Vaccine records on your phone: the privacy questions worth asking
A digital record is handy. A cloud account is a choice. What to ask before you put a child's immunization history in any app.
You are in the App Store at 10 p.m. The camp form is due Friday. A colorful tracker promises "all your family's shots in one place." The screenshots look clean. The privacy policy is four thousand words. Your thumb hovers over Get, then you close the store.
That pause is the right instinct. A phone record is useful. Putting a child's immunization history into someone else's computer is a choice, not a default.
A phone is not the same as a clinic portal
A pediatric portal holds records because the clinic already gave the shots. You log in as a patient. The practice is a covered clinic with its own rules. That is not automatically safer in every way — portals get breached too — but it is a medical relationship you already have.
A third-party app is different. You are handing dates, names, and often dates of birth to a company that did not vaccinate anyone. They may store the file, train a product on it, sell "insights," or show ads next to a toddler's HepB line. Or they may do none of that. You cannot tell from an icon.
The CDC's pages on immunization records tell parents to keep a copy. They do not tell you to create an account with a startup to do it.
A household list still makes sense. Why records scatter is a systems problem. The privacy question is where that list lives.
Four questions before you tap Get
Ask these out loud. If the app's site cannot answer them in plain English, that is an answer.
Does it need an account? An email and password usually mean a server, a password-reset database, and a company that can be sold. A tool that works after you install it, without signing up, is a different design.
Does it upload to a server you do not control? "Backed up to the cloud" is convenient until you want the file gone. Local storage on the phone is narrower. Sync across devices is wider. Wider is not evil. It is a larger room with more doors.
Are there ads — and what do they use? An ad next to a grocery list is one thing. An ad next to a child's vaccine dates is another. Ask whether vaccination data is shared with an ad network. "We take privacy seriously" is not an answer.
Can you export a file you own? If you cannot leave with a readable copy, you are renting your own history. What a real export should mean is the test of whether the app works for you or the other way around.
If any answer is a shrug, keep a paper binder and a folder on a device you already own.
What "local" actually means
Local-first means the record lives on the phone first, and anything that leaves does so because you sent it. It does not mean "a pretty interface with a tiny footnote about analytics."
It also does not mean immortal. Phones break, get replaced, and fall in lakes. A local record without a copy you control is a single point of failure. Export to a file you keep, or keep the clinic printout in a drawer. Privacy and backup are both part of care.
Do not confuse a photo album with a record. Camera rolls sync to accounts you forgot you enabled. A picture of a card in a shared family album may already be on someone else's phone and in a cloud you cannot name.
Ads, store labels, and honesty
Health data should never be the product. If an app is free, ask how it is paid for. Subscriptions are obvious. Advertising can be limited to a device identifier and stay away from your vaccine file — or it can be a tracking stack with a wellness skin.
Read the store's privacy labels. They are incomplete, but a listing that claims "data not collected" while the app has an account and a crash reporter is a story that does not add up.
You do not need to become a lawyer. You need to refuse the combination "child's medical dates + mystery server + ads."
Vaxnext is one on-phone family record that does not require an account and does not share health data with advertisers. It is an answer to the questions above, not a reason to skip them.
Keep the official paper anyway
A private phone list is for you. Schools, camps, and some borders still want a clinic or registry printout. Your app will not replace that, and it should not pretend to.
Use the phone to notice a gap. Use official paper to prove a date. That split is the same one in keeping the whole family in one place: the household copy is the index, not the submission.
If you already typed dates into an app you no longer trust, export what you can, save the file, then delete the account through the company's published process. Do not assume "delete app" deletes their server.
The Get button will still be there tomorrow. The questions fit on a note. Ask them before a child's history becomes someone else's dataset.
Not medical advice. This article is general information based on public U.S. CDC pages. It does not replace a clinician. Schedules and country entry rules change — confirm the current official page and your own situation before you act.