"93% of individuals in a dataset of 60 million could be uniquely identified using only four timed location points."
— Patterns Journal, 2021
The "free" download button in the App Store is often the first payment in a transaction you never agreed to make. While you scan your blood work to track your cholesterol, a silent network of advertisers and data brokers may be bidding on the very biomarkers you just uploaded.
This isn't a hypothetical privacy concern; it is the core business model for a global industry that treats your medical vulnerabilities as a liquid asset. This post pulls back the curtain on how your most intimate health data is harvested, de-anonymized, and sold.
The illusion of the free health assistant
Modern health apps often present themselves as helpful digital companions, yet research suggests their primary function is data extraction. A landmark 2019 study published in the BMJ analyzed 24 prominent medicines-related apps and found that 79% shared user data with external third parties.
The Fourth-Party Network: Researchers identified a network of 216 additional companies—mostly advertising and technology firms—that could indirectly receive user data through these apps. Once data enters this ecosystem, the original developer loses nearly all control over where your information travels.
When an app doesn't charge you a subscription, you are not the customer; you are the inventory. These platforms often integrate "tracking pixels" and software development kits (SDKs) from major advertising giants. In 2023, the FTC took action against GoodRx for allegedly sharing sensitive user data, including prescription names and health conditions, with advertising platforms to create targeted ad audiences.
The myth of the anonymous medical record
You might feel a false sense of security because an app claims your data is "anonymized" before it leaves your phone. However, data science has rendered the concept of true anonymity nearly obsolete in the age of big data.
The Re-identification Risk: A 2021 study demonstrated that 93% of individuals in a dataset of 60 million could be uniquely re-identified using just four spatiotemporal data points. If an app tracks your location alongside your health logs, your identity is effectively a mathematical certainty.
This technical reality creates a dangerous bridge between your "anonymous" lab results and your real-world identity. Data brokers capitalize on this by merging disparate data points—your ZIP code, your age, and your recent searches for "HbA1c levels"—to build a comprehensive medical profile. Your biological data is being bundled with your credit score and sold to the highest bidder without your knowledge or consent.
Taking back control of your biological data
Navigating this landscape requires moving beyond blind trust in "free" tools and adopting a strategy of digital sovereignty. Protecting your health information isn't about quitting technology; it's about choosing tools that are architecturally incapable of betraying you.
Regaining Sovereignty:
- Manual Transfers: Download your lab results as a PDF directly from your doctor's HIPAA-compliant portal and store them locally.
- Review Permissions: Check which apps have access to your Health data in your phone settings.
- Accountless Tracking: Use dedicated offline-first applications that function without a cloud account.
- Physical Records: Scan hard copies of your blood work into secure, local-only storage.
Your lab results stay with you
Meridian was built as a direct response to the data-mining industry. We believe your blood work is the most private information you own, which is why your data never leaves your device. Unlike "free" apps that upload your labs to a cloud server for processing, Meridian uses the Apple Neural Engine to handle OCR and Trend Charts locally on your iPhone.
This means your glucose levels and cholesterol markers are encrypted with AES-256-GCM hardware encryption and are never visible to us or any third party. Enable the Face ID lock in Meridian to ensure your medical history is instantly protected the moment you close the app.
Download on the App StoreSOURCES
- Grundy, Q. (2019). Data sharing practices of medicines related apps. BMJ, 364(l920).
- Farzanehfar, A. (2021). The risk of re-identification remains high. Patterns, 2(3).
- Kim, J. (2023). Data Brokers and the Sale of Americans’ Mental Health Data. Duke University.
- FTC. (2023). FTC Enforcement Action Against GoodRx Holdings, Inc.
- HIPAA Guide. (2025). H1 2025 Healthcare Data Breach Report.