Is CVS Health safe to use?

CVS Health integrates 48 third-party SDKs spanning infrastructure, analytics, and media. It collects data linked to your identity including Health & Fitness, Purchases, Financial Info, and Contact Info and 6 more categories. It does not include any advertising or attribution SDKs. Whether this is acceptable depends on your personal privacy preferences.

What permissions does CVS Health need?

CVS Health requests 16 iOS permissions: Camera, Microphone, Photo Library, Location (When In Use), Location (Always), Location (Always & When In Use), Calendars, HealthKit (Read), HealthKit (Write), Speech Recognition, Face ID, Bluetooth, Bluetooth Peripheral, Local Network, Apple Music, and NFC.

How many SDKs does CVS Health have?

CVS Health integrates 48 third-party SDKs. 10 for analytics, 1 for crash reporting, 1 for social integration, 14 for infrastructure, and 12 for other. None are for advertising or attribution.

Does CVS Health use Google SDKs?

Yes. CVS Health includes 2 Google or Firebase SDKs: Google Sign-In and Google Utilities. These are used for cloud infrastructure and services, not advertising.

Does CVS Health access your location?

Yes. CVS Health requests location access. The developer states: "To provide relevant notifications, deliver a more personalized in-store experience, and find pharmacies".

Does CVS Health access your camera or microphone?

CVS Health requests access to both your camera and microphone. The developer says camera access is for "Add an insurance card, use Virtual Care™, scan store items and share photos with Counsel Physicians". Microphone access is for "Microphone access is required in order to use MinuteClinic Virtual Care services". These permissions are only active when you grant them in iOS Settings.

Does CVS Health run in the background?

Yes. CVS Health registers 5 background modes, which means it can perform certain tasks when you're not actively using it.

What are some alternatives to CVS Health?

Other medical apps include 1-800 Contacts , DonorHub , Kardia , Ambetter , Ambra , and athenaPatient . Each app takes a different approach to medical and varies in its data collection and SDK usage.

Medical · Privacy report

CVS Health

Free · ★4.7 · CVS Pharmacy

Is CVS Health safe?

It collects a lot of your data, and shares it with trackers.

Our take. CVS Health carries 10 third-party trackers and its own label declares it links 10 categories of your data to you. It collects a lot itself, and shares a lot with outside companies.

Privacy footprint · vs 82 medicalHeavy

Trackers from other companies10 · a lot

typical medical: 2

Data the app links to you10 types · a lot

typical medical: 5 · from its own privacy label

What it collects about you

CVS Health links 10 categories of your data to you.

From the developer's own App Store privacy label. These are the kinds of data CVS Health ties to your identity.

Health & FitnessPurchasesFinancial InfoContact InfoUser ContentSearch HistoryIdentifiersUsage DataSensitive InfoOther Data

Who else is inside

It carries trackers from 3 companies.

Third-party SDKs found in the app, matched to the company that publishes each. Present in the code; we do not observe what they transmit.

🏢Monitoring SDKAnalytics

Crash and performance monitoring.

SDKs

🏢Other third partiesanalytics

A third-party SDK.

SDKs

🏢Messaging SDKMessaging

Push notification and messaging platform.

SDKs

How it compares

Where it sits among medical.

Every one of these apps we have scanned, on the two measures above: third-party trackers it carries (across) and data it links to you on its own label (up). Toward the top right is more invasive.

Each dot is one medical app. CVS Health sits to the right, carrying more third-party tracking than most.

The evidence

What it's built from.

All 48 SDKs in the app, grouped by what they are for. 10 are third-party trackers.

10analytics

1crash reporting

37standard libraries

10 of the 48 are third-party trackers. The rest are the app's own code and standard open-source building blocks.

Show the full SDK list

Monitoring SDKAnalytics

Datadog · Datadog Internal · Datadog Logs · Datadog RUM

Other third partiesanalytics

Medallia Digital · Medallia · New Relic · Quantum Metric

Messaging SDKMessaging

Braze · Braze Location

Standard libraries37 · on-device

The app's own code plus open-source interface, storage and networking libraries.

How we know this

Counterspy downloads the app from the App Store and statically analyzes its compiled binary. Embedded SDKs are matched against a signature database and resolved to the company that operates each. We also read the developer's App Store privacy label, which lists the data the app says it collects and links to you. We do not run the app or intercept its traffic, so we report capabilities present in the code and the developer's own disclosures, not proven transmission. We assess privacy and data collection, not malware, security flaws, or developer intent. Reports are automated and never edited for payment. Scan v26.3.50, 2026-04-04.

Third-party trackers are advertising, analytics and attribution SDKs detected by static signature matching. Presence shows a capability is compiled in, not that it ran or transmitted data.
"Data the app links to you" is the count of data categories the developer declares as Data Linked To You in its App Store privacy label. Labels are self-reported and not verified by Apple.
Comparison across the 82 medical in our corpus. Trackers: median 2. Data linked to you: median 5.