  An increasing number of mental health services are offered through mobile
systems, a paradigm called mHealth. Although there is an unprecedented growth
in the adoption of mHealth systems, partly due to the COVID-19 pandemic,
concerns about data privacy risks due to security breaches are also increasing.
Whilst some studies have analyzed mHealth apps from different angles, including
security, there is relatively little evidence for data privacy issues that may
exist in mHealth apps used for mental health services, whose recipients can be
particularly vulnerable. This paper reports an empirical study aimed at
systematically identifying and understanding data privacy incorporated in
mental health apps. We analyzed 27 top-ranked mental health apps from Google
Play Store. Our methodology enabled us to perform an in-depth privacy analysis
of the apps, covering static and dynamic analysis, data sharing behaviour,
server-side tests, privacy impact assessment requests, and privacy policy
evaluation. Furthermore, we mapped the findings to the LINDDUN threat taxonomy,
describing how threats manifest on the studied apps. The findings reveal
important data privacy issues such as unnecessary permissions, insecure
cryptography implementations, and leaks of personal data and credentials in
logs and web requests. There is also a high risk of user profiling as the apps'
development do not provide foolproof mechanisms against linkability,
detectability and identifiability. Data sharing among third parties and
advertisers in the current apps' ecosystem aggravates this situation. Based on
the empirical findings of this study, we provide recommendations to be
considered by different stakeholders of mHealth apps in general and apps
developers in particular. [...]
