Comment by pkuhar | Hacker News Reader

Comment by pkuhar | Hacker News Reader

Infections raise resting heart rate. so resting heart rate is a good indicator of an infections.

I've made an app that collect heart rate data from the apple watch and posts it to a public server together with an approximate location. Data is anonymized.

Apple rejected the app, since it relates to human subject research and need IRB approval.

The app and backend are open source. If anyone want to push this through their university and do some research, you have my full support.

-- rejection

Hello Peter,

Thanks for your time on the phone today.

As we discussed, we noticed that your app is conducting health-related human subject research however the seller and company names associated with your app are not from a recognized institution and we were unable to verify independent ethics review board approval.

We have now rejected your app for the App Store Review Guidelines detailed below.

Guideline 5.1.3 - Legal - Privacy - Health and Health Research

Your app is conducting health-related human subject research, but we were unable to verify independent ethics review board approval.

Next Steps

Apps conducting health-related human subject research must secure approval from an independent ethics review board. You can attach proof in the App Review Notes section of App Store Connect.

Guideline 5.1.1 - Legal - Privacy - Data Collection and Storage

We found in our review that your app provides services in a highly-regulated industry and requires sensitive user information, however the seller and company names associated with your app are not from a recognized institution.

Per section 5.1.1 (ix) of the App Store Review Guidelines, apps that provide services or collect sensitive user information in highly-regulated fields should be submitted by a legal entity that provides these services, and not by an individual developer.

> Infections raise resting heart rate. so resting heart rate is a good indicator of an infections.

This does not logically follow. There are many reasons your resting heart rate could be increased and most will be unrelated to infections.

This is the classic logical fallacy “affirming the consequent”. Look it up.

Thanks for supplying the formal name. It escaped my mind this morning :)

Bloody bureaucrats. Is there some way you could get a recognized institution to back you?

I'll tweet out a request see if someone is willing to take it up.

On the other hand, this is quite sensitive data, which is why a respected nonprofit organization would be much more trustworthy, and which is why I understand the decision of the referees.

People install apps voluntarily, they should be able to make these sort of decisions for themselves.

It's one thing to protect users from malware, quite another to treat them like legal incompetents.

Just like they made the decisions for themselves when faced with the Cambridge Analytica quizes, right? Regulations are there for a reason.

You know, my HIPAA training is out of date and it's possible that new legislation applies. One of the more aggravating parts of my insurance job was dealing with people who thought I wanted them to sign an authorization because the insurance company was a meanie face trying to screw them out of their money and I would explain "No, ma'am, we need this to comply with federal law. Please and thank you." and they would be all chagrined and get me the auth, at long last.

But I only see App Store guidelines cited, not federal legislation. So the odds are good that someone in the company has the power to overrule that.

Given the circumstances, it seems to me this would be an appropriate time for an executive to say "Yea, verily, fuck them there guidelines. Let this person do this thing."

And if they don't want to or can't do that, it would be a good time for someone to hand walk it through the process and get it hooked up post haste with whatever doohickey would make everyone all happy.

It’s a crisis. This kind of thinking is what led the FDA to delay coronavirus testing authorization in the US by a couple months.

Any set of regulations needs a crisis mode.

There is nothing wrong with Apple having some standards for the app store.

I have had HIPAA training. TLDR:

"Certain other people, like doctors and insurance companies, need to comply with strict rules surrounding your privacy when handling your health data. You, on the other hand, can do any fucking thing you want with your personal health data. Sign here in triplicate to assign this right to others. Have a nice day."

(I might be making up the triplicate thing for dramatic effect. It might only be duplicate. shrug)

In most countries it takes way more ethics work than “you installed the app yourself” to get a human study approved.

It’s not unreasonable for Apple to demand similar steps.

It's not unreasonable in normal times for normal situations.

Last I checked, "ethics" were supposed to protect life, not uphold some arbitrary abstract standard while people died by the raft loads.

But pay me no mind. I learned my ethics from military culture which deals with life and death routinely. So I might have some weird ideas about upholding the value of life as sacred or something.

I believe research is one of the most beneficial human activities.

But for some reason as a society we will let people sky dive, horseback ride, smoke cigarettes, or get raging drunk for any reason, but if it's for research we won't let subjects consent to even the risk of filling out a survey without IRB approval.

I'm sorry but what then? We'll have 200 corona tracking apps backed by random people, with no ties to efforts that actually do something useful, no scientific review of efficacy and potentially a non zero number of apps that are either malicious or misuse the data later on.

It's not like we don't have precedent with the latter at this point. Apple's stance doesn't really seem that unreasonable here.

Who would that help?

Reply on news.ycombinator.com