Ranking
Safest Health and Fitness Apps 2026
Every app we cover that collects data about your body or mind, from patient portals and online therapy to period trackers, diabetes apps, fitness trackers and diet logs. Each score weighs what the app collects and shares for advertising, how well it protects accounts and stored health data, the control it gives you, risks such as dosing bugs and misleading claims, and its record with privacy and health regulators.
Updated · Scores update with each page
The ranking
Oura
The Oura app is one of the safer places to keep wearable health data. Oura is paid by membership rather than ads, says it does not sell data, and Apple's label shows no tracking. Its 2025 Pentagon and Palantir news caused alarm, but Oura says consumer data stays out of that system unless a service member opts in.
Score 76, grade BMyChart
MyChart is one of the safer places for your medical records. Epic does not sell your data or keep copies of your health information, and the app needs two-step login by default. The weak points are outside the app itself, in how each hospital runs its portal and in phishing emails that copy MyChart's branding.
Score 74, grade BWysa
Wysa is one of the more careful AI mental health chatbots. You can use it with just a nickname, Apple's label shows no tracking, and one button deletes your history. The catch is that chats go to outside AI models such as OpenAI's after names are stripped, and Wysa says it is not for crises or severe illness.
Score 72, grade BFreeStyle LibreLink
FreeStyle LibreLink is a careful app for reading Abbott glucose sensors: no tracking on the store labels and US data under HIPAA. The watch points are research data kept after deletion, two-step login only in some countries, and a 2025 Libre 3 sensor recall linked to seven deaths.
Score 71, grade BGarmin Connect
Garmin Connect is one of the more private fitness apps. Neither app store shows ad tracking or data sharing, and no regulator has fined Garmin over it. The weak spots are security, after a 2020 ransomware attack knocked the service offline for days, and a two-step login limited to codes by email or text.
Score 70, grade BmySugr
mySugr, Roche's diabetes logbook, keeps data in the EU or US, lets you export and delete it in the app and shows no ad tracking. The catches are health data used for analytics, no two-step login we could find, and a 2024 bolus calculator bug that could suggest too much insulin.
Score 70, grade BHeadspace
Headspace is a safe choice for meditation and mental health care. It holds SOC 2 and HITRUST certifications and has no regulator action or known breach, but it shares identifiers and app activity with advertising partners unless you opt out.
Score 69, grade Chealow
healow is a reasonably safe way to see records from a doctor's office that runs eClinicalWorks. Neither app store shows tracking, and your records stay under HIPAA. The weak points are thin public security detail, a policy that lets healow pass non-medical data to ad partners, and portal phishing.
Score 69, grade CClue
Clue is one of the safer period trackers for the data that matters most, with health data kept in the EU under GDPR and a public pledge never to hand it to authorities. The catches are ad tracking through device identifiers, no two-step login and no bug bounty.
Score 68, grade CHuawei Health
Huawei Health has a clear privacy statement, no ad tracking and good deletion tools, and European users' data stays in Germany. The catches are data centres in Hong Kong and Singapore for other regions, a parent the US treats as a security risk, and an Android app installed from outside Google Play.
Score 68, grade CNatural Cycles
Natural Cycles is a regulated contraceptive with careful data rules, an optional anonymous mode and no record of a breach. The real risk is the method itself, which fails for about 7 in 100 women a year in typical use, plus ad targeting built on users' contact details.
Score 68, grade CDexcom G7
The Dexcom G7 app is careful with data, with no tracking on the App Store label and no sharing on Google Play. The risks are reliability and record: a 2025 Class I app recall for missing alerts, an open FDA warning letter on sensors, and an unconfirmed 2026 breach claim.
Score 67, grade CDoctolib
Doctolib is a reasonably safe way to book doctors in France, Germany and Italy. Health data sits with a certified host on Amazon's EU servers. But details of 6,128 appointments leaked in 2020, the app sent searches to Facebook in 2021, and France fined it for abusing its dominance in 2025.
Score 67, grade CCalm
Calm is safe to use for sleep stories and meditation, but it is an advertising-funded business at heart. It tracks purchases, identifiers and usage across other apps for ads, shares emails with ad platforms and publishes little about its security. No regulator has fined it.
Score 66, grade CFitbit (Google Health)
The Fitbit app, renamed Google Health in May 2026, is reasonably safe for your data. Google keeps Fitbit health data out of its ads and behind Google account security. The weak spot is the company record, with an A$11 million penalty in Australia and a $12.25 million US penalty over a watch that burned users.
Score 66, grade CFlo
Flo is reasonably safe today if you turn on Anonymous Mode or limit what you log. Until 2019 it passed period and pregnancy data to Facebook and Google, which led to a 2021 FTC order and $59.5 million in US class settlements. It says health data is no longer used for ads, but the app still tracks you for marketing.
Score 66, grade CSamsung Health
Samsung Health is reasonably safe, with health data encrypted on the phone and no breach or fine on record. The weak spots are what Samsung discloses on Google Play, where health data is listed as shared for marketing despite a policy that says otherwise, and a clumsy 2026 request to train AI on users' health data.
Score 66, grade CZepp (Amazfit)
Zepp, the app for Amazfit watches and rings, is reasonably safe. It does not track you across apps, says it never sells data and keeps US and European data out of China. It has no public bug bounty or audit, retention rules are vague, and the policy lets third-party kits, advertisers included, collect data.
Score 66, grade COmnipod 5
The Omnipod 5 app collects health data without ad tracking, and Insulet handles pump data under HIPAA. The risk is dosing: a Class I recall of the Android app in 2023, two dose-entry bugs on iPhone in 2025, and Class I Pod recalls in 2026 after serious injuries.
Score 65, grade CBetterHelp
BetterHelp is reasonably safe for online therapy, but its record is not clean. From 2017 to 2020 it passed emails and health questionnaire answers to Facebook, Snapchat and other ad platforms, leading to a 2023 FTC order and $7.8 million in refunds. Therapy content now stays away from advertisers.
Score 64, grade CMi Fitness
Mi Fitness, Xiaomi's app for its bands and watches, is reasonably safe for everyday tracking, with no ad tracking and a paid bug bounty. But it collects many phone identifiers, shares some data with partners such as Google Maps and Amazon Alexa, and faces a pending GDPR complaint over transfers to China.
Score 64, grade CTalkspace
Talkspace is a reasonably safe way to see a licensed therapist online. Records are protected health information under HIPAA and no regulator has fined it, but it shares identifiers and app activity for advertising, analyses therapy chats with machine learning and makes deletion slow.
Score 64, grade CWHOOP
WHOOP is a reasonable choice if you accept some marketing use of your data. It says it never sells personal or health data, but Google Play lists data shared with other companies for ads, and profiles are searchable by default. An FDA warning over its blood pressure feature closed in June 2026.
Score 64, grade CFollowMyHealth
FollowMyHealth still works and gets updates, and it encrypts each user's records with a separate key. The concerns are a privacy policy last changed in 2019 that allows marketing use of your health record data, an App Store label that says it collects nothing, and two recent data breaches at its owner, Veradigm.
Score 63, grade CGoodRx
GoodRx is safe for finding cheaper prescriptions, but think about what it learns. Until 2020 it passed users' medications and conditions to Facebook, Google and others, leading to a $1.5 million penalty in 2023 and a ban on using health data for ads. Its store labels still list wide marketing use.
Score 60, grade CStrava
Strava is safe to use if you change a few settings. Adult accounts start with profile and activities visible to everyone, the app shares purchase and ID data for ad tracking, and public routes have exposed military bases and leaders' bodyguards. Teen accounts are private by default and no breach or fine was found.
Score 59, grade CMyFitnessPal
MyFitnessPal keeps your weight and food diary private by default and has run a paid bug bounty since 2022. But it tracks you across other apps for advertising, shares precise location with ad partners on Android, and a 2018 breach exposed the logins of about 150 million accounts.
Score 57, grade CCal AI
Cal AI is quick and popular, but it is one of the weaker health apps on privacy and security. It tracks you for advertising, its terms let it train AI on what you upload, and in March 2026 a hacker posted what was reported as data on about 3 million users, which the company has not publicly confirmed.
Score 50, grade DCerebral
Cerebral offers ordinary online therapy and medication today, but its record is one of the weakest in digital mental health. Trackers sent data on about 3.2 million patients to ad platforms for over three years, and in 2024 it settled with the FTC and with prosecutors over its ADHD prescribing.
Score 49, grade D23andMe
23andMe has a weak safety record. A 2023 attack exposed ancestry and relative data on 6.9 million customers, leading to a UK fine and US state settlements. After its 2025 bankruptcy the data passed to a nonprofit set up by its co-founder. You can still delete your account, but the lab keeps some genetic data.
Score 48, grade D
Which apps are on this list
The rule is the data. An app is here when its main job runs on information about your physical or mental health. That covers patient portals and booking apps such as MyChart, healow and Doctolib; online therapy and mental health apps such as BetterHelp, Talkspace, Wysa, Headspace and Calm; GoodRx for prescriptions; period and fertility trackers such as Flo, Clue and Natural Cycles; diabetes apps such as Dexcom G7, FreeStyle LibreLink and Omnipod 5; and fitness, sleep and diet apps such as Fitbit, Garmin Connect, Oura, Strava and MyFitnessPal. 23andMe is here because its reports cover genetic health risks.
Family-tree DNA services such as Ancestry and MyHeritage are left out, and so are the learning, children's and family-locator apps that share the same group on our site.
How the order is built
Each app is scored on five factors. Privacy and security count for 30% each: what the app collects and shares with advertisers, and how well it protects accounts and stored data. Transparency and control count for 15%. Scams and harmful content count for 15%, which for these apps also covers dosing bugs, device recalls and claims that go beyond the evidence. The regulatory record counts for 10%. Full rubrics are on how we score apps.
The list is those scores sorted from the highest down. When we update a page, its place here moves too, so this text does not quote scores.
What the apps near the top have in common
They keep health data away from advertising. Oura is paid for by membership and Apple's label shows no tracking, Garmin Connect shows no ad tracking or data sharing on either store, and the diabetes apps from Dexcom and Abbott list no tracking at all. MyChart turns on two-step login by default, and Epic says it does not keep copies of your health information.
Why some score lower
Most lose points for a past leak of exactly the data people trust them with. Flo passed period and pregnancy data to Facebook and Google until 2019, GoodRx shared medications and conditions until 2020, and a 2023 attack on 23andMe exposed data on 6.9 million customers. Calm and MyFitnessPal sell subscriptions, yet their apps still track users across other companies' apps for advertising. Cal AI's terms let it train AI on what you upload, and data reported to cover about 3 million of its users was posted online in March 2026.
What the score does not tell you
Our score covers the app as a keeper of your data. It says nothing about whether a treatment works or suits you. Natural Cycles is careful with data, yet as a method it fails for about 7 in 100 women a year in typical use. And a careful diabetes app is still only as good as the sensor or pump it reads, so keep up with recalls and speak to your doctor or diabetes team before you change any treatment.
Questions
Does HIPAA protect the data in my health apps?
Only some of it. HIPAA covers your records when an app works for a US doctor, hospital, insurer or their contractors, as patient portals such as MyChart and healow do and as therapy services such as Talkspace say they do. A period tracker, calorie counter or fitness band you sign up for yourself usually falls outside it, and the app's own privacy policy and US consumer law decide what it can do.
Is it safe to use a period tracker in the US?
It can be, if you choose one that keeps less. Clue stores health data in the EU under GDPRThe EU's General Data Protection Regulation, which sets rules on how organisations collect and use personal data and allows large fines.More in the glossary and has pledged not to hand it to authorities, and Flo and Natural Cycles offer anonymous modes. Whatever app you use, log only what you need, and remember that messages, searches and location on your phone can say as much as the tracker does.
Which therapy apps have shared users' data?
Two big online mental health services have settled US cases over it. The FTC said BetterHelp passed emails and health questionnaire answers to ad platforms from 2017 to 2020, and it paid $7.8 million in refunds. Trackers at Cerebral sent data on about 3.2 million patients to ad platforms for more than three years, and it settled with the FTC in 2024. BetterHelp says therapy content now stays away from advertisers.
Can a diabetes app give a wrong reading or dose?
Yes, which is why these apps are regulated as medical devices. Dexcom recalled its G7 app in 2025 because alerts could be missed, the Omnipod 5 Android app was recalled in 2023, and a 2024 bug in mySugr's bolus calculator could suggest too much insulin. Keep your app and phone updated, read every recall notice, and talk to your diabetes team before you change how you dose.
How do I limit what a fitness app shares?
Open its privacy settings on the first day. Strava starts adult profiles and activities as visible to everyone, and WHOOP profiles are searchable by default. Set a privacy zone around your home, hide your profile from search, and turn off ad personalisation in the app and on the phone.