Domain 4: Privacy & Security
Considers Health App privacy and security.
Remember: Your responses are saved only in this browser session and will be lost if you close your browser. Generate and download your report to keep a permanent copy.
0 of 5 questions completed (0%)
If the App requires entry of personal information and health data, does it comply with all relevant Australian Commonwealth and Jurisdictional privacy policies including storage and location of health data?
The developer shall document evidence that the Australian Privacy Principles are followed including adherence to storage of health data, what data is collected, how it is collected, and for what purposes it is used.
Does the App provide clear information on how user-derived data is used by the App and in any algorithms, decision-making processes, or automated actions that may affect the health of the user (whether that data is derived by devices or direct user entry)?
The developer shall document evidence on how the user is informed if any user-derived data are used for specific healthcare purposes.
Does the App collect personal data (whether from user entry or via connected devices), and if so does the App provide users with: • easy access to their personal data, including the ability to view, download, and understand the data collected about them? • the ability to easily and permanently erase their data from the App’s records? • the ability to easily withdraw or withhold consent for the collection, storage, or distribution of their data, whether there is an option for users to opt out from sharing their data, and whether users can access, copy, amend, or request deletion of their data?
The developer shall document evidence on how the user is informed about their control over data they provide to the App (or which accesses their data). The developer shall document evidence of compliance with all privacy policies concerning personal data.
Does the App obtain explicit consent from users before collecting their personal data and using beyond its stated primary intent including use of such data for AI training purposes?
The developer shall document evidence on how the user is informed for consent purposes with respect to collecting and using their personal data. The developer shall document evidence of compliance with privacy, consumer law and any other relevant laws with respect to collecting and sharing personal and sensitive data.
Does the App, or associated website:
• clearly disclose third parties who may obtain or use any personal information provided (including for training AI systems); and,
• show how third parties may use the data and how that usage may be terminated by the user if desired; and,
• disclose any data retention or destruction process?
The developer shall document evidence of compliance with privacy, consumer law and any other relevant laws with respect to collecting and sharing personal and sensitive data with third parties beyond primary use of the App.