Why most health apps can read your diary, and how to check

If you write something in a health app (a mood, a symptom, a 2am worry), it feels private. For most apps, it isn't. Not because anyone is doing anything sinister with it today, but because of a simple architectural fact: the company can read it.

"Encrypted" usually doesn't mean what you think

Nearly every app can truthfully say your data is encrypted. There are two very different things that can mean:

• Encrypted in transit and at rest. Your entries are scrambled while travelling to the server and while sitting on the disk, but the company holds the keys. Their systems decrypt your data every time they need to display, process, or analyse it. So can anyone who compromises those systems, and anyone the company is compelled to share data with.
• End-to-end encrypted (E2EE). Your entries are scrambled on your device with a key that never leaves it. The server stores ciphertext it cannot open. If the company's database leaked tomorrow, your diary would still be unreadable.

The overwhelming majority of mood trackers, symptom diaries, and wellness journals are in the first category. That is not a scandal; it is the default way software is built, and it makes features like server-side search and analytics easier. But for a diary holding your mental health history, medication list, and symptoms, the difference matters more than for most data you produce.

Why it matters even if you trust the company

Trusting a company's intentions is not the same as trusting every future the data might have. Readable health data is exposed to things no privacy policy controls:

• Breaches. Health data is a high-value target, and a breached database of readable entries is readable to the attacker too.
• Acquisitions. Companies get bought. The privacy policy you agreed to can be revised by whoever owns the servers next.
• Legal compulsion. A company that can read your data can be required to hand it over. A company that cannot read it has nothing legible to hand over.
• Insider access. Support staff, engineers, and contractors often have legitimate access to production systems where readable data lives.

The five-minute audit for any health app

You do not need to be technical to check this. Work down the list:

1. Search the privacy policy for "end-to-end". If an app is genuinely E2EE, it will say so loudly; it is expensive to build and companies advertise it. If the policy only says "encrypted in transit and at rest", you have your answer.
2. Try the password reset test. If you can reset your password by email and immediately see all your old entries, the server can read your data. With real E2EE, losing your key means the provider cannot restore your content, which is why E2EE apps make you save a recovery key.
3. Check whether staff can help you with your content. If support can "look into" the text of an entry for you, they can read it.
4. Look for a recovery key, passphrase, or device-transfer step. Genuine E2EE apps need one, because the key lives with you. No key ceremony usually means no E2EE.
5. Ask. Email support and ask directly: "Can your staff or systems read the text of my entries?" An honest answer to that question tells you everything.

The honest trade-offs

E2EE is not free. Features that need the server to understand your data (server-side search, "insights" computed in the cloud, staff being able to rescue your account) either have to run on your device or not exist. If you ever see an app claim full E2EE and offer to email you your forgotten entries, one of those claims is wrong.

Whatever app you use, including ours, the right habit is the same: know which category it is in, and decide what you write accordingly.

Kiltr is a product of Longdog Labs Limited. This article is general information about software architecture, not legal or medical advice.