WHAT THE POLICIES SAY

CommonHealth is an Android app, published by The Commons Project Foundation (TCP), a 501(c)(3) nonprofit (EIN 83-3933549), that lets U.S. users pull their electronic health records from participating providers and store them on-device. TCP's App Privacy Policy (last updated August 2, 2024) states health records download over an encrypted connection directly from the provider to the user's device without passing through TCP's own systems, that Health Data stored in the app is not accessible to TCP, and that TCP only shares Health Data with third-party apps a user affirmatively chooses to connect. The consumer-facing app itself is closed source, but TCP publicly publishes the CommonHealth Client SDK that third-party developers use to integrate with it. No breach, regulatory action, or other reported trust-violation record involving CommonHealth or TCP was found in this research.

TIMELINE

NO ENTRIES ON FILE YET.

TOOLS WE RECOMMEND

PLUS

RECEIPTS

7 ON FILE

[2024-08-02] · COLLECTION

CommonHealth's App Privacy Policy (last updated August 2, 2024) states that health records are downloaded over an encrypted connection directly from the user's healthcare provider to the user's device, that this connection does not pass through any of The Commons Project Foundation's own information systems, and that Health Data stored in the app is not accessible to TCP; beyond that, the policy states TCP collects only opt-in, anonymized 'Page View' category counts and automatically collected, anonymized 'Device Analytics' (Android OS version, country/language, device type, and crash data), describing this data as not revealing an individual user's identity, with an in-app option to opt out of crash-data collection specifically.

commonhealth.org ↗

OWNERSHIP TRANSPARENCY

While the consumer-facing CommonHealth app itself is closed source, The Commons Project Foundation publicly publishes the CommonHealth Client SDK's source and sample client code on GitHub under its own organization account, giving third-party developers and researchers visibility into the interface applications use to request access to a user's CommonHealth data.

github.com ↗

OWNERSHIP TRANSPARENCY

ProPublica's Nonprofit Explorer lists Commons Project Foundation as a 501(c)(3) organization based in New York, NY, tax-exempt since March 2020 under EIN 83-3933549, with IRS Form 990 filings publicly available; its most recently indexed filing reported conflict-of-interest transactions disclosed on Schedule L, a standard nonprofit governance disclosure.

projects.propublica.org ↗

[2021-08-31] · SHARING

The Commons Project Foundation's Website Privacy Policy (last updated August 31, 2021) states TCP does not sell, rent, or lease personal data to others, and its California disclosures separately state TCP does not sell personal data as defined by the CCPA, adding that TCP has voluntarily committed to CCPA compliance even though the law does not apply to it as a nonprofit organization.

commonhealth.org ↗

[2024-08-02] · SHARING

CommonHealth's App Privacy Policy states TCP only shares a user's Health Data with third-party apps the user themselves chooses to connect and with any third party the user directs, that Page Views/Device Analytics may be shared only with vendors and service providers who help operate or improve the app, and reiterates that a user's Health Data is stored on-device and TCP cannot access it.

commonhealth.org ↗

TRACK RECORD

CommonHealth's inclusion on Privacy Guides' Health and Wellness recommendations page required passing Privacy Guides' own published minimum requirements for that category — automatic updates, no unencrypted data stored outside the device, and offline functionality — an independent curator's vetting against explicit criteria; no breach, regulatory action, or other reported trust-violation record involving CommonHealth or The Commons Project Foundation was found in this research.

privacyguides.org ↗

[2024-08-02] · TRACKING TECH

CommonHealth's App Privacy Policy discloses only first-party 'Page Views' and 'Device Analytics' as data used to operate and improve the app itself, with no third-party advertising or analytics SDK described anywhere in the app-specific policy — narrower than TCP's separate website privacy policy, which discloses third-party Squarespace-based analytics cookies, but only for the marketing website, not the CommonHealth app.

commonhealth.org ↗

DATA SOURCES

Privacy Guides (www.privacyguides.org)

CC BY-SA · PRIVACYGUIDES.ORG ↗

Claims are summarized from these sources and may be edited from the original. Text adapted from a CC BY-SA source is shared under CC BY-SA.

LAST REVIEWED 2026-08-27 · METHODOLOGY v1.7