Analytics anonymisation is the removal of personal detail from the usage stream a health app records. Regulation 6 of PECR requires consent before an app stores or reads an analytics identifier on the user's phone, and there is no legitimate-interests route around it. Once the stream is genuinely anonymous it is no longer personal data, per UK GDPR Recital 26. An app sold into the NHS is also assessed against the NHS England Digital Technology Assessment Criteria, published in February 2021. anonym.plus does the work on your device.
When this applies
These streams track who tapped what, tied to a user identifier, an email, and an IP address. Funnel analysis needs the behaviour, not the people. Removing the handles also shortens the data protection answers a DTAC review asks for.
How anonym.plus handles it
- Open the usage dump in anonym.plus on a local device.
- It finds user identifiers, emails, IPs, and device handles.
- Screen names and action types stay in place.
- Swap the personal fields with the map switched off.
- Save the anonymous file on your machine.
What you need to provide
- The usage dump (CSV, JSON, or NDJSON).
- Replace with the re-link map off for anonymity.
- Optional column map for user and session fields.
Patient data entity types detected
| Category | anonym.plus entity type | Example |
|---|---|---|
| Identifiers | ID | user_id → [USER] |
| Contact | EMAIL_ADDRESS | profile email → [EMAIL] |
| Network | IP_ADDRESS | 198.51.100.9 → [IP] |
| Identifiers | ID | device handle → [DEVICE] |
| Dates | DATE_TIME | action time → [TIME] |
| Location | LOCATION | geo region → [PLACE] |
Compliance achieved
- True anonymity puts the records outside scope by UK GDPR Recital 26.
- Analytics identifiers written to the handset need consent under regulation 6 of PECR.
- Keeping a re-link key leaves the file pseudonymous and in scope under UK GDPR Art. 4(5).
- Supports the data protection section of the NHS England Digital Technology Assessment Criteria (DTAC), published February 2021.
- Where the events reveal a condition, they are also special category data under UK GDPR Art. 9(1).
- On-device processing keeps the stream in the UK with no onward transfer.
Anonymise health app analytics offline — see plans & start free →
Limitations & cautions
A usage trail can be unique with no name attached, because a rare path through the app fingerprints one person. Coarsen the timestamps and the region, and keep no re-link key, before you treat the output as anonymous under the ICO motivated-intruder test.
Frequently asked questions
Do I need consent for analytics inside a health app?
For the storage step, generally yes. Regulation 6 of PECR requires consent before an app or site stores information on a user's device or reads it back, and only strictly necessary storage is exempt. Analytics is not strictly necessary, so PECR sets the bar here, on top of whatever UK GDPR basis you rely on afterwards.
Is a user identifier personal data if it is only a number?
Yes, while it is stable. A number that follows one person from session to session singles them out, which is the test. Anonymity comes from removing the link, not from removing the name.
Does DTAC apply to every health app?
It applies where the app is being bought or deployed by an NHS or social care organisation. DTAC bundles clinical safety, data protection, technical security, interoperability, and usability into one assessment, so a clean anonymisation story helps with the data protection section rather than the whole review.