--- title: "Should You Use a Separate Email for Health and Fitness Apps?" date: "2026-11-06" author: "Ahsan Luqman" canonical_url: "https://aliasfleet.com/blog/should-you-use-a-separate-email-for-health-and-fitness-apps" tags: ["Email Privacy", "Health Apps", "Email Aliases"] description: "Health apps collect weight, location and medication data, and several shared it with advertisers. One alias per app stops a breach joining it to one identity." --- # Should You Use a Separate Email for Health and Fitness Apps? Health apps collect weight, location and medication data, and several shared it with advertisers. One alias per app stops a breach joining it to one identity. A separate email address for each health and fitness app is a practical response to a documented pattern. Apps that collect weight, cycle dates, medication lists and location have shared that data with advertising platforms. The address links the data to one person. Giving each app a distinct address limits the damage when a list is sold or a database is breached. A fitness app logs where a person runs and when. A period tracker logs cycle dates and symptoms. A medication app logs the drugs a person takes and the times they take them. Together, those records describe a body, a condition and a daily routine. ## The enforcement record In January 2021, Flo Health settled allegations from the United States Federal Trade Commission. Flo, a period and fertility app used by more than 100 million consumers, had shared health information with Facebook, Google, Google Fabric, AppsFlyer and Flurry. The information included the fact of a pregnancy. Flo had promised to keep the data private. Sharing ran from February 2016 until press reports exposed it in February 2019. The settlement required an independent review of Flo privacy practices and user consent before further sharing. The case is recorded in the [FTC announcement](https://www.ftc.gov/news-events/news/press-releases/2021/01/developer-popular-womens-fertility-tracking-app-settles-ftc-allegations-it-misled-consumers-about). GoodRx followed in February 2023. The company, a prescription discount and telehealth provider, shared prescription and health condition data with Facebook, Google, Criteo, Branch and Twilio from at least 2017. It had promised never to share personal health information with advertisers. In August 2019 it uploaded email addresses, phone numbers and mobile advertising identifiers for people who had bought heart disease and blood pressure medication to Facebook. The upload let the platform identify their profiles and target them with health-related ads. GoodRx paid a $1.5 million civil penalty and received a permanent ban on sharing health data for advertising, after more than 55 million consumers had visited or used the service since January 2017. The action was the first under the Health Breach Notification Rule, according to the [FTC case](https://www.ftc.gov/news-events/news/press-releases/2023/02/ftc-enforcement-action-bar-goodrx-sharing-consumers-sensitive-health-info-advertising). BetterHelp, an online counselling service, was ordered in July 2023 to pay $7.8 million for disclosing health data to advertising platforms. The service had disclosed email addresses, IP addresses and health questionnaire information to Facebook, Snapchat, Criteo and Pinterest. It had promised the data would be used only for limited purposes. The order also banned BetterHelp from sharing health data for advertising, closing the channel the company had used to send questionnaire information to four platforms. The terms are set out in the [FTC final order](https://www.ftc.gov/news-events/news/press-releases/2023/07/ftc-gives-final-approval-order-banning-betterhelp-sharing-sensitive-health-data-advertising). A fourth case remains unresolved. On 29 July 2026 the FTC, joined by Utah and California, sued telehealth provider Hims and Hers. The complaint alleges the company shared sensitive health information about medical conditions with Meta, Snap and other advertising platforms, through uploaded customer lists and tracking technologies on its site, despite promising privacy. The allegations are unproven. The case is pending and Hims and Hers denies them. The [FTC announcement](https://www.ftc.gov/news-events/news/press-releases/2026/07/ftc-states-act-against-hims-hers-deceptive-unlawful-privacy-practices) is a complaint, not a finding. In five years, the FTC brought cases against four different kinds of service: period tracking, prescription discounts, counselling and telehealth. ## Scale of collection Sharing was already widespread before any of these apps reached a regulator, and the studies below measured it at scale across thousands of apps. A peer reviewed study in [the BMJ](https://www.bmj.com/content/364/bmj.l920) tested 24 top rated medicines related apps in 2019. It found 19 of 24, or 79 percent, shared user data outside the app. Seventeen of 24 transmitted user data outside the app. Email addresses were among the data types shared most often, and 55 unique entities owned by 46 parent companies received or processed the data. Sixty seven percent of those entities provided services related to collection and analysis of user data, including analytics or advertising. Third parties advertised the ability to share the data further with 216 so-called fourth parties. The study concluded that sharing of user data is routine, yet far from transparent. More recent work shows the same scale. A 2026 study of more than 10,000 mobile health apps on Google Play, published on [arXiv](https://arxiv.org/html/2610.23851v1), found 69.15 percent requested at least one permission unrelated to their stated purpose. Over 52.9 percent requested location data. Nearly 93 percent failed to provide users with a consent form. The figures describe permissions and consent, not confirmed sales. They still show how much access these apps request before a person has used them. A 2025 study from the University of Bremen examined 20 popular health apps in Germany and tested how each one handled consent and data transmission. Several transmitted personal data such as advertising identifiers before users had given consent. All 20 apps contained at least one manipulative design trick in obtaining consent. The findings are summarised in the [report on the study](https://nachrichten.idw-online.de/2025/10/22/new-study-uncovers-data-protection-gaps-in-popular-mhealth-apps). The address is present in every one of those transfers, from the first signup to each later sale or breach of user data. ## HIPAA coverage Many people assume health data is protected by law wherever it sits. For most consumer health apps, that assumption is wrong. The United States Department of Health and Human Services states that the HIPAA Rules generally do not protect health information accessed through or stored on a personal cell phone or tablet. The same applies to data downloaded or entered into mobile apps for personal use, regardless of where the information came from. The full statement is in the [HHS guidance](https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/cell-phone-hipaa/index.html). HIPAA applies to covered entities. The category covers health plans, most health care providers and health care clearinghouses, plus their business associates. An app downloaded directly from an app store, and not provided by a doctor or a health plan, is generally none of those things. HHS adds that information collected by a device or app may be viewed or collected by other entities, used by the vendor to send specific ads, and sold to a data broker. Other laws reach these apps instead. The FTC Act and the FTC Health Breach Notification Rule are the laws behind the cases above. That is why the Flo, GoodRx, BetterHelp and Hims and Hers matters were brought by the FTC rather than by HHS. A person who reads an app privacy policy should therefore check its sharing disclosures directly, rather than assume the category is protected. ## Email address as the join key An advertising platform does not need a name to identify a person. It needs a field that already exists in its own records. The email address serves that purpose. When an app shares a user list, it uploads addresses alongside the health facts. The platform matches those addresses to accounts it already holds. GoodRx did exactly this in August 2019. Email addresses were the key that let Facebook identify people who had bought specific medication. The same joining happens after a breach. [Have I Been Pwned](https://haveibeenpwned.com) now counts 1,049 breached sites and 17.8 billion exposed addresses. An address that appears in a health app breach alongside a name and a condition is more useful to an attacker than an address alone. It connects the condition to the person, and to every other service that holds the same address. Tracking widens the link further. The FTC consumer guidance explains the mechanism in its [page on how websites and apps collect information](https://consumer.ftc.gov/articles/how-protect-your-privacy-apps). Cookies, pixels and advertising identifiers track activity across sites. A separate address per app breaks the join at the source, so the address held by one app cannot identify the person anywhere else. The address in the health app records belongs to that app only. ## Separate address per app A distinct alias for each app works in three ways. - Containment. When an app is breached or sells its user list, the exposed address belongs to that app and nothing else, and it cannot be used to log in to other accounts. - Attribution. When marketing mail or spam starts arriving on the alias given to one app, the alias names the source without any investigation. - A kill switch. The alias can be paused or closed when the app is deleted or its mail turns unwanted, without changing the main inbox address. Setup follows the same pattern as for any other app. The alias is created before signup, labelled with the app name, and kept for that app alone for as long as the app stays installed. The app receives the alias instead of the real address. When the app is deleted, the alias can be closed with it. The same logic is set out in the piece on [using a different email address for every website](https://aliasfleet.com/blog/different-email-for-every-website), applied here to the most sensitive category of data. It is also the habit described in the piece on [whether a second email address is needed at all](https://aliasfleet.com/blog/do-you-need-a-second-email-address): separation without a second inbox to manage. ## Limits of a separate address A separate email does not stop a health app collecting health data. The app still receives the weight, the cycle dates, the medication list and the location, because the person entered them at signup and during daily use. It does not make the person anonymous to the app itself. The app still holds the name and payment details given at signup. It does not remove data already shared or sold. Anyone whose real address has been used for health apps for years should check it on Have I Been Pwned first, using the method in [how to check if your email was leaked](https://aliasfleet.com/blog/how-to-check-if-your-email-was-leaked). Aliases act as containment from here on, not as a repair of the past. The app behaviour itself is also unchanged. If an app shares data with advertisers, the data still moves. Only the identifier it carries changes. An alias controls the handover of the address, nothing else. No verified count of health apps that reject alias addresses at signup was found for this article. Some apps may refuse an alias domain. That gap matters for planning, and it is stated here rather than filled with a guess. ## Patient portal rule The patient portal keeps a permanent address, and the alias is for the app signup and marketing stream only, never the medical record identity. The patient portal is a different thing from a health app. The two must not be confused. The portal holds the medical record, test results, prescriptions and messages with clinicians. It needs a stable address the clinic can rely on for account recovery, for identity checks, and for clinical communication about results and prescriptions. The alias covers the app signup and the marketing stream only. It must never be presented as the medical record identity. The full reasoning is set out in [how to protect your email when booking medical care](https://aliasfleet.com/blog/how-to-protect-your-email-when-booking-medical-care), which carries the same rule: a permanent address stays on the portal. The same split applies elsewhere. A bank account keeps a permanent real address used only for financial accounts. Aliases cover everything else, which keeps the sensitive address isolated. ## AliasFleet and health apps [AliasFleet](https://aliasfleet.com) provides email aliases that forward to a verified destination inbox. A person creates a distinct alias for each health or fitness app, labels it with the app name, and gives that alias at signup. Confirmations, reminders and marketing mail for that app arrive through the alias, and replies route back through the alias so the destination address stays out of the app records. The mechanism is described in [how email aliases actually work](https://aliasfleet.com/blog/how-email-aliases-actually-work): the alias is a forwarding address under the person's control, not a separate inbox. AliasFleet does not hold the medical record and does not replace the patient portal. The free tier covers 10 active aliases, one verified destination inbox, three managed subdomains and 100 MB of monthly forwarding, per the [pricing page](https://aliasfleet.com/pricing). Aliases are persistent addresses the person manages, with pause and delete controls. The safety question is judged the same way as for any alias provider, and [are email aliases safe](https://aliasfleet.com/blog/are-email-aliases-safe) sets out the test: what the provider stores and logs after delivery matters more than the alias itself.