Health insurer Vitality attacked over Facebook app push

A UK health insurer is facing criticism for advising its members to use a Facebook-owned fitness-tracking app in order to retain a popular perk.

Vitality - formerly known as PruHealth - has emailed users suggesting they download Moves if they want to keep getting a cinema ticket once a week.

Privacy campaigners say the app's connection to Facebook has not been made explicit enough.

But Vitality says the initiative will "motivate healthy behaviour".

Neither the private insurer's emails nor its webpage detailing the activity tracking scheme mention Moves' link to Facebook.

Moves' own homepage and app store listings likewise do not flag its relationship with the social media giant, instead listing its developer as being ProtoGeo.

Facebook acquired the Finnish company in April 2014.

But if users click on a link to the app's privacy policy, and read more than halfway through the 1,276-word document, the connection is detailed.

"We may share information, including personally identifying information, with our affiliates (companies that are part of our corporate groups of companies, including but not limited to Facebook) to help provide, understand, and improve our services," it states.

Facebook told the BBC that it runs Moves as a "stand-alone application" and does not presently combine information collected via the app with people's Facebook profiles.

But privacy group Big Brother Watch remains concerned.

"Whilst the lure of lower insurance premiums and free benefits such as cinema tickets is appealing, the requirement to download an app, provide it with a huge amount of personal data and give it permission to track your every move all day every day will raise concern for some customers," said the organisation's chief executive Renate Samson.

"It is not at all clear that the app is owned by Facebook and there are no specific details about how the social media company intends to use the data, either now or in the future.

"It is critical that both the app and the insurance company are clear about who has access to their customers data and for what purpose.

"Sharing sensitive information may provide interesting algorithms and big data opportunities but exposes users day-to-day habits and personal lifestyles to unwanted scrutiny by unseen and unknown organisations."

Vitality is owned outright by the South African firm Discovery following Prudential PLC's sale of its stake in the business in November.

A month later, the company first contacted members to tell them about its change of movie ticket policy, which comes into effect on 1 July.

Moves is not the only fitness-tracking option offered - members can also log activities via devices and associated apps from Garmin, Fitbug, Fitbit, Polar and Misfit.

However, Moves is listed above the other options and flagged as being the only way to record time-based running and cycling workouts that last long enough to unlock a cinema visit code.

"[Our] model helps members understand how they can improve their own personal health, make it cheaper and easier to get healthy and, offers rewards to keep members motivated as they take steps to get healthier, through a range of discounts and incentives," Vitality's commercial director Nick Read told the BBC.

"This model relies on members opting in to share an amount of activity based data to unlock their rewards, which they can do through a range of devices, one of which is a free app, Moves.

"Before offering Moves to our members we undertook an extensive market review to select a provider who offered a free service available for usage with the majority of smart devices."

A spokeswoman for the firm added: "Third-party and data protection terms and conditions are made available to members who choose to opt in to the rewards programme. We of course value any feedback... and whenever feedback is received, we review accordingly."

She declined to say how many members Vitality has.

Moves does not ask smartphone owners if they have a Facebook account when they activate it.

A health data campaign group said it was concerned that Vitality's promotion of the app might attract users who had deliberately steered clear of the social network.

"Bribing customers to hand over their sensitive personal data - including biometric measurements, activity and location data - is at best questionable, especially when the data is being shipped out of the UK's jurisdiction," said Phil Booth from MedConfidential.

"Burying the fact that if you use the recommended free app, Facebook will get all your data - even if you've never had a Facebook account - is a truly shocking compromise of customer privacy.

"That Discovery hasn't been completely up front about who'll get access to your data and what it'll be used for is deeply unethical."

Facebook stressed that it does not receive health data directly from Vitality itself and said its use of Move's data beyond the app was limited.

"We share information in order to provide a better experience for users," explained a spokeswoman.

"For example, sharing non-identifiable technical data from Moves with Facebook enables Moves to provide a quicker, more secure service to the people who use it."