Data Privacy, Ownership, and Secondary Use of Clinical Data Generated by Continuous Glucose Monitors and Mobile Health Applications: A Review.

The growing use of continuous glucose monitors (CGMs) and mobile health (mHealth) applications has changed how diabetes is managed, allowing real-time tracking of glycemic patterns and remote clinical decision-making. These technologies also generate large volumes of sensitive health data, raising questions about who owns this information, how it is protected, and under what conditions it may be repurposed for research or commercial objectives. This review examines the regulatory frameworks governing CGM and mHealth data in major jurisdictions, with particular attention to the Health Insurance Portability and Accountability Act (HIPAA) in the United States and the General Data Protection Regulation (GDPR) in the European Union. Significant regulatory gaps exist, particularly for consumer-grade devices and direct-to-consumer mHealth applications that fall outside traditional healthcare data-protection frameworks. Data ownership remains legally ambiguous in most jurisdictions, with patients, healthcare providers, device manufacturers, and app developers each holding competing claims. The secondary use of clinical data for research, while it could materially advance diabetes care, raises ethical concerns around informed consent, data de-identification, and the boundaries between clinical care and commercial exploitation. Emerging approaches, including the European Health Data Space, federated learning, and differential privacy, may help balance data utility with individual rights. The review recommends changes to regulation, industry practice, and consent models aimed at reconciling data-driven diabetes research with patient autonomy and privacy.