IBS data is special data. Bristol type, pain scale, stool frequency, and trigger notes fall under Art. 9 GDPR (health data) — a category with stricter rules than an address or date of birth. Anyone installing an IBS app is voluntarily uploading a particularly sensitive data category to third-party infrastructure. This article lays out the questions to ask before installation — and why most apps don't answer them cleanly.
Why IBS entries fall under Art. 9 GDPR
Art. 9(1) GDPR forbids processing of "special categories of personal data" — health data is explicitly listed. Art. 4(15) defines health data as data "which relate to the physical or mental health of a natural person". A Bristol-type-6 entry on a Tuesday evening qualifies; an IBS-SSS score of 280 does too; an entry "bloating 7/10 after onion" also counts.
Consequence: an IBS app may only process this data with a specific legal basis — in practice Art. 9(2)(a) (explicit consent) or, for medical devices, (h) (health care). "I accepted the ToS" is not enough. Consent must be explicit, informed, and revocable at any time. An app that doesn't clearly set out what happens with the data structurally violates GDPR.
Ten questions to ask every IBS app
The following ten questions can usually be answered in 5 minutes from a good privacy policy. If an app leaves more than three of them unanswered, that's a red flag.
- Who is the controller? Company name, legal form, seat, registry court, HRB number, VAT ID — required by Art. 13 GDPR.
- Where are the servers? EU, EEA, USA, worldwide? Which country specifically (not just "in the cloud")?
- Which processors are used? Hosting, database, analytics, push notifications, email delivery — each category with company, location, legal basis for third-country transfer.
- Which legal basis applies to which data? Art. 6 (general) vs. Art. 9 (health data) — must be listed separately.
- Which trackers / SDKs are running? Google Analytics, Facebook SDK, Firebase Crashlytics, Hotjar, Mixpanel, Braze, Adjust, AppsFlyer — especially common in mobile apps.
- Is data shared with third parties? Advertising, research partners, sale to data brokers — and if so, what consent is required.
- Is AI trained on your data? IBS entries are formally suitable for medical AI models. The app must disclose whether your data may be used for that.
- How long is data stored? Concrete periods, not "as long as necessary". What happens on account deletion and when.
- How can you exercise your rights? Art. 15–22 GDPR (access, rectification, erasure, restriction, portability, objection) — with a concrete email address or in-app self-service.
- Who is your supervisory authority? In Germany for private persons: the data-protection supervisor of your federal state; for federal bodies, the BfDI.
Five common privacy traps in health apps
- "Cloud" without a country. "We store securely in the cloud" is not a GDPR-compliant statement. The concrete server location is mandatory. Signal of the app's disinterest in transparency.
- Google Analytics without IP anonymisation. GA4 in default configuration transmits user IDs to Google Ireland + USA. For health data this is a major issue; many apps either don't know or ignore it.
- Facebook SDK in mobile apps. Your IBS tracking becomes available for Facebook ad targeting the moment the SDK runs — even without a Facebook account. In the privacy notice this often appears harmlessly as "social sharing".
- Opaque AI use. "We use artificial intelligence to detect patterns" without disclosing whether training data flows away. Especially relevant for "AI-powered" health apps.
- No self-service data deletion. The app requires an email request instead of offering an "Delete account" button. Friction = fewer exercised rights. GDPR Art. 17 requires easy exercise.
EU hosting vs. US cloud: why it matters
GDPR-compliant third-country transfers to the USA have run since 2023 under the EU-US Data Privacy Framework (EU-US DPF) and, for non-DPF-certified providers, under Standard Contractual Clauses (SCC) per Art. 46 GDPR. Both are legally permitted but carry higher risk and effort — and Schrems II (CJEU 2020, Schrems III potentially around the corner) makes clear that US agency access under FISA 702 remains an unresolved problem.
For health data the practical conclusion: if you have a choice between an app with EU hosting (Germany, Ireland, Netherlands — e.g. Hetzner, IONOS, Scaleway, OVH, Supabase EU) and one with US hosting (AWS us-east-1, Google Cloud us-central1), the EU option is structurally the lower risk. Neither "we use SCC" nor "our data is encrypted" makes US hosting data-protection equivalent — encryption protects against the cloud provider, not against government requests.
Cookie banners and TTDSG §25 — when do you need one?
Since TTDSG § 25 (2022), consent is required for any non-technically-necessary information stored on the end device. Consequence for IBS apps:
- Auth session cookie, language, UI preferences — technically necessary (§ 25(2) no. 2). No banner required.
- Analytics, tracking pixels, advertising cookies — require consent. Without active agreement (no dark pattern, no pre-selection) not allowed.
- Local storage for app state — technically necessary as long as it only supports functionality.
An IBS app that runs completely without trackers or ads doesn't need a cookie banner — only a privacy notice naming the technically necessary cookies. Details in our privacy policy, which explicitly invokes § 25(2) no. 2.
How DarmKompass handles your data
Transparent clarification so you can measure us by the same questions:
- Server location: Supabase in the EU (Ireland + Germany) — no US cloud. Details in our privacy policy.
- Processors: Supabase (hosting), Cloudflare (edge proxy, DPF-certified), Google Ireland (optional sign-in), webgo (email) — all with Art. 28 GDPR processing agreements.
- Trackers: none. No Google Analytics, no Meta Pixel, no Hotjar, no Braze, no mobile SDK framework for tracking. Aggregate statistics via self-hosted Plausible without personal references.
- AI training: your data is not used for AI model training. No third party receives aggregated data for research or advertising purposes.
- Account deletion: in-app under "Settings → Data" — 1 click, complete deletion, no questions. CSV export possible before deletion.
- Supervisory authority: Bavarian State Office for Data Protection Supervision (BayLDA), Ansbach.
This is not self-praise — it's the minimum that follows from the rules. Any app that can give similar answers is a valid choice. The article openly compares us with five others under IBS apps compared.