Privacy concerns of IoT medical applications: an empirical analysis of the current privacy policies under the GDPR

Recently, significant privacy concerns have arisen with the integration of IoT in healthcare. Healthcare data is vulnerable to threats in ubiquitous computing, where data is processed across clouds, fogs, and external servers, including unauthorised third-party access, which negatively impacts the acceptance and sustainability of IoT. The study examines whether the privacy policies of 25 US-based IoT medical applications comply with the General Data Protection Regulation (GDPR) by mapping their data collection practices against GDPR principles such as data transparency, purpose limitation, user control, security, and data retention. Results reveal strong compliance in transparency and data collection but notable shortcomings in security measures and data retention practices. Only 56% of the companies explicitly mention GDPR in their policies, suggesting a predominant focus on US legislation. The paper presents three scenarios illustrating varied GDPR compliance, emphasising the necessity of enhancing alignment with GDPR to ensure sufficient protection of EU residents' personal data.