Is it safe to let an app read my vitals from video?

The widespread availability of smartphones with high-quality cameras has unlocked new possibilities for health and wellness applications, including the ability to measure vital signs like heart rate and respiratory rate directly from a video feed of a user's face. This technology, known as remote photoplethysmography (rPPG), offers unprecedented convenience. However, it also raises significant questions for engineering leaders and development teams regarding data privacy and security. The core issue is not whether the technology works, but what happens to the video data after it is recorded. Ensuring a phone vitals scan is privacy safe depends almost entirely on the architectural decisions made during the application's development, specifically the choice between on-device and cloud-based processing.

"The average cost of a data breach in the healthcare sector reached nearly $11 million in 2023, an 8% increase from the prior year. This makes the healthcare industry the most targeted sector, accounting for 31% of all data breach incidents." - IBM Cost of a Data Breach Report, 2023.

On-device vs. cloud processing: a security deep dive

The fundamental question for any team integrating rPPG technology is: where does the analysis happen? The video stream contains sensitive biometric data that can be used to derive health insights. The location where this raw data is processed has profound implications for user privacy and platform security. A privacy-safe implementation ensures that this sensitive information is handled correctly, minimizing the attack surface and potential for exposure.

For engineering leaders, the choice between on-device and cloud processing is a critical one. On-device processing keeps the raw video data on the user's phone, performing all calculations locally. In contrast, cloud-based approaches transmit the video or derived physiological signals to a server for analysis. While cloud processing can offer benefits in terms of centralized model updates and heavy computational lifting, it introduces significant privacy risks. A study published in the Journal of Medical Internet Research highlighted that a vast majority of mobile health apps share data with third parties, often without clear user consent. When that data is a user's video feed, the stakes are considerably higher.

Comparison of data processing architectures

Feature	On-Device Processing	Cloud-Based Processing
Data Transmission	Raw video data never leaves the user's device. Only aggregated, anonymized results may be sent to a server.	Raw video or physiological data is transmitted over the internet to a third-party server.
Privacy Risk	Minimal. The user retains full control over their most sensitive data. Reduces risk of man-in-the-middle attacks.	High. Data is vulnerable during transit and at rest on the server. Creates a valuable target for attackers.
Latency	Low. All calculations are performed locally, providing near-instantaneous results.	High. Dependent on network conditions, server load, and round-trip time.
Offline Functionality	Fully functional without an internet connection.	Requires a stable internet connection to perform analysis.
Regulatory Compliance	Simplifies compliance with regulations like GDPR and HIPAA by minimizing data transfer and storage.	Complex. Requires robust Business Associate Agreements (BAAs) and proof of data governance for regulations like HIPAA.
User Trust	High. Users can be assured their video data is not being stored or analyzed by unknown parties.	Low. Requires users to trust the security practices of both the app developer and their cloud provider.

Industry applications and architectural trust

Building user trust is critical in the digital health space. A system's architecture is a direct reflection of its commitment to privacy.

• Telehealth Platforms: For platforms facilitating virtual consultations, integrating on-device vitals scanning allows for real-time data collection during a call without sending sensitive video to another server, ensuring patient confidentiality.
• Wellness and Fitness Apps: An app encouraging daily check-ins can confidently state that all user data is private and processed locally, which can be a strong competitive differentiator.
• Insurtech and Underwriting: Platforms that use vitals data for risk assessment must prioritize security. An architecture that processes data on-device eliminates a massive potential liability associated with storing large volumes of personal health information (PHI).

A key finding from a 2022 study by researchers at the University of Oulu is that rPPG signals themselves can be unique enough to potentially re-identify individuals. This makes the argument for on-device processing even stronger; if the raw signal never leaves the phone, it cannot be used for tracking or re-identification purposes by third parties.

Current research and evidence

The academic and security communities are actively investigating the implications of rPPG technology. Research has demonstrated that while rPPG is a robust technique for measuring vital signs, its implementation details are critical for ensuring user privacy. In a 2021 paper, "Facial Privacy Protection for Remote Photoplethysmography," researchers proposed methods to obscure facial identity while preserving the underlying physiological signal, but these techniques are best implemented in an on-device environment where the raw video is accessible for modification before any potential (and ill-advised) transmission.

Furthermore, the conversation around data security extends beyond simple privacy. It also involves the integrity of the data. On-device SDKs can be designed to operate within a secure enclave on the device, providing a higher degree of assurance that the results have not been tampered with. This is a crucial consideration for clinical and research applications where data integrity is as important as confidentiality.

The future of private health monitoring

As camera-based health monitoring becomes more common, the debate over data processing will intensify. We expect to see a market-wide push towards solutions that are "private by design." This means architectures that default to on-device processing and require explicit user consent for any data to be shared. The development of more efficient neural network models and more powerful mobile processors will further accelerate this trend, making it feasible to run even the most complex rPPG algorithms directly on a user's phone. For developers, this means the tools to build a phone vitals scan that is privacy safe are increasingly accessible and represent the most responsible path forward.

Frequently asked questions

Is the video of my face stored anywhere?

With a properly designed on-device rPPG system, the video of your face is processed in real-time and is not stored on the device or transmitted to any server after the scan is complete. The application should only retain the final vital sign measurement, not the video used to derive it.

Does HIPAA apply to these apps?

HIPAA's applicability depends on the app's function and the entity that created it. If a healthcare provider or a service acting on their behalf (a "Business Associate") develops the app to manage patient health, HIPAA rules will apply. However, many consumer wellness apps are not covered by HIPAA. Regardless of HIPAA, a privacy-first approach using on-device processing is the best practice for handling sensitive health data.

Can the police or government access this video data?

If the video data is processed on the user's device and then immediately discarded, there is no data to be accessed by any third party, including law enforcement. Cloud-based systems, where data may be stored on servers, can be subject to legal data requests and subpoenas, creating a potential privacy risk that on-device processing avoids.

As engineering leaders and developers continue to innovate in the digital health sector, the architectural choices we make have a lasting impact on user trust and data security. Circadify is committed to providing privacy-first solutions that empower developers to build secure and reliable health monitoring applications. To learn more about our on-device SDK and how to implement a privacy-safe vitals scanning feature, visit our developer documentation at circadify.com/custom-builds.