depression available in India was conducted in November 2021.
Results:
Most apps were listed under the category of health and fitness (54%). The median number of total and dangerous permissions requested at the time of download was nine and three, respectively. Privacy policy in English was available for 76%. The average length of the privacy policy was 2171 words, and the mean Flesch-Kincaid reading grade level was 12 (much higher than the recommended cut-off of eight). Important features relevant to safeguarding consumer confidentiality, including names of third parties with which user data could be shared (42%), explicit consent before sharing data with third parties (16%), and assurance regarding the collection of de-identifiable data (11%), were missing from the majority of privacy policies.
Conclusion:
There is an urgent need to improve the accessibility and usability of privacy policies by app developers, with the active involvement of other stakeholders.
The majority of Mental Health apps (MH apps) for depression were listed under “health and fitness” and not the “medical” category. Privacy policy in English was provided for about three-fourths of MH apps, and the mean reading difficulty grade was 12 (much higher than the recommended cut-off of eighth grade). Several important features relevant to safeguarding consumer confidentiality were missing from the majority of privacy policies.Key Messages:
The huge burden of mental health problems, coupled with the markedly deficient availability of mental health professionals in several low- and middle-income countries (LMICs), makes it one of the most pressing public health challenges. 1 Additionally, significant stigma is attached to mental health disorders and seeking treatment for the same. 2 With increased digitalization in almost every sector of life, there has been significant interest in using digital technology to manage mental health disorders. 3 Mental Health apps (MH apps) have been posited as an effective way to counter several of these challenges, especially in LMICs where resources are sparse. 3
India has the second largest number of both smartphone and Internet users in the world, with more than two-thirds of India’s total Internet traffic contributed by mobile phone users. 4 Thus, the potential market for mobile health apps is huge and merits careful examination. Several researchers have raised concerns about the safety of sensitive health-related information and other data collected by many available health apps, including MH apps. Mental-health-related information is often more sensitive than other personal (e.g., phone number and location data) or general health-related information (e.g., weight and sleeping habits), due to a higher degree of mental-health-related stigma and potentially serious repercussions that could occur following a breach of privacy through MH apps, in turn negatively affecting the financial (e.g., promotion at work, approval of loan, and credit from a bank) or social (e.g., marriage prospects, and participation in social gatherings) status of the person. 5 Furthermore, people experiencing extreme psychological stress or depression could be more vulnerable. They might not be able to fully process the pros and cons associated with MH app use provided in the privacy policy or app store description in an oblique or excessively technical manner.
Though previous studies have pointed out data safety and ethical concerns associated with MH app use, almost all of them have been conducted in western countries, and very few have been done for depression-related MH apps specifically. Moreover, given the rapidly evolving landscape of the MH app market, with one MH app for depression becoming unavailable every third day on average, 6 there is a need for conducting an updated assessment of the recently available MH apps to either supplant or refute the findings of previous studies. Most users download MH apps through app stores, and app developers often display information related to their apps for potential consumers. The information provided by the app developers about the MH apps available on the Google Play store was reviewed in this study. The study aimed to explore potential ethical and data safety issues or privacy risks associated with MH apps used for the management of depression and inform stakeholders (mainly technology experts, app developers, legal experts, clinicians with an interest in telemedicine or digital health interventions, and members of consumer awareness groups or forums) about potential areas of concern with their use.
Material and Methods
App Selection
This cross-sectional descriptive study assessed the MH apps for depression available in India. To identify potential apps for evaluation, a search was performed using the keyword “depression” on the Google Play store (
Assessment of Selected Apps
The app store description and additional information, including permissions, requested by the 50 selected apps were analyzed. Out of the 50 selected apps, ten did not have their privacy policy accessible through the link provided in the app store information. Finally, the privacy policy of 38 apps was analyzed in this study. Two researchers independently reviewed the information available for the app on the Google Play store and extracted information using a pre- designed assessment tool developed by the authors based on a review of available literature and their professional experience. 9 Any disagreements between the two researchers were mutually discussed with other researchers and resolved by consensus.
The readability of privacy policies for apps was assessed by calculating scores of the following three different readability measures: the Flesch Kincaid Grade (FKG) Score, the Gunning Fog Index (GFI), and the Simple Measure of Gobbledygook (SMOG) Index. The FKG is calculated using a formula involving the computation of average sentence length (i.e., the total number of words divided by the total number of sentences) and average syllables per word (i.e., the total number of syllables divided by the total number of words). The GFI is calculated using a formula involving the computation of average sentence length and the number of polysyllabic or complex words (i.e., ≥3 syllables).
10
The available literature recommends, for the general adult population, FKG and GFI scores of <8, for universal accessibility and readability.11,12 The SMOG index is calculated using a formula involving the computation of the number of polysyllabic words in three ten-sentence samples near the text’s beginning, middle, and end. It has been validated for healthcare-related information, and a score of <10 is considered suitable for universal readability.11,12 To prevent any human error in calculations, all readability assessments were done using a freely available online readability calculator (Readability Analyzer;
Statistical Analysis
The data were analyzed using SPSS version 17.0 (IBM Corp, Armonk, NY). Descriptive statistics using mean and standard deviation (SD) or frequency and percentage were used to describe the continuous or categorical variables, respectively. The data were checked for normal distribution using the Kolmogorov–Smirnov test. The median and interquartile range (IQR) were described for skewed data. Accordingly, appropriate parametric (independent t-test) and non-parametric (Mann-Whitney U test) inferential statistics were used for further exploratory analyses. The Chi-square and Fisher’s exact test (when the expected cell count was <5) were used to compare the proportions between the two groups (fully free apps vs. apps with in-app purchases). The level of statistical significance was set at a two-tailed p-value of < .05 for all the tests.
No human subject was enrolled for this study, and publicly available information was extracted and analyzed; hence, no institutional ethical clearance was sought. However, the declaration of Helsinki was complied with.
Results
Most apps were listed under the category of health and fitness (n = 27, 54.0%), with less than one-fifth of them in the medical category (n = 9, 18.0%). The remaining were distributed under various categories: lifestyle (n = 3, 6.0%), education (n = 2, 4.0%), social (n = 2, 4.0%), music and audio (n = 2, 4.0%), casual (n = 1, 2.0%), adventure (n = 1, 2.0%), role-playing (n = 1, 2.0%), puzzle (n = 1, 2.0%), and personalization (n = 1, 2.0%). The development or functioning of the app involved a mental health expert in 40.0% (n = 20) of all apps, while none were approved by the Food and Drug Administration (FDA). Table 1 summarizes the profile of services offered by the apps included in this analysis.
Profile of Services Offered by Mental Health Apps Analyzed in this Study (N = 50).
#Sum total more than 100%, as some apps offered more than one type of services.
The mean and median number of total permissions requested at the time of download were 9.1 (SD: 5.0) and 9.0 (IQR: 5.7–12.2), respectively. The mean and median number of dangerous permissions requested at download time were 3.4 (SD: 2.2) and 3.0 (IQR: 2.0–5.0), respectively. The fully free apps requested a significantly lesser number of total permissions than those with an option of in-app purchase (U = 188.5, p = .01). Table 2 describes the relative frequency of dangerous permissions. The fully free apps were less likely to request permission to read phone status and identity than those with the option of in-app purchase (7.7% vs. 33.3%; χ 2 = 5.1, p = .03). There were no significant differences, between fully free apps and those with in-app purchases, in the total number or proportion of various other dangerous permissions requested.
Dangerous Permissions Requested by Mental Health Apps (N = 50).
The privacy policy was accessible through a link provided in the additional information for 40 apps. But, two apps had their privacy policies in Spanish and German and were excluded from the analysis. Thus, Table 3 summarizes the characteristics of 38 privacy policies assessed. The average length of the privacy policy was 2170.7 (SD: 1917.7) words. The median length of the privacy policy was 1344.5 (IQR: 795.0–3109.7) words. The mean FKGL, Gunning-Fog score, and SMOG index for privacy policies were 11.9 (SD: 1.9), 13.9 (SD: 2.1), and 11.5 (SD: 1.9), respectively. The median FKGL, Gunning-Fog score, and SMOG index for privacy policies were 11.9 (IQR: 10.6–13.4), 13.9 (SD: 12.7–15.5), and 11.5 (IQR: 10.4–12.7) respectively. There were no significant differences in the length or any of the readability measures for privacy policies of fully free apps compared to in-app purchases (see Table S1 in the supplementary file).
Analysis of Privacy Policy Adopted by Mental Health Apps (n = 38).
Discussion
Less than one-fifth of the apps were listed under the category of “medical” apps, with a majority of them being listed under the category of “health and fitness”. This is likely intended to avoid the existing state regulations for medical apps and devices in various countries. The FDA and several other major international medical or health regulatory bodies do not regulate health and wellness apps that are not intended for medical use. 14 Less than half of the apps (40%) reported involving any mental health professional in their development process. Further, none of them were FDA approved for use in managing depression. Also, the median number of total and dangerous permissions requested when downloading an MH app was nine and three, respectively. This is greater than that observed in a previous cross-sectional study assessing the MH apps market in Australia. 15 This could be due to country-wise differences in the MH apps market or reflect a general trend towards mobile health apps requesting an increasingly higher number of permissions to support added features or functionality. The three most commonly requested dangerous permissions were to view Wi-Fi connections (92%), to read the USB storage (56%), and to modify/delete the USB storage (56%). The exact use of or purpose for asking for some of these permissions was seemingly not apparent for the functioning of the MH app and was also not clarified in their privacy policy. The Google Play store classifies dangerous app permissions as those that could pose a significant risk to the user’s privacy or interfere with the functioning of other mobile apps or features. For example, permission to view or access a Wi-Fi connection could be misused for hacking or sending users’ data, without their knowledge, through this network. 16 This is an area of potential concern that needs to be adequately addressed in the privacy policy by including a separate and explicit explanation behind the intended purpose of requesting all the different permissions.
The privacy policy in English could be accessed through the link provided at the app store for about 76% of the apps. This is higher than findings from previous studies assessing the privacy policies of MH apps related to dementia or depression.17,18 This is probably due to the insistence of the Google Play store to provide a link to the privacy policy for apps hosted on their platform. However, more than one-fourth of the MH apps did not have a privacy policy accessible through the app store description. Furthermore, in those apps for which a privacy policy was available in English, an overwhelmingly large majority of them were written at a difficulty grade that was much higher than that recommended for comprehension by an average layperson with English as their native language (i.e., only one MH app had privacy policy written at below eight grade level). This could be even more worrisome when we consider that English is not the native or first language for a significant proportion of users in several LMICs, including India. Furthermore, none of the apps provided the option of reading the privacy policy document in any regional or vernacular language spoken in the country where the MH app search was carried out. Moreover, the average length of the privacy policy was 2,171 words, which is comparable to the length of some academic journal publications (e.g., short papers, brief communication, and research letters). Thus, lengthy privacy policies written in a language requiring college-level education to comprehend them significantly limits the usability and accessibility of these privacy policies, especially in a multi-lingual country like India.
Concerns have been raised about the ethical issues associated with taking consent through the “I agree” option provided at the app store when the privacy policy is not accessible or meaningfully understandable to the consumers. 19 Furthermore, though three-fourths of the apps disclosed about sharing user data with third parties in their privacy policy, less than half of them actually mentioned the names of these third parties. Our finding of 28 out of 38 apps (73.7%) mentioning disclosing/sharing of user data to third parties is lower than in a similar study done in 36 top-ranked apps for depression and smoking cessation for Android and iOS in the United States and Australia, which reported 33 out of 36 (92%) apps transmitting user- generated data to third parties. 9 Thus, this is still a major challenge in terms of data governance and data sharing practices. A scoping review on privacy assessment in mobile health apps concluded that the privacy assessment of these apps is a complex task and that meaningful comparisons across studies are difficult, as the results are likely to be biased due to the heterogeneous evaluation methods and dynamic nature of the mobile app market. 20 Similarly, in the present study, less than half of the apps mentioned the time duration for which user data would be retained or stored (44.7%), provided an option to refuse or opt out of user data collection (39.5%), and shared information about various safeguards adopted to protect user data (39.5%) in their privacy policies. Worryingly, even a smaller minority of MH apps stated in their privacy policy that consent would be sought explicitly before sharing data with third parties (15.8%) or asserted that only de-identifiable data would be collected (10.5%).
We propose a few potential solutions to address several of the above-described significant privacy-policy concerns and to improve the overall quality and usability of the apps for the general public or consumers. At present, the privacy policy displayed by app developers often serves multiple and conflicting aims of informing the consumer as well as showing their compliance with existing regulatory practices and reducing their legal liabilities. Thus, it is often a lengthy multi-page document with a lot of technical details or legal jargon, making it difficult for consumers to understand how the app will handle their data or privacy. Thus, having a separate consumer-friendly version that is shorter, and without intricate details inserted for compliance with regulatory or other legal requirements, would be helpful. It should also be written in simple language with little or no technical jargon, to make it understandable for most of the population. This could be displayed at the app stores in addition to the traditional privacy policy documents. The information should be elaborated in a consumer-friendly way, without broad or technical statements that offer little insight to users about how their data or privacy will be protected. For example, instead of simply stating that user data would be shared with third parties, the names of all third-party organizations with which user data might be shared should be ideally listed. This shall help users in the consenting process. Furthermore, incorporating consumer feedback to improve the usability and ease of understanding of privacy policies would be a welcome step. Moreover, available research suggests that service users often do not read the entire privacy policy document when downloading an MH app and simply skip to the end to give their consent. 19 Thus, the use of “just-in-time” permission or consent requested at the time of actual app use or point of information collection, instead of blanket consent at the time of downloading or registering the app, should be encouraged. For example, the mobile app could prompt the consumer before accessing the phone’s location or contacts while using the app and give them the option to refuse or say “no” for that particular instance. 21 Lastly, developing and implementing standard privacy policies that ensure adequate safety of user data and other privacy concerns for mobile apps, on lines similar to the GNU General Public Licence document being used by several open software applications, needs to be examined. 22 The use of standardized licenses or policy documents could obviate the need to read these lengthy and complex documents by a general user with limited comprehension skills, as field experts would have thoroughly vetted these to ensure their fidelity and fairness.
Though it has been said that MH apps are a useful tool for the self- management of mental health and promoting well-being, most publicly available MH apps have no direct scientific evidence to support their claimed benefits of efficacy. 23 Also, it is important to note that, though user ratings indicate app popularity, they are not a reliable indicator of their credibility or clinical usefulness.24,25 We recommend efforts to establish accreditation programs for mental health apps that not only account for privacy and transparency concerns but also for integration with the clinical practice. There is a need for the clinical community, especially the mental health associations of various countries and international organizations, to conduct and coordinate frequent privacy reviews that incorporate considerations of privacy policies, technical security reviews, linkage with the clinical units, and better engagement by the mental health care users.
Also, local factors need to be considered while contextualizing the use of MH apps for the Indian scenario. Indian users and health professionals have an overall positive attitude toward using MH apps for managing mental health issues. However, in a recent qualitative study conducted in India, both patients with mental health problems and mental health professionals stated user privacy and data safety as primary concerns while deciding upon or recommending a particular MH app. 26 From a clinical perspective, a clinician can ask his/her patients to follow certain guidelines when deciding whether to use a particular health app or not. One of the examples is the American Psychiatric Association App Evaluation Model, which can help guide discussion and informed decision-making. 27 Alternatively, it might be a good idea to have third-party independent reviewers or platforms (e.g., MindTools.io, Credible Mind, One Mind PsyberGuide), with no affiliation to app developers, to provide publicly accessible ratings on the credibility and transparency of MH apps for different conditions such as depression. 25 This could help address several ethical and safety concerns highlighted in the present study.
The major strength of this study is that this is one of the few studies conducted in an Indian setting that has systematically explored the ethical and data safety concerns associated with apps for managing depression. The authors have incorporated all the points of the quality checklist used in a previous systematic review to assess smartphone health apps. 28 This study could act as a baseline for further research in India. Also, this study would make the technology experts, app developers, legal experts, members of consumer groups, and clinicians who prefer to advise or discuss with their patients about the use of MH apps cognizant of the potential data safety and ethical concerns associated with their usage.
However, the findings should be interpreted with a consideration of the study’s limitations. The most important limitation is that all the apps were in English rather than vernacular. Hence, the study cannot be generalized to the whole Indian setting but to a population who can understand and use MH apps in English. This study involved a cross-sectional assessment of the top 50 apps for managing depression on the Google Play store. This might not represent all the mental health apps and might not capture the dynamic changes in the rapidly evolving MH apps market. Furthermore, we only analyzed the information provided in the privacy policy of these apps and did not conduct any analysis of the actual data-handling practices of these apps through empirical testing. This might have resulted in an underestimation of the magnitude and severity of data safety concerns associated with these apps. Lastly, our findings might not be that relevant for the day-to-day clinical practice of an average clinician dealing with patients who are not inclined towards using MH apps.
That said, the potential of using MH apps to address the huge unmet mental health needs of the population in LMICs like India is promising. However, as we detected, important ethical and data safety-related concerns are associated with the use of MH apps at present. App developers should urgently improve the accessibility and usability of privacy policies. Simultaneously, professional mental health organizations and government regulatory bodies should take proactive steps to create an overarching framework where effective, safe, and secure MH apps are made available to end service users. This will help boost health professionals’ confidence in recommending these MH apps and promote the uptake of MH apps by people with mental health difficulties.
Supplemental Material
Supplemental material for this article is available online.
Supplemental Material
Supplemental material for this article is available online.
Footnotes
Declaration of Conflicting Interests
The authors declared no potential conflicts of interest with respect to the research, authorship, and/or publication of this article.
Funding
The authors received no financial support for the research, authorship, and/or publication of this article.
References
Supplementary Material
Please find the following supplemental material available below.
For Open Access articles published under a Creative Commons License, all supplemental material carries the same license as the article it is associated with.
For non-Open Access articles published, all supplemental material carries a non-exclusive license, and permission requests for re-use of supplemental material or any part of supplemental material shall be sent directly to the copyright owner as specified in the copyright notice associated with the article.
