Pitfall 1: Forgetting to Disclose Active Task and Sensor Data
ResearchKit's active tasks (gait, memory tests, voice) and sensor integrations generate behavioral and biometric data *beyond* survey responses. Developers often mention "surveys" in privacy policies but omit motion data, microphone access, or camera usage.
Why it happens: ResearchKit abstracts these data streams; they are not explicitly instantiated in app code the way HealthKit calls are. Developers assume users understand "research data" generically.
Consequence: GDPR non-compliance (incomplete Article 13 disclosures), CCPA/CPRA violations (failure to list "motion sensor" or "voice" as collected data), and loss of informed consent—invalidating the study legally and ethically.
Pitfall 2: Storing ResearchKit Data Without Encryption or Access Controls
Many indie founders self-host ResearchKit data (which is permitted) but do not implement TLS in transit or AES-256 encryption at rest, nor do they audit database access.
Why it happens: ResearchKit does not enforce storage; the burden falls entirely on the app operator. Developers prioritize feature velocity and assume a small user base means low risk.
Consequence: HIPAA breach (45 CFR § 164.404 requires breach notification and OCR investigation), GDPR Article 32 violation (inadequate security measures), state health privacy fines (e.g., Massachusetts 201 CMR 17.00 requires encryption), and potential civil liability if user data is compromised.
Pitfall 3: Missing or Vague Data Retention and Deletion Policies
ResearchKit apps often do not specify how long survey responses, consent signatures, and sensor data will be retained, or whether users can request deletion.
Why it happens: Research studies traditionally keep data indefinitely for secondary analysis. GDPR and CPRA introduce rights (Article 17, CPRA § 1798.105) that conflict with this practice.
Consequence: GDPR "right to erasure" violations, CPRA violation of the "right to delete," IRB protocol violations if retention terms change post-launch, and regulatory investigations (DPAs will flag absence of deletion policies as a red flag).
