This research aimed to explore ethical considerations for translating CP technologies into clinical care. Through in-depth, semistructured interviews, we explored perspectives on benefits, risks, and concerns around the integration of CP technologies, which also involved a supplementary exploration of specific concerns around privacy, data security, and perspectives toward the use and exchange of CP data.

As part of a multisite study funded by the National Center for Advancing Translational Sciences (R01TR004243), we recruited 40 participants between January 2023 and August 2023. Participants were recruited from a sister research study (R01MH125958) conducted within a clinical research setting, focused on validating CP tools designed to quantify objective digital biobehavioral markers of socioemotional functioning. Participants in our sister study were recruited from a clinical care setting in a large academic medical center using word of mouth. As part of that study, CP data were collected in a laboratory setting for research purposes with the stated goal of informing future clinical applications. As such, participant perspectives reflect experiences situated at the boundary of research and clinical care. Our choice to recruit from this sister study was also to ensure familiarity with and exposure to the collection of CP data, to enhance the ecological validity of our findings. Participants included adolescents (n=20) aged 12‐17 years and their caregivers (typically biological parents, see Table 1). The adolescents had previously received neurodevelopmental (ie, autism) and/or psychiatric diagnoses of autism, anxiety, or depression and potentially diagnoses that often accompany these (eg, attention deficit/hyperactivity disorder or obsessive compulsive disorder). Diagnostic presentations for all adolescents were confirmed through the administration of standardized clinician interviews. Participants were told about this study by a research coordinator from our sister study. Individuals who expressed interest in participating were referred to this study by the sister study’s coordinator and then contacted by a research assistant (RA) via phone or email to schedule a virtual interview. Our response rate was approximately 63% for patients and caregivers (63 people were contacted and 40 people agreed to participate).

We developed separate interview guides for adolescents and their caregivers (Multimedia Appendices 1 and 2), exploring the same constructs across both groups with appropriate variations in wording. Guides were informed by prior work exploring user perspectives in data privacy and governance [14,15,17,19,20,22,27,29-38] and with the guidance of experienced bioethicists, child mental health experts, and computational scientists who develop these algorithms. Constructs included data security and privacy issues, regarding perceived sensitivity of this type of data and data collection, beliefs about the potential for unintended uses and current data protections, thoughts on secondary usage of their data and access authorization, and transparency needs or preferences of their personal data and its transactions or security processes. Initial drafts of the interview guides were piloted with two psychologists specializing in adolescent mental health, resulting in minor clarifications in wording. Interviews were conducted by RAs (authors CD, AS, and MEH) with extensive training in qualitative interviewing and analysis. Interviews were held via a secure videoconferencing platform (Zoom for Healthcare [Zoom Communications, Inc]) and lasted an average of ≈45 minutes. Before beginning the interview, each participant was presented with a 7-minute primer video (Multimedia Appendix 3) explaining the nature and intended use of CP data in clinical research and health care (ie, a basic, 8th grade-level understanding of how CP technologies collect and analyze data and how they might be used during a clinical encounter), including the different types of CP technologies available and the types of data they collect (eg, different types of wearables, smart devices, and sensors that stakeholders would likely be familiar with and that can collect vocal, facial, accelerometry, GPS, heart rate data, and more). The primer video was developed to ensure informed responses from patients and caregivers who are likely to be less familiar with this suite of technologies. Additionally, the RA stopped the video at key predesignated intervals (eg, after the original explanation of how CP collects and analyzes patient data, after providing an example of what the integration of these tools into a traditional clinical assessment could look like, etc) to assess understanding and elicit clarifying questions from participants to ensure comprehension. Recruitment continued until we observed significantly diminished novel informational returns from each subsequent interview (“saturation”). Operationally, research team members reviewed transcripts to identify novel insights not present in prior interviews. Saturation was determined when successive interviews within a stakeholder group yielded no new insights, which occurred in around 20 interviews per stakeholder group.

This study was reviewed and approved by the Baylor College of Medicine Institutional Review Board (H-52233), which also waived a requirement for written consent due to research procedures involving minimal risk to participating stakeholders; thus, participants provided verbal consent. Minors provided assent with parental consent. Identifying participant information was stored in a password-protected system with 2-factor authentication behind a university firewall. All results are reported in the aggregate and are not linked to identifiable participants. Each participant received a US $50 gift card as compensation for their time.

Interviews were audio-recorded, transcribed verbatim, and analyzed using MAXQDA (VERBI GmbH) software. Led by a qualitative methods expert, team members developed a qualitative codebook to identify and label thematic patterns in adolescent and caregiver responses to questions addressing the topics above. Codebook development followed a hybrid inductive–deductive approach. We formed an initial set of broad analytic domains informed by prior literature on digital health ethics, data governance, trust, privacy, and informed consent [19,23-27,29-38], which served as sensitizing concepts rather than fixed categories. Within these domains, codes were developed inductively through our familiarity with the interview content (all team members listened to all interview recordings) and a close review of a subset of transcripts to capture emergent concepts. Codes and definitions were iteratively refined in collaborative team meetings, and subsequently used to identify patterns in the data using thematic analysis [49]. Specifically, outputs for each code were further analyzed by progressively abstracting relevant quotes, an inductive process that entails reading every quotation to which a given code was attributed, paraphrasing each quotation (primary abstraction), and further identifying which constructs were addressed by each quotation (secondary abstraction). These constructs mapped onto a core set of thematic findings across four emergent domains (see Figure 1). Each of the concepts in these four domains was further categorized along a scale of “high,” “medium,” or “low” (eg, “high” need for transparency) to examine relationships between beliefs and perspectives, informational needs and preferences, and trust. These designations reflect consensus-based qualitative judgments by the research team, grounded in close analysis of coded excerpts, rather than participant ratings or a formal scale. Each interview was coded by merging work from at least two separate coders to reduce interpretability bias and enhance reliability. To ensure the validity of our findings, all abstractions were validated by at least one other member of the research team before calculating thematic frequencies to characterize stakeholders’ responses and obtain a sense of the proportion of stakeholders raising or discussing each concern/theme. In rare cases where abstractions reflected conflicting interpretations, members of our research team met to reach consensus. Frequencies were used as a descriptive aid to convey the relative salience of perspectives across participants, consistent with pattern-based thematic analysis, and were not intended to suggest statistical significance or quantitative generalizability [49]. Frequencies account for participants who expressed perspectives that were ambiguous or context-dependent (eg, perceiving CP data to be highly sensitive in some situations but not in others) and were calculated when respondents expressed views across the high, moderate, and low categories. Frequencies and percentages reflect only reported information and therefore do not always sum to 100%, as some respondents did not express perspectives across all themes.

The results are organized around four analytic domains identified through thematic analysis of transcripts from 20 adolescents and 20 caregivers (total N=40; see Table 1). These domains include the following: (1) perceived sensitivity of CP data; (2) trust in existing data protections; (3) willingness to share data externally and desire for privacy; and (4) transparency of data practices (see Table 2). Within each domain, we describe the range of perspectives expressed by participants and use qualitative descriptors (eg, high, moderate, and low) to summarize relative emphasis and salience, illustrated with representative quotations (eg, higher to lower perceived sensitivity and higher to lower trust in existing data protections). Frequencies and percentages of expressed views across these domains are presented in Table 2, intended to aid interpretive comparison between and across groups. Taken together, our results indicate that most caregivers and adolescents view CP data as moderately to highly sensitive, are reluctant to share these data beyond their clinical teams, and expressed a desire to have visibility into or control over both primary and secondary uses of their data. Notably, adolescents expressed higher trust in existing data protections compared to caregivers. Most caregivers shared that they were less willing to share data externally compared to adolescents. The following sections elaborate on and summarize these findings, complemented by illustrative quotes.

Most participants (15 adolescents and 14 caregivers) perceived CP data to be highly sensitive. Participants commonly understood CP data as revealing intimate aspects of identity, emotion, and daily life, leading many to view continuous monitoring as intrusive even when collected for clinical purposes. Some characterized it as an “invasion of privacy” (A16) because such data capture the “emotions and feelings of a person” (A16) or “who you are on the inside” (CG03; see Table 3). Some caregivers characterized continuous monitoring as “unnerving” (CG08) or “debilitating” (CG03), or likened it to “big brother” surveillance (CG19). More than half of all participants expressed a desire to pause or disable monitoring during moments they considered private. These moments included private conversations, conflicts with family members, funerals, intimate situations, or emotionally vulnerable situations. Both stakeholder groups expressed a view that the potential negative impacts of collecting CP data may be especially pronounced in the context of physical and socioemotional changes associated with adolescence (eg, “where it would affect [their] self-image” CG07).

By contrast, a smaller number of participants (5 adolescents and 1 caregiver) viewed CP data as less sensitive, with one adolescent stating that it felt “sort of like wearing a Fitbit” (A07), particularly when perceived clinical benefits were salient (as noted by 6 adolescents and 9 caregivers).

Some stakeholders (3 adolescents and 5 caregivers) expressed ambivalence. For example, one caregiver shared that while the data itself did not seem invasive, since “our watches collect and our phones collect this kind of stuff all the time” (CG01), they would nevertheless be bothered if the data were shared with third parties (eg, insurance companies and future employers) without their knowledge (see also Willingness to Share CP Data section below).

Most participants (14 adolescents and 14 caregivers) expressed moderate to high trust in existing data protections governing CP data (see Table 4). This trust was largely grounded in confidence in clinicians and health care institutions, often accompanied by assumptions that CP data are protected under established health privacy laws. Several adolescents stated they had no concerns about CP data being shared beyond their doctor (eg, A11 and A13), while others emphasized that clinicians “are there to help you” and therefore could be trusted with sensitive data (A16). Some caregivers explicitly assumed that CP data were protected under HIPAA, stating that they “would expect the same type of privacy laws to apply” (CG03). This subset expressed more cautious trust, noting that while they had “no major concerns,” they still wanted reassurance that data protections were “following HIPAA” (CG05). Notably, no respondents expressed low or no trust in existing data protections.

Most participants were reluctant to share CP data beyond their immediate clinical teams. Reluctance to share reflected concerns about privacy, loss of control, and potential misuse of data, particularly among caregivers responsible for their children’s information. Participants frequently emphasized ownership and control, with one adolescent stating, “It’s my information, keep it that way” (A05). Caregivers expressed near-universal hesitancy about external sharing, particularly with commercial entities. Notably, twice as many caregivers (n=18, 90%) expressed this reluctance as adolescents (n=9, 45%) (Table 2). Their rationales (see Table 5) centered around a common view of these data as invasive and sensitive. At the same time, some participants expressed ambivalence or conditional willingness, acknowledging that CP data could be “helpful” (A16) or valuable for research while simultaneously asserting that such data “should be mine and my doctor’s, and that’s it” (A07). Some adolescents and caregivers stated a preference to be able to vet or control what information their doctors could access. A small number expressed resignation or apathy, suggesting that data sharing “does not make much difference” given the broader data ecosystem (A02).

Most participants expressed a desire for greater transparency regarding how CP data are collected, used, and shared. Transparency was valued as a means of maintaining trust and agency, though participants varied in whether transparency alone was sufficient without accompanying control. Participants (6 adolescents and 6 caregivers) sought clarity about what data were collected and when, asking “what information it’s gathering, when it’s gathering it, what it’s tracking” (CG07; see Table 6). Others focused on secondary use, questioning “Where is this going? Who are you sharing it with? What are we doing with this information?” (CG04). Some participants (8 adolescents and 7 caregivers) emphasized the importance of knowing how access was authorized, asking, “Who authorizes that sharing?” CG15; “How is it controlled? What happens if somebody who isn’t supposed to see it, [sees it]?” A16), and how transactions will be tracked (“How are you going to document?” CG11).

Additionally, participants (6 caregivers and 2 adolescents) also desired reassurance through transparency of data security processes. For example, specific reassurances included wanting transparency around “how they were going to protect the information” (CG17), along with “how safe and secure the information is” (CG10) and also “some assurance [that] it’s no longer collecting data” when it is physically turned off (CG17). Other participants (3 caregivers and 3 adolescents) shared that they would feel “weirded out” (A07), “upset” (CG09), “disappointed” (CG16), “angry” (CG07), and “violated” (A16) if shown transactions with their data that they did not explicitly consent to.

Other participants (n=4) expressed that transparency without the ability to intervene would be frustrating or distressing, noting they would “rather not know” if no action were possible (A03). As one caregiver put it, “I don’t think there’s any point… when you know something [that] you can’t do anything about” (CG03). Another adolescent participant reasoned that “[they’d] rather not know about it” if they could not act on the knowledge (A03).

A majority of adolescents and caregivers view CP data, that is, data collected through wearable digital sensors, as sensitive information, characterizing clinical assessments using CP as “invasive” (a term used by multiple participants). Many felt that such data could enable insights into patients’ emotions and overall well-being. This is, of course, the clinical rationale for collecting these data; however, many respondents expressed privacy concerns, particularly around the potential for stigma or discrimination in cases of unintended or unwanted disclosure, given that participation was connected to their mental health condition. Some respondents stated that CP data thus deserve as much as or greater protection than other personal health data, which should be kept private and deidentified before sharing, as previous studies have found. Consistent with other research findings [50-52], participants from our study said they would feel distressed upon discovering that their data were being used in ways they did not explicitly consent to, especially for commercial purposes. Their concerns are broadly echoed in the literature around CP technologies [53-55], as well as for nonhealth-related data [31,56-59].

Importantly, however, most participants believe that CP data already receives high levels of protection and security. Many stated they highly trust their clinicians and hospitals to protect CP data once collected and expressed confidence that CP data fall under HIPAA protections as with other medical information. Others said they would seek “reassurance” that this is the case, revealing that they consider HIPAA protection to be the default. Respondents were generally unaware that many, if not most, forms of CP data are not classified as protected health information (PHI). CP data often falls outside traditional health privacy protections for two reasons. First, many tools are developed by companies that are not covered health care entities under HIPAA. The data generated by these technology products is instead subject to other data protection laws at the federal level (eg, Gramm-Leach-Bliley Act, Federal Trade Commission Act, and Family Educational Rights and Privacy Act) and state level (eg, California Consumer Privacy Act, California Privacy Rights Act, and Virginia Consumer Data Protection Act). However, critics [60,61] have characterized these as a “patchwork” of data protections that are too specific to certain data types or entities or contain various loopholes that create data protection gaps for citizens, especially for consumer-facing health apps and wearables.

Second, many of these data types (eg, GPS, accelerometry, call logs, message logs, or content) are not directly related to a patient’s health or diagnostic status, even if they may in some cases be collected in service of clinical objectives. As other scholars [18] have noted, these forms of NTH data occupy an ambiguous or gray area in health data protections, even more so when they are uncoupled from the 18 identifiers that define HIPAA-protected PHI, as HIPAA does not cover deidentified information. This gap in legal protections for deidentified data becomes increasingly problematic as the ability to reidentify data grows, or when certain types of data, such as facial expressions and voice, are increasingly hard to deidentify. These concerns around privacy have been widely debated in the context of insurance, genomics, and other domains of data governance [62]. A burgeoning industry devoted to reidentifying personal data using machine learning technologies (eg, for marketing purposes or other forms of profiling) increasingly enables unwanted disclosure of personal data. The potential for reidentification is especially high for NTH that is subject to data exchange decisions that are outside of patients’ (and even many physicians’ and researchers’) control.

An important takeaway from our findings in this context is that most patients and caregivers erroneously believe that HIPAA protections guard them from unwanted disclosure of their PHI and may not recognize the limitations of existing data protection frameworks [63]. Importantly, participants rarely differentiated between research and clinical data-sharing frameworks, despite these contexts being governed by different standards for consent, oversight, and commercial use. This lack of differentiation reflects the reality that CP data are often collected and reused across translational pipelines in ways that obscure whether data are governed by research ethics approvals, clinical privacy regimes, or commercial data practices. This ambiguity contributes to epistemic vulnerability and complicates their ability to make informed decisions about whether to consent to the use of CP technologies in clinical care or research. When individuals later learn that protections are weaker or more fragmented than assumed, this mismatch can undermine trust, reduce willingness to share data, and negatively affect adoption and sustained engagement. These findings echo broader public concerns about digital privacy beyond health care, where individuals often misunderstand the extent of their data protections [64-66]. Similar trends exist in consumer data ecosystems, particularly in digital marketing, where data collection occurs without explicit user awareness [30]. To bridge the gap between perceived and actual protections, it is critical to educate individuals about the limitations of data protections across these domains and the circumstances under which their data may be used without their consent. Education can help to promote greater reflection about potential threats to the security and privacy of the information that individuals agree to have collected and managed. The use of decision aids and other decision support approaches (eg, shared decision making) offers frameworks to ensure patients and caregivers receive sufficient risk/benefit information to engage in informed consent. However, as we discuss below (see “Clearly Communicating (and Knowing) Risk”), certain factors limit the efficacy of education as a primary approach to achieving informed consent.

Given these uncertainties, it remains unclear how clinicians and researchers should proceed with informed consent. On the one hand, they are ethically obligated to communicate risks associated with the use of CP in research or care, but they themselves lack sufficient insights into these risks. Further, they must be careful not to over- or understate risks, balancing awareness against the potential to affect individuals’ willingness to participate in research or integrate technologies that may ultimately benefit patients. Greater visibility into the nature and extent of transactions may only partially solve the problem of informed consent, as it may lead to distress if accompanied by opportunities for intervention or control. However, data controllers (ranging from researchers, institutions, companies, and data brokers) currently have little incentive to offer such control if legal mandates are not in place (and there is no indication they will be anytime soon). A key arena to watch for developments around such mandates is the newly created federal Trusted Exchange Framework and Common Agreement (TEFCA; 2024), which aims to facilitate nationwide, query-based data sharing and to improve patient access to health information as mandated by the 21st Century Cures Act (2016) [75]. Mandel et al [76] recently argued that three principles should be put in place by the time TEFCA launches, including that patients can (1) query for data about themselves, (2) know when their data are queried and shared, and (3) configure what is shared about them. TEFCA launched in 2024, and so far, while it does appear to support patient access to their own health information, TEFCA does neither specifically mandate that patients be notified each time their data are queried or shared, nor do all constituent health information networks offer the capacity for patient-configurable data-sharing controls. Research to identify and validate procedures and technologies that may provide the necessary infrastructure for such controls should be prioritized at the federal level to evolve alongside emerging data privacy legislation.

This study has several limitations. First, our qualitative sample was drawn from adolescents and caregivers already enrolled in a research study embedded within a clinical research setting. Participants may thus have higher baseline trust in clinicians and institutions than individuals engaging with direct-to-consumer digital health tools, potentially limiting generalizability to other populations or contexts. Second, participants’ perspectives reflect experiences at the intersection of research and clinical care; while this overlap is increasingly common for CP technologies, findings may not fully capture attitudes in purely clinical or purely commercial settings. Third, although the primer video was designed to ensure a shared baseline understanding of CP technologies, it may have influenced participants’ framing of risks and benefits. Finally, as with all qualitative research, our findings are not intended to quantify prevalence or establish causal relationships, but rather to identify salient themes and ethical concerns that warrant further empirical investigation.

Our findings highlight the need for clearer communication, stronger data governance, and consent models that better reflect how digital health data are used in practice. These data hold strong potential to provide ecologically valid insights into patients’ health conditions beyond the clinic, but also pose significant privacy risks that remain understudied. While clinicians and researchers have a unique responsibility to safeguard participant and patient data, they cannot effectively do so without a better understanding about the nature and extent of these risks or how to effectively mitigate them. To promote greater visibility, understanding, and trust (when justified) in digital tools that have strong promise to promote patient health, we advocate for five key strategies, including: (1) educating patients on the limitations of existing data protections; (2) conducting targeted research, including forensic analyses, into secondary data exchanges and identifying privacy breaches or reidentification risks; (3) enacting regulations that mandate greater transparency in health data transactions; (4) implementing computational mechanisms, such as distributed ledger technologies, to enhance data traceability and auditability; and (5) adopting dynamic consent models that allow patients to continuously manage and update their consent preferences. These strategies may help to better balance the promise of CP technologies and insights from wearables and mHealth apps with the ethical imperative to protect patient privacy, fostering greater trust and responsible innovation in digital health care.