Privacy and Security of Women's Reproductive Health Apps in a Changing Legal Landscape

Shalini Saini,Nitesh Saxena

2024-04-09

Abstract:FemTech, a rising trend in mobile apps, empowers women to digitally manage their health and family planning. However, privacy and security vulnerabilities in period-tracking and fertility-monitoring apps present significant risks, such as unintended pregnancies and legal consequences. Our approach involves manual observations of privacy policies and app permissions, along with dynamic and static analysis using multiple evaluation frameworks. Our research reveals that many of these apps gather personally identifiable information (PII) and sensitive healthcare data. Furthermore, our analysis identifies that 61% of the code vulnerabilities found in the apps are classified under the top-ten Open Web Application Security Project (OWASP) vulnerabilities. Our research emphasizes the significance of tackling the privacy and security vulnerabilities present in period-tracking and fertility-monitoring mobile apps. By highlighting these crucial risks, we aim to initiate a vital discussion and advocate for increased accountability and transparency of digital tools for women's health. We encourage the industry to prioritize user privacy and security, ultimately promoting a safer and more secure environment for women's health management.

Cryptography and Security,Emerging Technologies

What problem does this paper attempt to address?

The problem that this paper attempts to solve is the privacy and security vulnerabilities in female reproductive health applications. With the development of mobile application technology, more and more women use mobile phone applications to manage their menstrual cycles and fertility plans. However, the privacy and security vulnerabilities existing in these applications bring significant risks to users, such as unwanted pregnancy and legal consequences. Specifically, the paper focuses on the following aspects:

1. **Privacy Policy Analysis**: Many applications collect personally identifiable information (PII) and sensitive medical data, but their privacy policies lack clear descriptions of security measures. Approximately 85% of application privacy policies do not explicitly mention security measures, although this data is very sensitive.

2. **Permission Analysis**: The study found that about 61% of the code vulnerabilities in these applications belong to one of the OWASP (Open Web Application Security Project) top ten vulnerabilities. These vulnerabilities may lead to unauthorized access and data leakage.

3. **Attack Surface Analysis**: Through dynamic and static analysis methods, the study reveals that many applications have unprotected components, which may be exploited by malicious users, leading to privacy and security attacks.

4. **Code Analysis**: Static analysis shows that many applications have serious security vulnerabilities, such as unprotected exported services, insecure content providers, and improper receiver permission settings.

The paper emphasizes that in the post - Roe v. Wade era, the vulnerabilities in menstrual - tracking and fertility - monitoring applications significantly increase women's privacy and security risks. The author calls on medical professionals, developers, and policymakers to cooperate to develop safer and more trustworthy digital health management tools to protect women's reproductive health rights.