# On the connection between Lenz’s law and relativity

Thales B. S. F. Rodrigues & B. F. Rizzuti  Instituto de Ciências Exatas,
Departamento de Física, Universidade Federal de Juiz de Fora, Juiz de Fora,
MG, Brazil<EMAIL_ADDRESS>&<EMAIL_ADDRESS>
###### Abstract

In this work, we demonstrate explicitly the unified nature of electric and
magnetic fields, from the principles of special relativity and Lorentz
transformations of the electromagnetic field tensor. Using an operational
approach we construct the tensor and its corresponding transformation law,
based on the principle of relativity. Our work helps to elucidate concepts of
advanced courses on electromagnetism for primary-level learners and shows an
alternative path to derive the Lenz’s law based on the connection between
relativity arguments and a standard electromagnetism experiment.

##  1 Introduction

In most introductory courses on electromagnetism, undergraduate students
accept the idea that the electric and magnetic fields are independent
entities. One of the reasons why it happens could be related to the duration
of the program: when it is time to unity them, the semester is over. Usually,
in textbooks used in these courses, first, the student learns about the
electric field separately before the magnetic field. It’s only after that the
Maxwell’s equations and their applications are introduced, suggesting a
liaison with electric and magnetic phenomena on either side [1, 2]. Yet the
connection between these allegedly different topics is not explored.

On the other hand, it is only in advanced courses and textbooks on
electromagnetism [3] that the students truly learn about the nature of
electric and magnetic fields and their behavior as a unified entity. We need
to reconsider the current approach to teaching these concepts and explore the
possibility of introducing such formulations in primary-level courses (i.e.,
courses that teach elementary concepts of specific topics in physics at the
college level).

In [4], an approach was presented that establishes the connection between the
special theory of relativity and introductory courses in quantum mechanics.
This approach demonstrates that it is feasible, from a pedagogical standpoint,
to introduce these advanced concepts to primary-level learners. Similar
approaches have been observed in the literature regarding the teaching of
electromagnetic field concepts [5, 6, 7, 8, 9]. As in [10], for instance, by
demonstrating that Lorentz force is not Galilean invariant, the author
highlighted the inherent need for a new transformation connecting different
inertial systems.This was achieved by employing an infinitesimal Lorentz
transformation approach, ultimately ensuring the invariance of the Lorentz
force.

However, up to our knowledge, it is not explicitly addressed in other works in
literature how the Lorentz transformations of the electromagnetism field
tensor $\mathcal{F}^{\mu}{}_{\nu}$ play a crucial role in unifying the
electric and magnetic fields, giving birth to the induction/Lenz’s law. On one
hand, works in literature either focus their approach on demonstrating the
lack of covariance of Maxwell equations and the Lorentz force under Galilean
transformations, or on alternative approaches to evince electromagnetism
covariance under Lorentz transformation. On the other hand, what sets our work
apart is the primary emphasis on the relativistic origin of Lenz’s law, based
on the transformation rule of the tensor $\mathcal{F}^{\mu}{}_{\nu}$.

In this work, we aim to propose a didactic approach that demonstrates the
unified nature of the electric and magnetic fields to primary electromagnetism
students at undergraduate level, anchoring in the principles of special
relativity [11] and the coordinate transformation of
$\mathcal{F}^{\mu}{}_{\nu}$. In what follows, first, we introduce the
electromagnetic field tensor $\mathcal{F}^{\mu}{}_{\nu}$ in section 2,
constructed from experimental assumptions already presented in past works
[12]. Then, in section 3 we elucidate the transformation rule of the tensor
$\mathcal{F}^{\mu}{}_{\nu}$, based on Lorentz transformations [13]. In section
4 and 5, respectively, is showed a recap to the induction law using
geometrical and experimental considerations, and, we demonstrate with a simple
experiment, the connection between the induction law and the special
relativity. In particular, we show how the Lenz’s law can be found invoking
the principle of relativity. Finally, the conclusions of the work are given in
section 6.

Our notation throughout the text will be the following. Greek letters
$\alpha$, $\beta$, $\mu$, $\nu$, etc run values from $0$ to $3$, representing
space-time quantities whereas Latin letters $i$, $j$, $k$, etc assume values
$1$, $2$, $3$, meaning spatial quantities. As usual, Einstein summation
notation is adopted.

##  2 Construction of the electromagnetic field tensor

Tensors are geometric objects that are fundamental in physics due to the fact
that they put forward a coordinate-independent description of physical laws
[14]. In this section, we will show the steps for constructing the
electromagnetic field tensor $\mathcal{F}^{\mu}{}_{\nu}$, which is key for our
further considerations. Our staring point will be the Lorentz force a charged
particle fells when set in a spatial region filled with electromagnetic field.

$\vec{F}=\vec{F}_{E}+\vec{F}_{M}=q(\vec{E}+\vec{v}\times\vec{B}).$ (1)

As usual, $q$ denotes the particle charge, while $\vec{E}$ and $\vec{B}$ stand
for the electric and magnetic sectors of the field.

First, we can construct the magnetic field contribution to the force that acts
on charged particles, based on experimental results [12], namely, (i) the
magnetic force $\vec{F}_{M}$ is perpendicular to the velocity and depends
linearly on it and (ii) is also linearly proportional to the charge $q$ of a
particle beam. In summary, we can write, owing to the aforementioned empirical
data,

$\vec{F}_{M}=q\mathcal{M}(\vec{v}),$ (2)

where the object $\mathcal{M}$ is a linear operator that acts on the velocity
$\vec{v}$

$\mathcal{M}:\mathbb{V}\rightarrow\mathbb{F}.$ (3)

$\mathbb{V}$ is the linear space of velocities and $\mathbb{F}$ the space of
force vectors. Abstract vectors (elements of say, $\mathbb{V}$ or
$\mathbb{F}$) as well as operators gain a concrete structure when we present
them by fixing an ordered basis on the corresponding spaces. For now on, we
fix an orthonormal ordered basis $\mathcal{B}=\\{\hat{e}_{i}\\}$, $i=1,2,3$,
that, with adjusted coefficients, it is possible to generate any vector with
linear combinations. For example, $\vec{v}=v^{i}\hat{e}_{i}$. That way, the
vector $\vec{v}$ has a unique expansion with components $v^{i}$ to the basis
$\mathcal{B}$ and is represented by the column

$\vec{v}\leftrightarrow\begin{pmatrix}v^{1}\\\ v^{2}\\\ v^{3}\end{pmatrix}.$
(4)

Linear operators, in turn, are in a one-to-one correspondence with matrices,
whose order depends on the dimensions of domain and image of the operator.
This is a central result in representing objects in Linear Algebra [15]. In
our particular case, both $\mathbb{V}$ and $\mathbb{F}$ are three dimensional.
Thus, $\mathcal{M}$ is represented by a $3\times 3-$matrix. Therefore, we can
write (2) as

$\begin{pmatrix}F^{1}\\\ F^{2}\\\
F^{3}\end{pmatrix}=q\begin{pmatrix}\mathcal{M}^{1}{}_{1}&\mathcal{M}^{1}{}_{2}&\mathcal{M}^{1}{}_{3}\\\
\mathcal{M}^{2}{}_{1}&\mathcal{M}^{2}{}_{2}&\mathcal{M}^{2}{}_{3}\\\
\mathcal{M}^{3}{}_{1}&\mathcal{M}^{3}{}_{2}&\mathcal{M}^{3}{}_{3}\end{pmatrix}\begin{pmatrix}v^{1}\\\
v^{2}\\\ v^{3}\end{pmatrix}.$ (5)

By fixing a specific initial direction of the force vector $\vec{F}_{M}$ and
comparing the components of $\mathcal{M}$ that vanish using the experimental
considerations (i) and (ii) described above, we can conclude - see the details
in [12] \- that $\mathcal{M}$ is represented by an anti-symmetric matrix,
whose elements we denote
$B_{i}=\frac{1}{2}\varepsilon_{ijk}\mathcal{M}{{}^{j}{}_{k}}$. As usual,
$\varepsilon_{ijk}$ is the Levi-Civita symbol.

With this notation, the expression (5) can be written in a more sympathetic
form as

$\vec{F}_{M}=q\vec{v}\times\vec{B}.$ (6)

For a detailed description of the last steps, we suggest interested readers to
check the construction in the previous study [12]. The vector notation from
(5) to (6) is not mere notation. Actually, under rotations, the coefficients
$B_{i}$ transform as components of a vector, justifying the nomenclature.

With the magnetic field contribution at hand, the second step is to introduce
the electric field contribution of the object $\mathcal{F}$, which is
responsible for yielding the electric force $\vec{F}_{E}$. It can be achieved
with the help of $4-$vectors. To differentiate them from $3-$vectors, say
$\vec{v}$, $\vec{F}$, etc, the notation $\overrightharpoon{A}$ will be used
henceforth. We start with the $4-$velocity $\overrightharpoon{V}$, whose
components, after fixing coordinates (or a basis), are [16]

$\left(\overrightharpoon{V}\right)^{\mu}\equiv
V^{\mu}=\gamma\begin{pmatrix}c\\\ v^{1}\\\ v^{2}\\\ v^{3}\end{pmatrix},$ (7)

where $\gamma$ is the Lorentz factor

$\gamma=\frac{1}{\sqrt{1-\frac{\vec{v}^{2}}{c^{2}}}},$ (8)

as well as $c$ is the speed of light. The $4-$force $\overrightharpoon{f}$
components also gain a $gamma-$factor in front of it [11]

$\left(\overrightharpoon{f}\right)^{\mu}=f^{\mu}=\gamma\begin{pmatrix}F^{0}\\\
F^{1}\\\ F^{2}\\\ F^{3}\end{pmatrix}.$ (9)

At this point, we will demand that the electromagnetic field is a linear
operator acting on the charged particle $4-$velocity, resulting in the
$4-$force, in resemblance to the expression we obtained in (5). We denote it
as $\mathcal{F}$ and due to the dimension of the underlying spaces are working
on, it will be represented by a $4\times 4-$matrix, with components
$\mathcal{F}^{\mu}{}_{\nu}$. If we define the components of $\mathcal{F}$ as

$\mathcal{F}^{\mu}{}_{\nu}=\begin{pmatrix}0&E_{1}c^{-1}&E_{2}c^{-1}&E_{3}c^{-1}\\\
E_{1}c^{-1}&0&B_{3}&-B_{2}\\\ E_{2}c^{-1}&-B_{3}&0&B_{1}\\\
E_{3}c^{-1}&B_{2}&-B_{1}&0\end{pmatrix},$ (10)

then, a direct calculation shows that the spatial sector of the compact form

$f^{\mu}=q\mathcal{F}^{\mu}{}_{\nu}V^{\nu}$ (11)

yields (1), as expected. It is also possible to relate $f^{0}$ with the power
the particle gains due to its interaction with electromagnetic field. This
details are not relevant to our discussions and will be omitted here.

In conclusion, we can see that the electromagnetic field tensor $\mathcal{F}$
is simply a linear operator which acts on $4-$velocity vectors resulting in
$4-$force vectors. (10) has also a unifying character, in the sense that both
$\vec{E}$ and $\vec{B}$ are but a manifestation of the electromagnetic field
when one fixes a particular basis to represent it. In the next section we will
see how it behaves when there is a change in frames of reference.

##  3 The transformation rule of $\mathcal{F}^{\mu}{}_{\nu}$

After the construction presented in the last section, we shall introduce the
transformation rule of the electromagnetic field tensor
$\mathcal{F}^{\mu}{}_{\nu}$, which will be crucial to the whole discussion of
this work.

The coordinate transformation $x\mapsto x^{\prime}$ of a reference frame to
another one with relative velocity $\vec{v}=v\hat{e}_{1}$ is given by a
Lorentz boost $\Lambda$. We will focus on the $x^{1}-$direction for specific
reasons that will be elucidated in the subsequent sections of our work. It is
given by

$x^{\mu}\rightarrow x^{\prime\mu}=\Lambda^{\mu}{}_{\nu}x^{\nu}.$ (12)

In matrix notation, it reads

$\begin{pmatrix}x^{\prime 0}\\\ x^{\prime 1}\\\ x^{\prime 2}\\\ x^{\prime
3}\end{pmatrix}=\begin{pmatrix}\gamma&-\beta\gamma&0&0\\\
-\beta\gamma&\gamma&0&0\\\ 0&0&1&0\\\
0&0&0&1\end{pmatrix}\begin{pmatrix}x^{0}\\\ x^{1}\\\ x^{2}\\\
x^{3}\end{pmatrix}$ (13)

where $\beta=v/c$.

As a matter of fact, (12) induces the transformation of the components of any
$4-$vector,

$A^{\mu}\rightarrow A^{\prime\mu}=\Lambda^{\mu}{}_{\nu}A^{\nu}.$ (14)

With the transformation of vectors, let us see how $\mathcal{F}^{\mu}{}_{\nu}$
transforms under a Lorentz boost. Firstly, we may write, due to the principle
of relativity,

$f^{\mu}=q\mathcal{F}^{\mu}{}_{\nu}V^{\nu}\Leftrightarrow
f^{\prime\mu}=q\mathcal{F}^{\prime\mu}{}_{\nu}V^{\prime\nu},$ (15)

since the laws of physics hold in every (inertial) frame. The arrow points to
both sides, after all, there are no privileged coordinates for different
frames. According to (14), the right part of (15) reads,

$\Lambda^{\mu}{}_{\nu}f^{\nu}=q\mathcal{F}^{\prime\mu}{}_{\beta}\Lambda^{\beta}{}_{\alpha}V^{\alpha}\Rightarrow
f^{\nu}=q\left(\Lambda^{-1}\right)^{\nu}{}_{\mu}\mathcal{F}^{\prime\mu}{}_{\beta}\Lambda^{\beta}{}_{\alpha}V^{\alpha}.$
(16)

Comparing (15) and (16), we conclude that

$\mathcal{F}^{\nu}{}_{\alpha}=\left(\Lambda^{-1}\right)^{\nu}{}_{\mu}\mathcal{F}^{\prime\mu}{}_{\beta}\Lambda^{\beta}{}_{\alpha}\Leftrightarrow\mathcal{F}^{\prime\mu}{}_{\beta}=\Lambda^{\mu}{}_{\nu}\mathcal{F}^{\nu}{}_{\alpha}\left(\Lambda^{-1}\right)^{\alpha}{}_{\beta}.$
(17)

That is exactly the standard transformation law of a rank $(1,1)-$tensor,
obtained upon the principle of relativity. We point out that defining tensors
as objects that transform in a particular way might appear to be an ad hoc
assumption, made without a clear basis, potentially leading to confusion.
Therefore, by invoking the principle of relativity, we can deduce such
transformations, as illustrated in equation (17), without requiring any prior
premises.

Let us consider an example that will be useful for our future discussions.
Suppose a particular spatial region is permeated by a magnetic field pointing
in the $x^{2}-$direction, $\vec{B}=B_{2}\hat{e}_{2}$. In this case, the
electromagnetic field tensor has only two non-vanishing terms,
$\mathcal{F}^{1}{}_{3}=-\mathcal{F}^{3}{}_{1}=-B_{2}$. How is the field
perceived by a reference frame that is boosted in the $x^{1}$ direction, with
a relative velocity of $\vec{v}=v\hat{e}_{1}$? A direct calculation shows that

$\mathcal{F}^{\prime\mu}{}_{\beta}=\begin{pmatrix}0&0&0&\beta\gamma B_{2}\\\
0&0&0&-\gamma B_{2}\\\ 0&0&0&0\\\ \beta\gamma B_{2}&\gamma
B_{2}&0&0\end{pmatrix}.$ (18)

However, the values in the first row (and column) of the matrix that
represents the tensor should be interpreted as the electric field. Therefore,
our previous result shows that the $\vec{B}-$field in the initial frame is
perceived as an electric field in the frame that is moving with respect to the
former. Comparing the terms ${}^{0}{}_{3}$ in both (10) and (18), we have

$E^{\prime}_{3}=v\gamma B_{2}.$ (19)

Once again, we emphasize that electric and magnetic fields are relative. An
electric field can be perceived as a magnetic field and vice versa, in the
sense of (19). Another interesting aspect of the transformation (19) is its
behavior in the limit where $v\ll c$: $E^{\prime}_{3}\approx vB_{2}$. Despite
the low limit of speeds, we still observe a relative change from magnetic to
electric fields. In contrast, a Galilean boost does not preserve the
fundamental structure of $\mathcal{F}^{\mu}{}_{\nu}$, which includes a
symmetric first row and column ($\mathcal{F}^{0}{}_{i}=\mathcal{F}^{i}{}_{0}$)
in addition to the anti-symmetric sector $\mathcal{F}^{i}{}_{j}$.

##  4 Brief recap on the induction law

In this section, we will discuss the very structure of the induction law
through a simple experiment. Due to its geometrical appeal, we will focus on
the differential form of the law. Prior to that, it is instructive to consider
an equation of the form

$\vec{b}=\nabla\times\vec{a}.$ (20)

The geometrical meaning of Equation (20) is clear: if we interpret the vector
field $\vec{b}$ as the source of the field $\vec{a}$, then the latter
circulates around the former according to the right-hand rule, as shown in
Figure 1.

Figure 1: Geometric picture of the equation (20).

In this particular case,
$\vec{a}(x^{1},x^{2},x^{3})=-x^{2}/2\hat{e}_{1}+x^{1}/2\hat{e}_{2}$, which
implies $\vec{b}=\hat{e}_{3}$. Here, once again,
${\hat{e}_{1},\hat{e}_{2},\hat{e}_{3}}$ are the unit vectors pointing in the
$x^{1}$, $x^{2}$, and $x^{3}$ directions of a Cartesian coordinate system.
There are many other examples with this composition, even within the realm of
electromagnetism. For instance:

  1. 1.

The Ampère’s law indicates that currents generate a magnetic field around
them, given by the equation $\nabla\times\vec{B}=\mu_{0}\vec{J}$.

  2. 2.

The magnetic field can be expressed as $\nabla\times\vec{A}=\vec{B}$.

The previous mathematical concepts will be directly applied to a simple yet
astonishing experiment. We bring a magnet close to a conducting ring, and they
are not supposed to interact (magnetically) with each other. In this case, the
ring could be made of, say, silver or aluminum. However, a curious effect
occurs when the magnet enters the circle defined by the ring: the system feels
a repulsion, and the ring is deflected in an effort to move away from the
magnet. This sequence is shown in Figure 2, where the line below it indicates
the arrow of time.

Figure 2: The aluminum ring is repeled by the moving magnet. Source:
https://www.fisica.ufjf.br/~lesche/F%C3%ADs%20III/Notas%20de%20aula%20F%20III/

Since the ring does not feel the presence of a static magnet, the only
possible interaction between them must have been created by the variation of
$\vec{B}$ in time, given by $\partial\vec{B}/\partial t$. Knowing that like
magnetic poles repel each other, we expect that $\partial\vec{B}/\partial t$
induced a current on the ring, denoted as $I_{ind}$, and the corresponding
magnetic field created by the current ($\vec{B}_{ind}$) interacted with the
$\vec{B}$ field of the magnet, causing the repulsion.

Figure 3: Schematic representation of the repulsion between magnet and ring.

And one might now ask, what is the origin of $I_{ind}$? Since the ring was
initially stationary relative to the magnet, our experiment indicates that
$I_{ind}$ was generated by an electric field $\vec{E}$ that can only have a
specific configuration - it circulates around $\partial\vec{B}/\partial t$,
obeying the left-hand rule. Hence, our previous discussion, as seen in (20),
allows us to formulate the differential form of the induction law,

$\frac{\partial\vec{B}}{\partial t}=\lambda\nabla\times\vec{E},$ (21)

here $\lambda$ is still to be determined.

First of all, a simple dimensional analysis shows that

$[\lambda]=\frac{T/s}{N/mC}=1,$ (22)

meaning that this parameter is a dimensionless constant. Due to the left-hand
rule depicted in Figure 3, we expect it to be negative.

To conclude this section, we would like to emphasize that the experiment can
be repeated with the magnet polarization inverted, and it would work in the
same way. Furthermore, if the magnet is moved away from the O-ring instead of
being pushed towards it, the pair will experience an attraction, and the
explanations provided above would still hold.

Next, we will investigate a particular experiment that allows us to obtain
$\lambda$ by invoking the principle of relativity.

##  5 Toy model for measuring currents

Let us consider a simple experiment consisting of an infinite wire carrying a
steady current $I>0$, as indicated in Figure 4. Here, we emulate a similar
experiment presented previously with a different setup. At the same plane
where the wire is located, there is a rectangular closed-loop circuit moving
away from the wire with a fixed velocity $\vec{v}$ orthogonal to the wire
direction. The resistance of the circuit is given by $R$, and its sides are
$a$ and $b$. An ammeter is connected to the circuit with the orientation
indicated close to it. We point out that the arrow does not represent the
physical effect of moving charges. Rather, it is only an experimental
prescription of how to connect the ammeter in the circuit.

Figure 4: Experimental setup used to explore the relativistic behavior of the
induction law.

Thinking of the wire and the circuit as rigid bodies, they define reference
frames that we name $S$ and $S^{\prime}$, respectively. We fix a Cartesian
coordinate system in $S$, in a way that the wire is in the $z$ direction, and
$\vec{v}$ points towards the positive $x$-direction.

An observer in $S$ may use the induction law (21) to estimate the current $i$.
For that, we integrate (21) over the surface $(\mathcal{S})$ delimited by the
closed path around the circuit, oriented clockwise,

$\iint\limits_{(\mathcal{S})}\frac{\partial\vec{B}}{\partial
t}\cdot\overrightarrow{dS}=\lambda\iint\limits_{(\mathcal{S})}(\nabla\times\vec{E})\cdot\overrightarrow{dS}=\lambda\oint\limits_{(\partial\mathcal{S})}\vec{E}\cdot\overrightarrow{dl}.$
(23)

The last equality is justified by the Stokes’ theorem and provides the voltage
in the circuit induced in accordance with (21).

Let us gather some pieces of information.

(i) With the oriented ammeter, we have

$\oint\limits_{(\partial\mathcal{S})}\vec{E}\cdot\overrightarrow{dl}=Ri.$ (24)

(ii) The magnetic field generated by the wire is given by

$\vec{B}=\frac{\mu_{0}I}{2\pi x}\hat{e}_{2}.$ (25)

For this case, in which the wire is moving, the flux in (23) may calculated by
[17, 18]

$\displaystyle\iint\limits_{(\mathcal{S})}\frac{\partial\vec{B}}{\partial
t}\cdot\overrightarrow{dS}$
$\displaystyle=\frac{d}{dt}\iint\limits_{(\mathcal{S})}\vec{B}\cdot\overrightarrow{dS}$
(26) $\displaystyle=\frac{d}{dt}\int^{b}_{0}\int^{x+a}_{a}\frac{\mu_{0}I}{2\pi
x}\hat{e}_{2}\cdot\hat{e}_{2}dxdy$ (27)
$\displaystyle=\frac{\mu_{0}Ibv}{2\pi}\left(\frac{1}{x+a}-\frac{1}{x}\right),$
(28)

where $dx/dt=v$ and $\vec{dS}=dxdy\hat{j}$. We observe that both results (24)
and (26) are related. Since $(\partial\mathcal{S})$ runs clockwise,
$(\mathcal{S})$ is oriented in the $+\hat{j}$ direction and vice versa.
Finally, the current predicted by an observer in $S$ is given by

$i=\frac{\mu_{0}Ibv}{2R\pi\lambda}\left(\frac{1}{x+a}-\frac{1}{x}\right).$
(29)

On the other hand, an observer in $S^{\prime}$ comoving with the circuit could
also estimate the current. Our previous discussion on the relativity of
electric and magnetic fields tells us that $\vec{B}$ in $S$ is seen in
$S^{\prime}$ as an electric field $\vec{E}^{\prime}$, pointing toward the
direction defined by $\vec{v}\times\vec{B}$. More precisely, the
transformation of the electromagnetic strength tensor in (18) provides

$\vec{E}^{\prime}=\gamma\vec{v}\times\vec{B}=\frac{\gamma v\mu_{0}I}{2\pi
x}\hat{e}_{3}.$ (30)

Now, the current named $i^{\prime}$, is given by

$Ri^{\prime}=\oint\limits_{(\partial\mathcal{S})}\vec{E}^{\prime}\cdot\overrightarrow{dl}^{\prime}\Rightarrow
i^{\prime}=\gamma\frac{v\mu_{0}I}{2\pi
R}\left(\frac{1}{x}-\frac{1}{x+a}\right).$ (31)

Owing to the principle of relativity, we expect that there is only one
possible value for the current. Thus, comparing (29) and (31) in the limit of
low velocities ($\gamma\approx 1$), we can determine the value of $\lambda$ as

$i=i^{\prime}\Rightarrow\lambda=-1,$ (32)

leading to the well-known induction law

$\nabla\times\vec{E}=-\frac{\partial\vec{B}}{\partial t}$ (33)

based on relativity arguments.

##  6 Conclusions

In this paper we have discussed the relativistic character of
electromagnetism. Our findings are the following:

  1. 1.

From a operational approach, we have constructed the electromagnetic field
tensor $\mathcal{F}^{\mu}{}_{\nu}$, which allows us to describe the Lorentz
force when it acts on 4-velocity vectors.

  2. 2.

By utilizing the principles of special relativity, we have established the
transformation rule that the tensor $\mathcal{F}^{\mu}{}_{\nu}$ must adhere
to. This explicit demonstration highlights the inherently relativistic nature
of electromagnetism. We recognize that what we perceive as electric and
magnetic fields are merely different manifestations of the same underlying
entity, contingent upon the reference frame from which we observe them.

  3. 3.

Again, using an alternative operational approach, we successfully derived the
induction law and demonstrated that the origins of Lenz’s law are purely
relativistic in nature.

## Acknowledgments

This work has been supported by Programa Institucional de Bolsas de Iniciação
Científica - XXXV BIC/Universidade Federal de Juiz de Fora - 2022/2023,
project number 51670.

## ORCID iDs

Thales B. S. F. Rodrigues https://orcid.org/0000-0002-1048-8586
B. F. Rizutti https://orcid.org/0000-0003-3667-1335

## References

## References

  * [1] Young H D, Freedman R A and Ford A L 2012 Sears and Zemansky’s University Physics - with modern physics (Boston: Addison-Wesley)
  * [2] Nussenzveig H M 2018 Curso de Física Básica - 3: Eletromagnetismo (São Paulo: Editora Edgard Blücher)
  * [3] Jackson J D 1999 Classical Electrodynamics (New York: Wiley)
  * [4] Peralta L G, Poveda L A and Poirier B 2021 Eur. J. Phys. 42 055404
  * [5] Sobouti Y 2015 Eur. J. Phys. 36 065036
  * [6] Heras J A and Heras R 2020 Eur. J. Phys. 41 035202
  * [7] Feynman R et al 2010 Feynman Lectures on Physics, Vol. 2, Section 13.6 (New York: New millennium - Basic Books)
  * [8] Ramos I R O, Braga J P M, Silva J W C, Lima A P and Holanda L M 2017 Rev. Bras. Ens. Fís 39 e2306
  * [9] Moraes J T, Rizzuti B F and Gonçalves B 2022 Quarks 4 61-80
  * [10] König J 2021 Eur. J. Phys. 42 045204
  * [11] Lesche B 2005 Teoria da Relatividade (São Paulo: Editora Livraria da Física)
  * [12] Alves P V, Rizzuti B F and Gonçalves R 2020 Rev. Bras. Ens. Fís. 42 e20200285
  * [13] Rocha A, Rizzuti B F and Mota D 2013 Rev. Bras. Ens. Fís. 35 4304
  * [14] Shapiro I L 2019 A Primer in Tensor Analysis and Relativity (Cham: Springer International Publishing)
  * [15] Hoffman K and Kunze R 1971 Linear Algebra (New Jersey: Prentice-Hall, Inc.)
  * [16] Ugarov V A Special Theory of Relativity (Moscow: Mir Publishers)
  * [17] Flanders H 1973 Am. Math. Mon. 80 615
  * [18] Feoli A, Iannella A L and Benedetto E 2021 Rev. Bras. Ens. Fís. 43 e20210017


# Empirical Analysis of Sri Lankan Mobile Health Ecosystem:
A Precursor to an Effective Stakeholder Engagement

Kenneth Thilakarathna,1,2 Sachintha Pitigala,2 Jayantha Fernando,3 Primal
Wijesekera,4,5 1University of Colombo School of Computing, 2University of
Kelaniya, 3Heritage Partners, 4ICSI, 5UC Berkeley

###### Abstract.

Sri Lanka recently passed its first privacy legislation covering a wide range
of sectors, including health. As a precursor for effective stakeholder
engagement in the health domain to understand the most effective way to
implement legislation in healthcare, we have analyzed 41 popular mobile apps
and web portals. We found that 78% of the tested systems have third-party
domains receiving sensitive health data with minimal visibility to the
consumers. We discuss how this will create potential issues in preparing for
the new privacy legislation.

privacy, health surveillance, compliance

††journalyear: 2024††journalvolume: 2024††journalnumber: X††doi:
XXXXXXX.XXXXXXX

##  1\. Introduction

Sri Lanka’s mature and effective public health ecosystem has proven equally
efficient compared to major economies. Given the open and unrestricted nature
of the health ecosystem, patients can consult any medical practitioner at will
without worrying about insurance or the cost. Inadvertently, this has also
created a vibrant digital ecosystem where consumers in Sri Lanka have long
enjoyed the comfort of scheduling appointments over the phone digitally.

As the first in the region, Sri Lanka recently passed its first nationwide
privacy legislation (pdpa, ). Europe and the US, despite having regulations in
place for some time, are facing continuous threats of breaching consumer
privacy expectations and regulatory violations. Research at the intersection
of Tech, Policy, and Legal has shown various reasons, such as lack of
awareness, miscomprehension of the regulatory requirements, miscommunication,
the lack of transparency in the third-party code and systems used by
developers, and finally, lack of a strong institutional framework due to
budgetary and bureaucratic constraints. This long list of reasons has produced
the notion of law in the books vs. law in the code.

Sri Lanka is uniquely placed in this journey since the country is at an early
phase of setting up the institutional framework for the implementation of
privacy legislation enacted recently. The core objective of the work is to
utilize the golden period and ensure that relevant authorities and
stakeholders in the health domain are properly informed by empirical evidence
and aware of their responsibilities towards a privacy-conscious ecosystem.

##  2\. Related Work

Prior studies have investigated potential regulatory violations in mobile apps
in the US (nguyen2021share, ; reyes2018won, ; reyes2018won, ; han2020price, ;
feal2020angel, ; samarin2023lessons, ) while another line of work examines the
compliance of mobile health apps in the context of GDPR
(Fan2020gdprcompliance, ; Mulder2019HealthAppsPrivacyGDPR, ;
Benjumea2019gdprcompliance, ; Papageorgiou2018gdprcompliance, ). The focus of
privacy studies has delve into the healthcare ecosystem through multiple
subsystems such as analyzing privacy of femtech health (shipp2020private, ;
epstein2017examining, ; rosas2019future, ), mobile-based COVID-19 tracing
applications for their privacy implications (chidambaram2020observational, ;
simmhan2020gocoronago, ), operation of mobile therapy apps, a subset of the
telehealth app ecosystem (iwaya2023privacy, ; hassan2023unveiling, ) to name a
few. Another research trajectory assesses the availability, scope, and
transparency of mobile health app privacy policies
(Benjumea2020AssessmentFairness, ; Sunyaev2014MobileHealthPrivacyPolicy, ;
Sampat2017PrivacyRisks, ; OLOUGHLIN2019110, ) where there are studies focused
on understanding the developers’ role in health privacy and challenges faced
in producing complied software solutions (tahaei2022privacy, ;
bednar2019engineering, ; hadar2018privacy, ; Mustafa2019devRoleInCompliance, ;
Muchagata2018DevRoleInCompliance, ; aljedaani2020empirical, ;
aljedaani2021challenges, ). In the US, legal authorities such as the FTC and
HHS scrutinize mobile health apps for compliance (ftc_letters, ; betterhelp, ;
premom, ; goodrx, ). FTC has used the HBNR (hbnr, ) and FTC Act (FTCAct, ) to
pursue these actions as these apps traditionally fall outside the scope of
HIPAA (hipaa_ref, ).

##  3\. Background

###  3.1. What is a health app?

Definitions of ”health app,” ”medical app,” or ”wellness app” can overlap, and
there is no universally accepted definition for these terms. For the context
of this work, we define a health app as an Android-based mobile app or a
mobile-ready website that lets consumers (patients) communicate with a
healthcare provider and schedule an appointment or give specific information
or guidance on a specific health condition such as diabetes, or online
pharmacy.

###  3.2. Applicable Privacy Legislation

In 2022, the government of Sri Lanka passed its Personal Data Protection Act,
No. 9 of 2022 (PDPA), which is a commendable starting point for a privacy
ecosystem (pdpa, ). PDPA is a comprehensive privacy legislation such as CCPA
or GDPR; however, Health data is defined under a special category with extra
protection.

##  4\. Methodology

###  4.1. Mobile Analysis Tool

We focused our analysis on the Android ecosystem, given it is the most
prevalent mobile operating system (androidshare, ) and our in-house tools on
Android. In our custom Android platform (based on v9.0-_r39), we modified the
platform to enable the real-time monitoring of apps’ access to protected
resources (e.g., location data, address book contacts, etc.) and sharing over
the network. We have also implemented stringent guards to hide our
instrumentation from the latest array of anti analysis techniques
(lim2018survey, ; Zhang_15, ; Talsec, ; Appsealing, ; Promon, ).

Our network interception occurs at two different points: one at the default
Android network stack at conscrypt library level just before the SSL_read and
SSL_write, and one at the webview library level intercepting XHR requests. Our
instrumentation does not have any false positives, but there is a probability
of false negatives due to the coverage in app execution – the data should be
treated as the absolute lower bound of what is happening in the real world.

###  4.2. App Corpus

We looked for Android apps and websites that let a patient make an appointment
with a physician, provide information or guidance on specific conditions,
online pharmacy systems, rehabilitation apps, or sites for leading hospitals
in the Sri Lanka Google Play Store from 01 June 2024 until 07 June 2024 and in
the Google website. We ended up testing 41 Android-based apps and websites.
The dataset includes 5 Android apps and 37 websites accessed through Android:
11 hospitals, 14 medical clinics, four information sites targeting specific
conditions, seven online pharmacies, and five physician scheduling portals.
The data set also has different types of health apps focusing on fertility,
diabetes, cancer, mental health, etc. From here onward, we refer to both apps
and websites as health systems.

###  4.3. Testing Procedure

We tested the apps and websites using Pixel 3a phones running our instrumented
Android. We explored the apps/websites as much as possible go over as many
options and links as possible. Whenever possible, we also searched for
specific conditions or a specific physician to see whether such information is
shared with third-parties.

Android offers more sensitive resources and functionalities than the desktop
environment. Hence, understanding how these websites behave in the mobile
ecosystem is important. During the app testing, the researcher recorded all
the sensitive data used, such as synthetic names, all the synthetic health
data used to fill the questions, sensitive pages visited, such as ”help on
anxiety.” Once the network traces are decoded, we use a script to look for any
transaction with specific strings used in the testing.

###  4.4. Health Data

The definition of health data under PDPA (pdpa, ) is ”personal data related to
the physical or psychological health of a natural person, which includes any
information that indicates his health situation or status;;” and HHS recently
issued a guidance (hhs-2022, ), identifying that even sharing the app name
along with a unique ID of the consumer would fall within the definition of
Personal Health Information (PHI), as it identifies the individual’s past,
present or future health or health care or payment. Keeping this new legal
principles in mind, we labeled the following items as health data as any of
the following can be used to infer their health conditions or health
interests: conventional health data, app usage (apps targeting specific
medical conditions), search queries within health apps (searching for a
medical condition, a medication, etc.), navigation with the app (viewing pages
focusing on a specific medical condition).

###  4.5. Ethical Considerations

Based on our number of prior conversations with our Institutional Review Board
on large-scale mobile app analysis for compliance, we determined we do not
require an IRB review for this study. We are not examining any human subject
but only the app execution.

### Ecological Validity

Android apps are likely to detect the geolocation based on the IP and might
change their behavior accordingly. All Sri Lankan based apps were executed in
Sri Lanka to preserve the ecological validity of the test environment. We only
have one app that stopped its execution after detecting the underlying custom
Android OS.

##  5\. Data Sharing Practices

| Third-Party
---
Recepient
Type |  | Number of
---
Apps
| Health Data
---
Status
| Google
---
Analytics
| Tracking/
---
Event Reporting
10 | Non-compliant
Google Search | Search | 8 |  | Likely
---
non-compliant
Facebook |  | Tracking/
---
Event Reporting
6 | Non-compliant
Doubleclick | Advertising | 5 | Non-compliant

Table 1. Third-party recipients of physician information.

| Third-Party
---
Recepient
Type |  | Number of
---
Apps
| Health Data
---
Status
| Google
---
Analytics
| Tracking/
---
Event Reporting
24 | Non-compliant
Google Search | Search | 11 |  | Likely
---
non-compliant
Facebook |  | Tracking/
---
Event Reporting
5 | Non-compliant
Zoho | CDN | 5 | Unknown
Doubleclick | Advertising | 4 | Non-compliant
GStatic | CDN | 3 | Unknown
| Google
---
Tag Manager
Tracking | 2 | Non-compliant
Cloudfare | CDN | 2 | Unknown
Private Site | Personal | 1 |  | Likely
---
non-compliant

Table 2. Recipients of sensitive usage information.

#### Physician Information

: Since the pandemic, systems allowing scheduling appointments online have
soared, and most of them went unchecked until recently. Online physician
scheduling is quite popular in Sri Lanka. In the health compliance ecosystem,
they play a crucial role. Our dataset has seventeen systems that allow
patients to search for physicians, get scheduling information, or make an
appointment directly. We have observed that ten health systems (58.82% out of
17 health systems with the scheduling feature) have shared sensitive physician
information with third parties. Physician information can divulge a patient’s
condition as a highly sensitive data point. Table 1 lists all the third-party
recipients of such sensitive information. The last column denotes whether the
respective recipient will treat the health data without violating any
regulatory or consumer privacy expectations.

#### Usage Information

: Event reporting in online systems is usually harmless for the consumers.
But, in a health system, it can diffuse sensitive information such as
potential interest or a condition a patient has. For example, a repeated visit
to infertility pages can likely expose consumer’s highly sensitive condition.
Hence, sharing usage information should be done carefully with masking. This
concern is confirmed by HSS (in the US) as per their latest guidance on
regulatory expectations (hhs-2022, ).

In our dataset, we have 27 (65.85% of our test-pool) apps sharing highly
sensitive usage information with third parties who are likely to use such
information for user tracking and profiling. This usage information includes
visits to infertility treatment pages, mental illness tests, physician pages
specializing in specific conditions. In an ideal setup, patients are highly
unlikely to share their interests and why they visit such pages. Table 3 lists
all the third-party recipients of such sensitive information. The last column
denotes whether the recipient will treat the health data without violating
regulatory or consumer privacy expectations – this is determined based on
their public documents.

We observed that nine health systems shared the search queries we used during
the testing with third-party recipients—Google Analytics (8 apps) and Facebook
(2 apps) are the most common recipients. Similar to app usage, search queries
are sensitive, such as physicians, symptoms, and a particular medicine, all of
which could expose sensitive conditions associated with the patient.

We also observed one health system sending sensitive health information over
the Internet unencrypted, jeopardizing the confidentiality and integrity of
the patients’ health data.

Out of the 33 health systems sharing data with third parties, only nine health
systems (27.27%) have acknowledged third-party data sharing in their privacy
policies, and, overall, 27 ( 65% of our test-pool) health systems did not have
a privacy policy.

Except for two Android apps (which shared AAID with Facebook and Google
Analytics), none of the other systems shared soft or persistent IDs with third
parties. From a developer perspective, no sensitive health data shared had an
ID linking to the patient. The biggest caveat, however, is the patient’s IP
address. Even HIPAA labels the IP address as one of the eighteen HIPAA
identifiers that can be used to link to a specific person. The extent of the
linkage depends on the nature of the mobile phone’s connection. If it is a
home WIFI, it is easy to link each data transfer to a specific person along
with the IP address and many other meta information.

##  6\. Regulatory Preparation

The main objective of this work is to understand the current status of the
mobile health ecosystem as a precursor to understanding the cost,
responsibilities, and challenges faced by developers and health organizations
in complying with the new Privacy legislation.

The preparation has to be done in two ways: by managing consent and by
providing data subject rights. We recently conducted a focus group to
understand stakeholder perspectives on the new privacy legislation
(roundtable, ). Participants raised both of these tasks as sources of cost in
the process of complying with new legislation.

None of the health systems we analyzed have any sort of consent management
(except for one website that had cookie consent). This will be one of the
first major changes for health systems to properly manage consumers’ consent.
There are several challenges to effectively obtaining an informed consent from
patients.

PDPA requires the controller to properly convey one or more predefined
purposes to the data subject before obtaining consent unless exempted under
PDPA guidelines such as legal obligations. Given the widespread use of third
parties receiving sensitive health data, it will be a challenge for health
systems to set a predefined purpose properly. Especially once a data
controller shares data with the likes of Facebook and Google Analytics, it is
hard to dictate how they are going to use the health data.

Another major change would be to obtain consent for cross-border data
transfer. All third-party data recipients are not based in Sri Lanka; hence,
as per PDPA clauses, health systems need to obtain consent from the users of
the health systems properly.

The heavy use of third-party trackers such as Google Analytics, Facebook, and
DoubleClick further complicates since controllers need to properly expose how
the data recipients are going to profile customers based on health data. Apart
from the knowledge that most of such data is used in Advertising, it is a
black box for outsiders to understand how the whole mobile ad ecosystem
behaves, leaving the data controllers in Sri Lanka in the dark. PDPA has a
separate clause for profiling, especially when using special category data
such as health.

PDPA (similar to the clauses in GDPR and CCPA) emphasizes providing data
subjects (patients in this context) with an array of rights: access, erase,
and withdraw consent. Our prior work on implementation of data subject
requests (DSR) in CCPA (samarin2023lessons, ; samarin2023understanding, )
showed controllers have a hard time accurately responding to DSR because
controllers are not fully aware of how third parties collected data from data
subjects while executing within the controller’s app. Given the widespread use
of third-party trackers, Sri Lankan health systems will face the same issue.

PDPA sets clear guidelines on what information should be available for the
consumer for transparency. Privacy policy is one of the key techniques to
properly convey data practices, purposes, and other relevant information. Most
health systems in Sri Lanka do not have any privacy policy. We believe this
will be an easy first step for many organizations to publish an accurate
privacy policy. Still, this step will also be affected by third-party data
collection’s opaque nature and their purposes.

Literature has looked into how developers understand their regulatory
responsibilities and the gaps in their comprehension of the regulations
(alomar2022developers, ). Further work is needed to understand why developers
share health data with third parties that have publicly asked not to share
heath data with them
111https://support.google.com/analytics/answer/13297105?hl=en
222https://web.facebook.com/business/help/361948878201809?id=188852726110565&_rdc=1&_rdr.
Literature has proposed solutions such as the use of SBOM to communicate
compliance restrictions (wijesekers24_conpro, ). This is one of the
overarching objectives of this work, i.e., to work with stakeholders to
understand how to effectively implement privacy legislation while helping the
likes of developers of health systems providing proper guidance and tools.

The Data Protection Authority of Sri Lanka is keen to work with stakeholders
to understand their perspectives and figure out the best way to roll out the
implementation with the help of relevant parties such as health organizations,
patients, developers of health systems, and legal practitioners. We have
already conducted one stakeholder engagement to understand the cost,
challenges, and opportunities that lie ahead in the compliance process. We
hope this work will set an effective precursor for engaging with professionals
in the healthcare domain to figure out their costs and challenges in preparing
for the new legislation. The objective of this is not to blame anyone but to
figure out where the help is most needed.

###### Acknowledgements.

This work was supported by the U.S. National Science Foundation (under grant
CNS-2055772 & CNS-2217771 ).

## References

  * [1] Coppa support.  https://github.com/prebid/prebid.github.io/pull/3476.  Accessed: 2022-01-28.
  * [2] Federal Trade Commission (FTC) Act.  15 U.S.C. §45(a)(1).
  * [3] Personal data protection act.  https://www.parliament.lk/uploads/acts/gbills/english/6242.pdf.
  * [4] Round table discussion on pdpa.  https://www.linkedin.com/pulse/roundtable-discussion-privacy-regulation-beyond-primal-wijesekera-lor3c/.
  * [5] B Aljedaani and MA Babar.  Challenges with developing secure mobile health applications: Systematic review. jmir mhealth uhealth 9, e15654, 2021.
  * [6] Bakheet Aljedaani, Aakash Ahmad, Mansooreh Zahedi, and M Ali Babar.  An empirical study on developing secure mobile health apps: The developers’ perspective.  In 2020 27th Asia-Pacific Software Engineering Conference (APSEC), pages 208–217. IEEE, 2020.
  * [7] Noura Alomar and Serge Egelman.  Developers say the darnedest things: Privacy compliance processes followed by developers of child-directed apps.  Proceedings on Privacy Enhancing Technologies, 4(2022):24, 2022.
  * [8] Kathrin Bednar, Sarah Spiekermann, and Marc Langheinrich.  Engineering privacy by design: Are engineers ready to live up to the challenge?  The Information Society, 35(3):122–142, 2019.
  * [9] J Benjumea, J Ropero, O Rivera-Romero, E Dorronzoro-Zubiete, and A Carrasco.  Assessment of the fairness of privacy policies of mobile health apps: Scale development and evaluation in cancer apps.  JMIR Mhealth Uhealth, 8(7):e17134, 2020.
  * [10] Jaime Benjumea, Enrique Dorronzoro, Jorge Ropero, Octavio Rivera-Romero, and Alejandro Carrasco.  Privacy in mobile health applications for breast cancer patients.  In 2019 IEEE 32nd International Symposium on Computer-Based Medical Systems (CBMS), pages 634–639, 2019.
  * [11] Swathikan Chidambaram, Simon Erridge, James Kinross, and Sanjay Purkayastha.  Observational study of uk mobile health apps for covid-19.  The Lancet Digital Health, 2(8):e388–e390, 2020.
  * [12] Federal Trade Commission.  Health breach notification rule.  https://www.ftc.gov/legal-library/browse/rules/health-breach-notification-rule/.  Accessed: 2023-10-15.
  * [13] Stat Counter.  Mobile operating system market share worldwide.  https://gs.statcounter.com/os-market-share/mobile/worldwide, 2023.  Accessed: 2023-10-15.
  * [14] Daniel A Epstein, Nicole B Lee, Jennifer H Kang, Elena Agapie, Jessica Schroeder, Laura R Pina, James Fogarty, Julie A Kientz, and Sean Munson.  Examining menstrual tracking to inform the design of personal informatics tools.  In Proceedings of the 2017 CHI Conference on Human Factors in Computing Systems, pages 6876–6888, 2017.
  * [15] Leselye Fair.  First ftc health breach notification rule case addresses goodrx’s not-so-good privacy practices.  https://www.ftc.gov/business-guidance/blog/2023/02/first-ftc-health-breach-notification-rule-case-addresses-goodrxs-not-so-good-privacy-practices, 2023.  Accessed: 2023-10-15.
  * [16] Ming Fan, Le Yu, Sen Chen, Hao Zhou, Xiapu Luo, Shuyue Li, Yang Liu, Jun Liu, and Ting Liu.  An empirical evaluation of gdpr compliance violations in android mhealth apps.  In 2020 IEEE 31st International Symposium on Software Reliability Engineering (ISSRE), pages 253–264, 2020.
  * [17] Álvaro Feal, Paolo Calciati, Narseo Vallina-Rodriguez, Carmela Troncoso, Alessandra Gorla, et al.  Angel or devil? a privacy study of mobile parental control apps.  Proceedings on Privacy Enhancing Technologies (PoPETs), 2020(2):314–335, 2020.
  * [18] FTC.  Betterhelp, inc., in the matter of.  https://www.ftc.gov/legal-library/browse/cases-proceedings/2023169-betterhelp-inc-matter, 2023.  Accessed: 2023-10-15.
  * [19] FTC.  Ovulation tracking app premom will be barred from sharing health data for advertising under proposed ftc order.  https://www.ftc.gov/news-events/news/press-releases/2023/05/ovulation-tracking-app-premom-will-be-barred-sharing-health-data-advertising-under-proposed-ftc, 2023.  Accessed: 2023-10-15.
  * [20] HHS & FTC.  Use of Online Tracking Technologies.  https://www.hhs.gov/sites/default/files/ocr-ftc-letters-re-use-online-tracking-technologies.pdf, July 20 2023.
  * [21] Irit Hadar, Tomer Hasson, Oshrat Ayalon, Eran Toch, Michael Birnhack, Sofia Sherman, and Arod Balissa.  Privacy by designers: software developers’ privacy mindset.  Empirical Software Engineering, 23:259–289, 2018.
  * [22] Catherine Han, Irwin Reyes, Álvaro Feal, Joel Reardon, Primal Wijesekera, Narseo Vallina-Rodriguez, Amit Elazar, Kenneth A Bamberger, and Serge Egelman.  The price is (not) right: Comparing privacy in free and paid apps.  Proceedings on Privacy Enhancing Technologies (PoPETs), 2020(3):222–242, 2020.
  * [23] Muhammad Hassan and Masooda Bashir.  Unveiling privacy measures in mental health applications.  In Adjunct Proceedings of the 2023 ACM International Joint Conference on Pervasive and Ubiquitous Computing & the 2023 ACM International Symposium on Wearable Computing, pages 648–654, 2023.
  * [24] Health and Human Services.  Use of Online Tracking Technologies by HIPAA Covered Entities and Business Associates.  https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/hipaa-online-tracking/index.html, December 01 2022.
  * [25] INKA Entworks Inc.  Appsealing.  https://www.appsealing.com/, September 30 2021.
  * [26] Leonardo Horn Iwaya, M Ali Babar, Awais Rashid, and Chamila Wijayarathna.  On the privacy of mental health apps: An empirical investigation and its implications for app development.  Empirical Software Engineering, 28(1):2, 2023.
  * [27] Jongsu Lim, Yonggu Shin, Sunjun Lee, Kyuho Kim, and Jeong Hyun Yi.  Survey of dynamic anti-analysis schemes for mobile malware.  J. Wirel. Mob. Networks Ubiquitous Comput. Dependable Appl., 9(3):39–49, 2018.
  * [28] Joana Muchagata and Ana Ferreira.  Translating gdpr into the mhealth practice.  In 2018 International Carnahan Conference on Security Technology (ICCST), pages 1–5, 2018.
  * [29] Trix Mulder.  Health apps, their privacy policies and the gdpr.  European Journal of Law and Technology, Jun 2019.  University of Groningen Faculty of Law Research Paper No. 15/2020.
  * [30] Uzma Mustafa, Eckhard Pflugel, and Nada Philip.  A novel privacy framework for secure m-health applications: The case of the gdpr.  In 2019 IEEE 12th International Conference on Global Security, Safety and Sustainability (ICGS3), pages 1–9, 2019.
  * [31] Trung Tin Nguyen, Michael Backes, Ninja Marnau, and Ben Stock.  Share first, ask later (or never?) studying violations of GDPR’s explicit consent in android apps.  In 30th USENIX Security Symposium (USENIX Security 21), pages 3667–3684, Berkeley, CA, USA, 2021. USENIX.
  * [32] Kristen O’Loughlin, Martha Neary, Elizabeth C. Adkins, and Stephen M. Schueller.  Reviewing the data security and privacy policies of mobile apps for depression.  Internet Interventions, 15:110–115, 2019.
  * [33] Achilleas Papageorgiou, Michael Strigkos, Eugenia Politou, Efthimios Alepis, Agusti Solanas, and Constantinos Patsakis.  Security and privacy analysis of mobile health applications: The alarming state of practice.  IEEE Access, 6:9390–9403, 2018.
  * [34] Promon.  Shield: In-App Protection and Security for Mobile Apps.  https://promon.co/products/mobile-app-protection/, September 30 2021.
  * [35] Irwin Reyes, Primal Wijesekera, Joel Reardon, Amit Elazari Bar On, Abbas Razaghpanah, Narseo Vallina-Rodriguez, Serge Egelman, et al.  “won’t somebody think of the children?” examining coppa compliance at scale.  Proceedings on Privacy Enhancing Technologies (PoPETs), 2018(3):63–83, 2018.
  * [36] Celia Rosas.  The future is femtech: Privacy and data security issues surrounding femtech applications.  Hastings Bus. LJ, 15:319, 2019.
  * [37] Nikita Samarin, Shayna Kothari, Zaina Siyed, Oscar Bjorkman, Reena Yuan, Primal Wijesekera, Noura Alomar, Jordan Fischer, Chris Hoofnagle, and Serge Egelman.  Lessons in vcr repair: Compliance of android app developers with the california consumer privacy act (ccpa).  arXiv preprint arXiv:2304.00944, 2023.
  * [38] Nikita Samarin and Primal Wijesekera.  Understanding how third-party libraries in mobile apps affect responses to subject access requests.  2023\.
  * [39] Brinda Hansraj Sampat and Bala Prabhakar.  Privacy risks and security threats in mhealth apps.  Journal of International Technology and Information Management, 26(4), 2017.
  * [40] Laura Shipp and Jorge Blasco.  How private is your period?: A systematic analysis of menstrual app privacy policies.  Proc. Priv. Enhancing Technol., 2020(4):491–510, 2020.
  * [41] Yogesh Simmhan, Tarun Rambha, Aakash Khochare, Shriram Ramesh, Animesh Baranawal, John Varghese George, Rahul Atul Bhope, Amrita Namtirtha, Amritha Sundararajan, Sharath Suresh Bhargav, et al.  Gocoronago: privacy respecting contact tracing for covid-19 management.  Journal of the Indian Institute of Science, 100:623–646, 2020.
  * [42] Ali Sunyaev, Tobias Dehling, Patrick L Taylor, and Kenneth D Mandl.  Availability and quality of mobile health app privacy policies.  Journal of the American Medical Informatics Association, 22(e1):e28–e33, 08 2014.
  * [43] Mohammad Tahaei, Julia Bernd, and Awais Rashid.  Privacy, permissions, and the health app ecosystem: A stack overflow exploration.  In Proceedings of the 2022 European Symposium on Usable Security, pages 117–130, 2022.
  * [44] Talsec.  Talsec freeRASP.  https://www.talsec.app/freerasp-in-app-protection-security-talsec, September 30 2021.
  * [45] Primal Wijesekera.  Health compliance through a transparent supply chain.  2024\.
  * [46] Hang Zhang, Dongdong She, and Zhiyun Qian.  Android root and its providers: A double-edged sword.  In Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security, CCS ’15, pages 1093–1104, New York, NY, USA, 2015. Association for Computing Machinery.

| ID / URL
---
App Name |  | App Type
---
| Service Category
---
Owner Category
| com.inova.velocity
---
| Doc990
---
Android App | Physician Appointment | Third-Party/Telecom
| doc.lk
---
| Doc990
---
Website | Physician Appointment | Third-Party/Telecom
| com.developer.odoc
---
| oDoc -
---
Video Consultations
Android App | Video Consultation | First-party/technical
| asirihealth.com
---
| Asiri Health
---
Website | Appointment/generic | Hospital
| www.durdans.com/appointments/
---
| Durdans
---
Website | Appointment/generic | Hospital
| www.nawaloka.com/channeling/
---
| Nawaloka
---
Website | Generic | Hospital
| www.lankahospitals.com/en/doctor-channeling/
---
| Lanka Hospital
---
Website | Generic | Hospital
| www.delmonhospital.com/en/find-a-doctor
---
| Delmon Hospital
---
Website | Generic | Hospital
| www.ninewellshospital.lk/appointment-booking/
---
| Nine Wells
---
Website | Appointment/generic | Hospital
| https://medihelphealth.com/
---
https://www.medihelp.lk/
| Medihelp
---
Website | Appointment/generic | Hospital
| www.wishfertility.lk/
---
| Wish Fertility
---
Website | Generic | Medical Services
| hemashospitals.com/
---
| Hemas Hospitals
---
Website | Generic | Hospital
| ivflanka.com/
---
| IVF Lanka
---
Website | Generic | Medical Services
| www.suvika.lk/
---
| Suvika
---
Website | Generic | Medical Services
| www.pfrcivf.lk/
---
| PCR IVF
---
Website | Generic | Medical Services
| jeewakaprivatehospital.lifegroup.lk/
---
channel-your-doctor/
| Jeewaka Hospital
---
Website | Generic | Hospital
| www.goldenkeyhospitals.com/
---
ask-online-from-a-consultant
| Golden EENT
---
Website | Generic | Medical Services
| www.inspirationscare.lk/#
---
| Inspiration
---
Website | Generic | Medical Services
| santadorahospital.com/
---
| Santa Dora
---
Website | Generic | Medical Services
| arogyahospitals.lk/
---
| Arogya
---
Website | Generic | Medical Services
| www.diabetessrilanka.org/
---
| National Diabetes
---
Centre
Website | Generic | Medical Info Services
| www.csth.health.gov.lk/
---
| CSTH
---
Website | Generic | Medical Info Services
| www.jaffnadiabeticcentre.org/
---
| Jaffna Diabetic
---
Centre
Website | Generic | Medical Info Services
| www.nawinna.com/
---
| Nawinna
---
Website | Generic | Medical Services
| www.queensburyhospitals.lk
---
| Queensbury
---
Website | Generic | Hospital
| diabeteshormonecenter.com/
---
| DHC
---
Website | Generic | Hospital
| ceylincocancercentre.lk/
---
| Ceylinco
---
Website | Generic | Medical Services
| cdem.lk/
---
| CDEM
---
Website | Generic | Medical Services
| com.health_assist
---
| Nawaloka
---
Android App | Generic | Hospital
| com.durdans.patientcare
---
| Durdans
---
Android App | Generic | Hospital
| www.healthguard.lk/
---
| Health Guard
---
Website | Generic | Pharmacy
| unionchemistspharmacy.lk/
---
| Union Chemist
---
Website | Generic | Pharmacy
| www.mycare.lk/
---
| mycare
---
Website | Generic | Pharmacy
| www.uniquepharmacy.lk/
---
| Unique Pharmacy
---
Website | Generic | Pharmacy
| www.carelink.lk/
---
| Carelink
---
Website | Generic | Pharmacy
| www.ceymed.lk/
---
| Ceymed
---
Website | Generic | Medical Service
| buymedicine.lk/
---
| Buy Medicine
---
Website | Generic | Pharmacy
| onlinepharmacy.lk/
---
| Online Pharmacy
---
Website | Generic | Pharmacy
| echannelling.com/
---
| eChanneling
---
Website | Physician Appointment | Third-Party
| vida.lk
---
| Vida
---
Website | Generic | Medical Services
| www.odoc.life/
---
| oDoc -
---
Video Consultations
Website | Generic | Medical Services
Table 3. List of applications tested