Omnipod 5

Is the Omnipod 5 app safe?

For your privacy, mostly yes. For dosing, it needs more care than most health apps. The Omnipod 5 app tells Insulet's tubeless pump how much insulin to give, and neither Apple's label nor Insulet's policy points to ad tracking inside the app. But the app has had three FDA recalls for dose-entry errors since 2023, one of them Class I, and in 2026 Insulet recalled millions of Pods because some could leak insulin without warning.

We score the Omnipod 5 app 65/100, below the sensor apps it pairs with, the Dexcom G7 app (67) and FreeStyle LibreLink (71). An app that sends insulin commands carries a higher stake than one that only shows readings.

What the Omnipod 5 app collects

Apple's label lists health data, customer support messages, user and device IDs, product interaction, crash and performance data. All of it is linked to you, for running the app and for analytics. There is no "Data Used to Track You" section, no advertising purpose, and no location or contact list, which makes it one of the narrower labels among diabetes apps. On Google Play, Insulet says it shares your email address and health information with other companies, for app functionality and analytics.

Insulet's privacy policy, updated in August 2026, does not cover protected health information. Data that falls under HIPAA, such as the pump and sensor data the app handles for your care, is governed by a separate HIPAA notice. The general policy covers Insulet's websites and apps beyond that. It says Insulet may disclose some personal data to ad partners for "tailored advertising" on other sites, which may count as a "sale" under US state laws. You can switch that off with Global Privacy Control, which Insulet honours, or its Do Not Sell or Share link. Insulet says it does not respond to Do Not Track signals.

The recalls that matter

These FDA recalls name the Omnipod 5 app or the Pods it controls.

• Android app, Class I (November 2023). In versions 1.1 to 1.2.3, the bolus calculator did not record a decimal point if it was the first thing entered when changing a dose. A user who did not spot it on the confirmation screen could get much more insulin than intended. About 27,000 users in the US, Germany and the UK were affected.
• iPhone app, Class II (May 2025). If the phone was set to a region that uses a comma as decimal separator, the app could read 0.1 units as 1 unit. Insulet counted about 122,800 downloads and about 80,000 active users.
• iPhone app, Class II (September 2025). Using the iPhone's magnifier while typing a number in a manual entry field could duplicate the digit, for example in a bolus or carb ratio. FDA lists all 2.x versions and about 174,000 units.
• Pods, Class I (March and May 2026). Some Pods had a torn cannula, so insulin leaked inside or around the Pod instead of reaching the body. Insulet had 18 reports of serious adverse events when it announced the first correction, and FDA said 24 serious injuries and no deaths were linked to the May recall, which covered about 4.9 million Omnipod 5 Pods plus older Omnipod models.

A smaller Class II recall in 2023 covered an outage that left some Android users unable to control their pump from the app after a certificate change on Insulet’s cloud; basal insulin kept flowing.

Under our rules, FDA recalls are device corrections, not fines, so they mainly shape the harmful content score and take only a small deduction from the regulatory record. In an app that sends insulin commands, they are the main risk.

How secure is it?

Insulet runs a disclosure programme on HackerOne that promises a first response within two business days but pays no rewards. We found no breach of the app itself. Two incidents touched Omnipod customers. In January 2021 a hacker reached Cornerstone OnDemand, Insulet's training vendor, and may have taken names, emails and training records. Insulet wrote to customers on 18 March 2021, and its report to the HHS Office for Civil Rights the next day describes a business associate's cyber-attack that affected 9,050 people, with names, addresses and treatment information. In December 2022 Insulet sent Omnipod DASH users a link to confirm they had read a recall letter. Trackers on that web page passed each customer's IP address and whether they used DASH and a controller to Insulet's "website performance and marketing partners." Insulet removed the trackers on 6 December 2022, the day it found the problem. Its report to the HHS Office for Civil Rights, filed on 5 January 2023 as an unauthorised disclosure through tracking technology, counts 29,000 people whose names and IP addresses were captured.

We could not confirm whether Omnipod accounts offer two-step login; Insulet's help pages block automated readers.

Who should be careful

Parents of young children carry the most risk, because they enter doses for someone who cannot check them. These steps follow from the recalls:

1. Read the dose on the confirmation screen before every bolus, especially values below 1 unit.
2. Keep your phone's region and number format matched to how you enter decimals.
3. Check Pod lot numbers at omnipod.com/check-pods after any recall notice, and watch for high glucose or a wet Pod site, since leaks may not set off an alarm.
4. Keep Insulet's controller or a backup insulin plan for when your phone or app fails.
5. Turn on Global Privacy Control in your browser if you use omnipod.com.

Medical decisions, such as switching pumps after a recall, belong with your diabetes team.

How we scored it

The regulatory record (85) is the strongest factor: FDA cleared the system, we found no privacy or consumer fine or order, and the recalls count as context there. Scams and harmful content (56) is the weakest, because of three app recalls for dose-entry errors and the 2026 Pod recalls with serious injuries. Security (60) is held back by the 2022 tracker incident and no paid bug bounty.