Privacy, explained plainly

The app is being designed with an optional way to contribute de-identified, combined data (for example, how often people keep to their schedules). This is planned to work as follows:

• It is off by default. Nothing is contributed unless you turn it on.
• It needs its own, separate consent. Accepting the app's terms or joining a group does not switch it on.
• Figures are only produced for groups large enough that no one person stands out, and figures for small groups are held back.
• Further safeguards are intended to reduce the chance that anyone could be re-identified by combining figures with other information.
• You can turn it off again later.

"Anonymous aggregate" is not the same as an anonymous account

These are two different things. The aggregate figures are designed so that they do not identify you. Your account is different: if you sign up with an email address, the operator knows which account is yours. Turning on aggregate contribution does not make your account untraceable, and turning it off does not change what is needed to run your account.

No system can honestly promise that nobody could ever identify you, or that it can never be breached. We aim to collect as little as possible, protect what we hold, and tell you plainly what we do.

Many people expect HIPAA to cover anything health-related. It does not cover everyone. The U.S. Federal Trade Commission explains that HIPAA applies to "covered entities" (health plans, many health care providers and health care clearinghouses) and, in part, to their "business associates". A consumer service like P in the Cup, which is not a doctor, insurer or clinic, may not be covered by HIPAA.

That does not mean there are no rules. The FTC's guidance says that the FTC Act, which prohibits unfair or deceptive practices, applies to companies that collect, use or share health information even when they are not required to comply with HIPAA, and advises those companies to tell consumers the whole truth rather than bury key facts in a privacy policy.

The FTC also enforces a Health Breach Notification Rule. According to the FTC, it applies to vendors of personal health records and related businesses that are not covered by HIPAA, and its examples include health apps. Under the Rule, a "breach" is not only hacking: it also includes a company disclosing covered information without the person's authorization. Businesses covered by the Rule must notify affected people, the FTC and, in some cases, the media.

Whether the Rule applies to the P in the Cup app will depend on how the app is finally built and what it stores. That has to be assessed against the app as actually built, and the app's privacy policy will address it. This page is general information, not legal advice.