Tracking Health Data Privately: Why On-Device Storage Matters

A dose log is among the most sensitive data you can generate: it reveals what you take, how often, and by extension things about your health you may share with no one but your clinician. Yet health apps are routinely built to send exactly this data to servers, and research has repeatedly found many sharing it further. This guide explains why on-device storage is the strongest default for personal health logs, and what to ask about any health app before trusting it with your records.

Why a dose log is sensitive data

It is easy to think of a log as just timestamps, but timestamps tell stories. A record of what you self-administer, when, and how consistently can imply diagnoses, treatments and health decisions. In the wrong hands, that kind of inference feeds advertising profiles, and in worse cases it can affect insurance, employment or legal exposure depending on where you live. Treating a dose log with the same care as a medical record is not paranoia; it is an accurate reading of what the data contains.

The gap most people miss: HIPAA usually does not apply

In the United States, HIPAA protects health information held by covered entities such as clinicians, hospitals and insurers. A consumer app you downloaded yourself is generally not a covered entity, so the medical privacy law most people assume protects them typically does not apply to app data at all. What governs a consumer health app is mostly its own privacy policy plus general consumer protection and, in some regions, stronger regimes like the GDPR. And the track record is poor: peer-reviewed analyses, including a large 2021 BMJ study of mobile health apps, found that the vast majority collected user data and a substantial share transmitted it to third parties, often for advertising and analytics, frequently with disclosure buried or absent.

Why on-device storage changes the math

Every privacy promise a cloud service makes, encryption, access controls, no-sale pledges, is a policy layered on top of one fact: your data sits on someone else's computer. Policies change, companies get acquired, servers get breached, and stored data can be demanded by legal process. On-device storage removes the fact itself. Data that never leaves your phone cannot leak from a server that does not hold it, cannot be sold by a company that cannot read it, and is protected by your device's own passcode and encryption. No architecture is magic, you still need to secure and back up your own device, but 'there is no server copy' is the one guarantee that does not depend on anyone keeping a promise.

Questions to ask about any health app

You can evaluate most of this in five minutes from an app's store listing and privacy policy:

• Where is my data stored, on the device or on the company's servers, and is that stated plainly?
• Do I need an account? Requiring an email or login usually signals server-side storage and linkability.
• What does the App Store privacy label or Play Store data safety section disclose about collection and third-party sharing?
• Does the policy mention advertising partners, analytics SDKs, or 'sharing with affiliates'?
• Can I export my data in a usable format, and can I delete all of it?
• What happens to the data if the company shuts down or is sold?

These questions are the reason Peptide Tracker keeps everything on your device: no account, no cloud, your dose history stays on your phone. For a logging utility, the same principle applies as for the log itself, records should serve you and your clinician, and no one else. If you are just starting a log, our guide on why keep a dose log covers what to record.

Sharing on your terms

Privacy does not mean secrecy from your care team; it means you decide who sees the record. An on-device log can still be shown or exported at an appointment, which is the model that matches how medical confidentiality has always worked: information flows to your clinician because you brought it, not because a server shared it. As with everything health-adjacent, this article is general information, not medical or legal advice; for decisions about your health or your data rights in your jurisdiction, consult the appropriate qualified professional.