<figure><img src="image_1.png" /></figure>

ifip

International Federation for Information Processing

This document is the original author manuscript of a paper submitted to an IFIP
conference proceedings or other IFIP publication by Springer Nature. As such, there
may be some differences in the official published version of the paper. Such
differences, if any, are usually due to reformatting during preparation for publication or
minor corrections made by the author(s) during final proofreading of the publication
manuscript.
# Gamification in mHealth - Opportunities and Privacy Risks

Ramona Schmidt<sup>[0000-0002-9197-1536]</sup> and Ina Schiering<sup>[0000-0002-7864-5437]</sup>

Ostfalia University of Applied Sciences

Institute for Information Engineering

Wolfenbüttel, Germany

`{ramo.schmidt, i.schiering}@ostfalia.de`

**Abstract.** The use of mobile devices and wearables in healthcare is an important trend. To increase the motivation for regular use of such mHealth applications gamification elements have a huge potential. On the other hand for the integration of gamification concepts in mHealth applications personal health related data and usage data needs to be processed. Based on a categorization of gamification elements and examples for mHealth applications an overview about the aim of the use of gamification is given. It is analysed whether the processing of personal data is needed and if privacy is considered in the examples for the realization of gamification elements. Based on this analysis approaches for addressing privacy risks in gamification in mHealth are proposed.

**Keywords:** mHealth · gamification · privacy · motivation

# 1 Introduction

The broad availability of mobile devices and wearables has fostered such trends as mHealth, the increasing use of mobile devices in the health context [12]. At first many applications addressed fitness and well-being. Due to the increasing possibilities concerning sensors and data processing assistive technologies are more commonly used. This allows integrating health monitoring and rehabilitation training into everyday life. But despite the potential benefits people often stop using mHealth applications after a few times [31].

It is important to find approaches to motivate regular usage of mHealth applications and long-term commitment, to achieve the underlying health objectives [16]. Mechanics used in games motivate users to change their health behaviors and to stay engaged with the application [26]. Especially younger people are used to motivational concepts used in computer games. The derived concept of gamification tries to shape the activity itself to be motivating [25] and has a huge potential [18]. But to integrate such elements as e.g. badges, daily goals and leaderboards in mHealth applications personal data and usage data has to be processed. Since security and privacy of mHealth applications are crucial [22, 23], privacy risks need to be considered also for gamification elements.
To this end typical examples are selected based on a categorization of archetypes of applications [27], motivational aim of these elements is summarized and it is explored to which extent privacy aspects are already considered. Applications focused on specific illnesses are still in the process of development. To consider a broad range of users, who will sooner or later also be part of the target group of medical programs, fitness and well-being applications are as well evaluated as mHealth applications for rehabilitation and other health-related therapies. Further the usages of the gamification elements are investigated from a privacy perspective. Approaches for a privacy-preserving realisation are proposed.

## 2 Gamification

Gamification is defined by Deterding as the use of design elements characteristic for games in non-game contexts [6]. A gamification concept is typically based on a variety of elements, as e.g. points, leaderboards and daily goals, that foster the motivation of users. The variety of game elements employed in gamification is broad. Different sources discuss and differentiate varying elements. Garett and Young identified 14 different elements [8] whereas Sardi et al. focus on only four elements and sum up “others” [26] for additional elements. Based on an investigation of literature reviews concerning gamification elements, the following ten elements are stated as the most common and most used elements which are directly visible to users [25, 28, 26, 7, 14, 4]: avatars, badges, daily goals, leaderboards, level, performance graphs, points, progress bars, storytelling and teams (see Table 1 for an overview).

Typically, a combination of elements is used in a specific context. An avatar of a user or a team can be for example integrated in a narrative context and combined with storytelling [25]. As an example an application in which users have to run regularly could draw a narrative context by embedding this activity in a story about a zombie apocalypse. Within the storytelling multiple users could form a group of survivors doing the health-related activities together as a team.

Avatars and storytelling can furthermore be linked with rewards [26, 28] or with badges, level or daily goals while unlocking new content. Expending the previous example in the context of running and the story of surviving, levels could be represented as different forms of survivors e.g. from “fearful newbie” to “survival artist”. Leaderboards, level, progress bars and performance graphs are representations of a users performance based on defined metrics. Therefore these elements are typically combined with points as a basis to make metrics transparent. Performance graphs can also render the fulfillment’s of daily goals over time transparent for users.

To describe the motivational aim of gamification elements, the psychological background needs to be briefly summarized. The effect of gamification is according to the self-determination theory based on basic psychological and intrinsic needs for competence, autonomy and social relatedness [25, 16]. Competence is experienced in events with positive feedback that imply effectiveness. Autonomy
<table><caption>Table 1: Gamification elements</caption><thead><tr><th rowspan="2"></th><th rowspan="2"></th><th colspan="3">Aim</th></tr><tr><th>autonomy</th><th>relatedness</th><th>competence</th></tr></thead><tbody><tr><td colspan="5"><strong>Elements with social focus</strong></td></tr><tr><td>avatar</td><td><em>Avatars</em> are visual representations (e.g. of the user). Users can design them individually or chose them out of a given collection. The visual options are manifold [25]. They can also be used as personifications of aspects of the application [28].</td><td>x</td><td></td><td></td></tr><tr><td></td><td></td><td colspan="3">personalizing, self-identification [25]</td></tr><tr><td>storytelling</td><td>The element of <em>storytelling</em> embeds activities of an application in a narrative context which can be fictive or trying to convert a complex matter in a real context [25].</td><td>x</td><td>x</td><td></td></tr><tr><td></td><td></td><td colspan="3">cooperation [25]</td></tr><tr><td>teams</td><td>A <em>team context</em> motivates multiple users to work in a cooperative way on a shared goal [25]. Enabling the option to compare multiple teams or the users performance in the team itself adds additional competitive aspects. [33].</td><td></td><td>x</td><td></td></tr><tr><td></td><td></td><td colspan="3">relevance, cooperation, competition [25, 4]</td></tr><tr><td colspan="5"><strong>Elements for specific goals</strong></td></tr><tr><td>daily goals</td><td><em>Daily goals</em> are primary goals or multiple daily challenges which can change on a daily basis [7] or can simply be renewed after a specific period of time. It is additionally possible to adapt the corresponding goals according to the performance of the users [33].</td><td></td><td></td><td>x</td></tr><tr><td></td><td></td><td colspan="3">randomness, curiosity [4]</td></tr><tr><td>badges</td><td><em>Badges</em> are optional goals and rewards for achieving these goals consisting of the visual badge itself, the reward and the condition for fulfillment [13].</td><td></td><td>x</td><td>x</td></tr><tr><td></td><td></td><td colspan="3">cumulative feedback [25], self-confidence, guidance [13]</td></tr><tr><td colspan="5"><strong>Elements for continuous monitoring</strong></td></tr><tr><td>points</td><td><em>Points</em> are a basic game element. Specified defined activities within the gamified environment can give the user points [26]. They can be used as a simple representation of progress or as redeemable currency or reputation points [25].</td><td></td><td></td><td>x</td></tr><tr><td></td><td></td><td colspan="3">constant feedback [25], progress [4]</td></tr><tr><td>level</td><td><em>Levels</em> are a representation of progress by depending on specific achievements (e.g. a number of points). It can be further a representation of varying difficulties [28].</td><td></td><td></td><td>x</td></tr><tr><td></td><td></td><td colspan="3">progress, increasing difficulty [4]</td></tr><tr><td>progress bar</td><td>A <em>progress bar</em> displays progress for example within a level or a badge condition. It illustrates feedback over already accomplished progress and the amount of effort still to be performed to achieve the level or badge [26, 14].</td><td></td><td></td><td>x</td></tr><tr><td></td><td></td><td colspan="3">progress over time [26], overview [14]</td></tr><tr><td>performance graph</td><td><em>Performance graphs</em> represent the users performance described via metrics over time [25].</td><td></td><td></td><td>x</td></tr><tr><td></td><td></td><td colspan="3">continuing feedback [25]</td></tr><tr><td colspan="5"><strong>Complementary element</strong></td></tr><tr><td>leaderboard</td><td><em>Leaderboards</em> foster competition between participants. They represent a ranking of participants according to their performance [26].</td><td></td><td>x</td><td>x</td></tr><tr><td></td><td></td><td colspan="3">cumulative feedback, competition [25, 26]</td></tr></tbody></table>
is achieved by providing choice and acknowledging experience. *Relatedness* is combined with social acceptance and recognition. The satisfaction of these needs fosters intrinsically motivated behaviour and can be integrated in extrinsic motivations [5]. Providing feedback on a users performance is a way to evoke the feeling of competence [25]. Additionally other psychological effects like curiosity [4], self-identification [25] and self-confidence [24] can lead to the interaction with gamification elements.

Furthermore the elements can be sub-classified according to the context they are typically used in. Elements which can be seen in a *social context* drawing a narrative context and representing the users themselves as well as their role in the narrative or application are avatars, storytelling and teams. These elements create representations and frames within the application. Through different psychological effects, e.g. personalizing and cooperation, they satisfy the needs for autonomy and social relatedness. Daily goals and badges can be described as *specific goals* with clear conditions and the possibility of fulfilling. Whereas points, level, progress bars and performance graphs have a *continuous* background. They mostly provide different forms of feedback and satisfy with that the need for competence. Leaderboards are a combination of continuous goals in a social environment and for that are *complementary* to the other elements.

## 3 Related Work

The use of gamification in mHealth is already investigated in several contexts. For an overview of gamification research in general and an investigation of effectiveness see Koivisto and Hamari [16]. An example is *The Heart Game* [7], a prototype with daily challenges and additional gamification elements to motivate users like badges, leaderboard, levels and a point system. Other Examples are the prototypical applications *Sana* [17], *Fitrust* [29], *bant* [3], *More Stamina* [9] and *Regain* [1].

Cheng et al. [4] investigated applications of gamification for mental health and well-being. They considered which elements are most commonly applied, which domains are most commonly targeted and what reasons are given for using gamification in these applications. An overview of gamification elements employed in an healthcare context is presented by Garett and Young [8]. Especially employed gamification strategies in e-Health as well as the benefits and the most encountered challenges are analyzed by Sardi et al. [26]. There the potential of gamification for health application is broadly investigated.

Disregarding privacy and effectiveness Schmidt-Kraepelin et al. [27] investigated different archetypes of gamification approaches and their relationship to the targeted health behavior. Furthermore independent of the gamification context Pires et al. [24] constructed a classification of mobile health applications by their functionality.

Mavroeidi et al. [21, 20] investigated potential conflicts of specific elements with privacy requirements like anonymity, pseudonymity, unlinkability, unde-
tectability and unobservability and categorized different game elements in harmful and non-harmful elements but without considering the context of the application. The categorization is amongst others based on the differentiation whether users information or actions are recorded and constrained by time.

Although gamification can introduce additional privacy risks by acquiring and recording a huge amount of personal data [11], in the description of gamified applications privacy issues are often not discussed. Several examples which are investigated as *The Heart Game* [7], *Sana* [17] and *Fitrust* [29]. Sardi et al. [26] mention the importance of privacy and security in general in the context of the protection of personal health data, but do not provide a deeper analysis.

Bilbey and Sandikkaya [2] studied the effects of gamification on privacy in a gamified context. They concluded that users of gamified environments are less careful protecting their private information especially when participants are already lured into the gamified environment and enforced to disclose personal information to continue. Therefore the investigation of privacy in gamification applications is an interesting field for further investigation in the conflict between fostering the important aspect of motivation of users to enhance usage times on one hand and the consideration of privacy risks on the other hand.

# 4 Methodology

Mavroeidi et al. [21, 20] already investigated privacy in gamification on a general basis. But in a health context especially in the area of mental health and cognitive deficiencies already the use of an app contains the risk of stigmatization. For example a person using a mobile device at work is often considered a distracted worker, although the used application actually might help the person to stay focused.

To provide a broad overview of gamification in mHealth the archetypes of Schmidt-Kraepelin et al. [27] are used and examples for mHealth apps for the considered types are provided. Using these archetypes ensures that the examples are selected from different fields of mHealth applications which pursue different objectives and use the concept of gamification in various forms. For these examples the employed gamification elements and their motivational aim is summarized and it is investigated whether in the context of the application itself and the additional gamification elements privacy is directly mentioned. In addition it is investigated whether the data needed for gamification elements is justified by the intended effect from the point of view of the users and which opportunities exist to reduce privacy risks.

# 5 Analysis

## 5.1 Selection of examples

Based on the archetypes of Schmidt-Kraepelin et al. [27] examples of mHealth applications targeting patients were selected which employ gamification. *Archetype*
7 *Positive and Negative Reinforcement Without Rewards* and *Archetype 8 Pro-gressive Gamification for Health Professionals* were both disregarded since they solely target health professionals. In the following the examples and their clas-sification according to the archetypes are described. For an overview see table 2.

<table><caption>Table 2: Selection of examples of mHealth applications based on the archetypes of Schmidt-Kraepelin et al. [27]</caption><thead><tr><td>Archetype</td><td>Application</td><td>Goal of application</td></tr></thead><tbody><tr><td>1: Competition and Collaboration</td><td>Fitrust</td><td>Help to lose, maintain or gain weight</td></tr><tr><td>1: Competition and Collaboration</td><td>Heart Game</td><td>Assist heart patients in their telerehabilitation</td></tr><tr><td>2: Pursuing Self-Set Goals Without Rewards</td><td>Zwift</td><td>Indoor athletic performance</td></tr><tr><td>3: Episodical Compliance Tracking</td><td>Sana</td><td>Imitate physiotherapy sessions for post-operative acl reconstruction patients</td></tr><tr><td>3: Episodical Compliance Tracking</td><td>Regain</td><td>Help stroke patients in rehabilitation at home</td></tr><tr><td>4: Inherent Gamification for External Goals</td><td>Let's farm</td><td>Help stroke patients in rehabilitation</td></tr><tr><td>5: Internal Rewards for Self-Set Goals</td><td>More Stamina</td><td>Help persons with multiple sclerosis managing their energy</td></tr><tr><td>6: Continuous Assistance Through Positive Reinforcement</td><td>Bant</td><td>Management of type 1 diabetes in adolescents</td></tr></tbody></table>

*Fitrust* is an application integrating Fitbit's and Nutritionix web API to gain and analyse information like users steps and heart rate time series as well as record food and exercise calorie information to help the users to lose, maintain or gain weight [29]. This can be assigned to *Archetype 1 Competition and Collaboration* which contains competitive and collaborative gamification elements helping the users reaching externally and self-set goals while the gamification approach is independent of the underlying health activity. To the same archetype another application *The Heart Game* assisting heart patients in their telerehabilitation process can be allocated. It uses several gamification elements presenting each day exercises as daily goals for a team of two, a patient and a companion, while offering the use of a point system, badges, a leaderboard, a progress bar, level and performance graphs [7].

*Archetype 2 Pursuing Self-Set Goals Without Rewards* exclusively draws on goals that are set by the users themselves and does not offer any type of explicit rewards for specific health-related activities like badges. An example that can
also be seen as a serious game but is still a good example to represent this
archetype is *Zwift*. This application enables virtual sports while recording real-
world athletic performances [32].

The *Sana* system and the *Regain* App are both developed for increasing en-
gagement and improving rehabilitation programs. *Sana* imitates real-life phys-
iotherapy sessions for post-operative anterior cruciate ligament reconstruction
patients simplifying the exercises to the goal of reaching a green circle [17]. *Re-
gain* helps stroke patients in rehabilitation at home by providing exercises with
animated self-avatars in a familiar environment like a garden or living room [1].
Both systems belong to *Archetype 3 Episodical Compliance Tracking* targeting
amongst other therapy adherence where the narrative is always episodical.

Another application concerning stroke patients is *Let's Farm* transferring and embedding recovery exercises as various farming activities [19]. This is an implementation of *Archetype 4 Inherent Gamification for External Goals* where the health-related activity is partially or fully embedded in the gamification approach and therefore it is impossible to execute this without interacting with the gamification elements.

*Archetype 5 Internal Rewards for Self-Set Goals* describes the use of gamification evoking users' behavior and attitude to change by experiencing positive and negative reinforcements for decisions concerning self-set goals. For that solely internal rewards like points and badges are used without any form of competition. *More Stamina* tries to help persons with multiple sclerosis to manage their energy by transferring it to a point system. The users spend these points on self-set activities and achieve badges for example for continuous usage and correct energy assessments [9].

An application consistent with *Archetype 6 Continuous Assistance Through Positive Reinforcement* is the *bant* app for the management of type 1 diabetes in adolescents [3]. This archetype targets patients requiring continuous assistance and therapy adherence not containing any competitive elements or negative reinforcements and offering no rewards like badges.

## 5.2 Investigation of the examples

As a first step of the analysis it was investigated whether privacy was already ad-
dressed in the description of the examples. Table 3 shows the results. Five of the
examples, *Fitrust*, *Heart Game*, *Zwift*, *Sana* and *Let's farm*, did not discussed
privacy at all. For *Regain* a requirement for security was defined, but no privacy
issues were addressed. *More Stamina* and *Bant* addressed some privacy con-
siderations. However, while these considerations refer to privacy concerning the
functionality of the application, the gamification elements were not considered.

Investigating possible privacy risks, all examples were analysed which data
is needed or shown by the ten different elements presented in Section 2. The
results for elements with social focus are summarised in Table 4a, for elements
for continuous monitoring in Table 4b and for elements for specific goals as well
as the complementary element in Table 4c.
<table><caption>Table 3: How privacy was addressed in the examples</caption><tr><td>Fitrust [29]</td><td>not addressed</td></tr><tr><td>Heart Game [7]</td><td>not addressed</td></tr><tr><td>Zwift [32]</td><td>not addressed</td></tr><tr><td>Sana [17]</td><td>not addressed</td></tr><tr><td>Regain [1]</td><td>only addresses security:<br>“The design artifact has to enable healthcare professionals to have access to the stroke survivors’ data remotely and in a secure way in order to assess the progress, and make adjustment to the rehabilitation program.” [1]</td></tr><tr><td>Let’s farm [19]</td><td>not addressed</td></tr><tr><td>More Stamina [9]</td><td>addresses privacy concerning the functionality:<br>“usage statistics are gathered locally for each added activity to keep track and collect assessments; the user can choose to share these statistics to a secure server for analysis” [9] and “users will have full control as to which information to disclose and with whom, whether it is personal, clinical, or treatment-related. Additionally, they can opt in to send de-identified information for research purposes.” [9]</td></tr><tr><td>bant [3]</td><td>addresses privacy concerning the functionality:<br>communication between peers happen “in a secure community area of the app” [3] and that “this was achieved through a private microblogging platform similar to the social network Twitter. It used the open-source alternative StatusNet (available at http://status.net/) running on a secure server at our center at Toronto General Hospital.” [3]<br>Additionally they provided the possibility of sharing “test results and diabetes-related information with parents (as well as peers and clinic staff) via secure online tools and communities for sharing results” and for that “elected to integrate the mobile app with a secure online personal health record called TELUS health space” [3]</td></tr></table>

The investigated examples needed for elements with social focus primarily to record customization choices. Only the progression of the storyline in *Let's Farm* or the individual engagement based on the users improvement in *Sana* needed additionally a small amount on user-specific performance data.

In contrast for gamification elements for continuous monitoring the choices of the users have hardly influence on the recorded data. Points were given for activities needed to use the application as intended. For example *bant* is an application for management of type 1 diabetes. To manage diabetes it is important to do blood glucose testing. Points are given and recorded for each test the users perform and for that only depend on the choice to use the application itself. In every example the points were recorded accumulated.

For the implementation of level two of three applications did not need any other data and could calculate the level based on the points. Similarly four of five
<table><caption>Table 4: Analysis which data is needed or shown</caption><caption>(a) Data for gamification elements with social focus</caption><thead><tr><th></th><th> avatar </th><th> story </th><th> team </th></tr></thead><tbody><tr><td> Heart Game [7] </td><td> - </td><td> - </td><td> names and points per teammate ● </td></tr><tr><td> Regain [1] </td><td> adjustable gender and colors ● </td><td> selectable environment (garden/living room) ● </td><td> - </td></tr><tr><td> Let's Farm [19] </td><td> user-picture, customizable story avatar ● </td><td> monitoring if all available exercises were executed and storage progress approval by therapist ● </td><td> user-picture for each teammate participating in specific exercise ● </td></tr><tr><td> Sana [17] </td><td> - </td><td> e.g. average pain score ● </td><td> - </td></tr><tr><td> Fitrust [29] </td><td> customizable abstract picture, name and title ● </td><td> ○ </td><td> - </td></tr></tbody></table>

<table><caption>(b) Data for gamification elements for continuous monitoring</caption><thead><tr><th></th><th> points </th><th> level </th><th> progress bar </th><th> performance graph </th></tr></thead><tbody><tr><td> bant [3] </td><td> e.g. amount of tests per day and per different context ● </td><td> per 200 points ● </td><td> - </td><td> - </td></tr><tr><td> More Stamina [9] </td><td> available energy to be spent user-controlled ● </td><td> - </td><td> additional representation of energy (see points) ● </td><td> - </td></tr><tr><td> Heart Game [7] </td><td> gained for each task in individually amount and accumulated weekly ● </td><td> for specific amount or progress until a specific amount of points ● </td><td> depend on specific amount of points on weekly basis ● </td><td> points per day, finished challenges and corresponding points ● </td></tr><tr><td> Let's Farm [19] </td><td> Accumulation of coins gained per task in individual amount ● </td><td> completion of all current tasks and approval by therapist ● </td><td> amount of executions per exercise ● </td><td> - </td></tr><tr><td> Sana [17] </td><td> - </td><td> - </td><td> progress concerning therapy goal (specific height and last achieved/average height) ● </td><td> Accuracy and range per day ● </td></tr><tr><td> Fitrust [29] </td><td> Accumulated and earned per daily goal and exercise mode (different per exercise) ● </td><td> - </td><td> progress within daily goal ● </td><td> steps per day ● </td></tr></tbody></table>

<table><caption>(c) Data for gamification elements for specific goals and complementary elements</caption><thead><tr><th></th><th> daily goals </th><th> badges </th><th> leaderboard </th></tr></thead><tbody><tr><td> Heart Game [7] </td><td> ○ </td><td> e.g. amount of completed challenges ● </td><td> team names and points per team ● </td></tr><tr><td> Let's Farm [19] </td><td> - </td><td> - </td><td> user-picture and points ● </td></tr><tr><td> Fitrust [29] </td><td> amount of steps and glasses of water drunk ● </td><td> e.g. rank in leaderboard or number of exercises executed ● </td><td> points, badges and avatar ● </td></tr></tbody></table>

- element not used, ○ no data needed, ● no additional data needed, ● data needed
applications used the progress bar only as additional display and reuse the data already recorded by other elements. All examples using a performance graph recorded the shown data per day.

The gamification elements for specific goals were mostly described exemplar-
ily. Especially the badges could have needed far more data than shown. However
the daily goals were significantly simpler than the badges. In *The Heart Game*
they were solely used as daily suggestion and therefore did not need any personal
data at all. Further in *Fitrust* only simple data like steps and glasses drunk were
needed. The leaderboard as complementary element did not need specific data
itself but rather combined other gamification elements and thus needed the data
they record.

When multiple users are linked together as in case of teams and leaderboards a centralized component for data processing is needed. If the teammates share the usage data locally as for example in *The Heart Game*, since they both use the same device, this is not necessary. The actual connection of users within a leaderboard can be avoided by using virtual opponents which in addition can be adapted to the user's performance. The other elements like points, level, progress, performance graphs, badges, daily goals, avatars and storytelling could be processed locally.

In summary the elements with social focus needed some customization choices but recorded only a small amount of performance data. Elements for continuous monitoring on the contrary did not need customization choices, instead constant performance data had to be collected. Points were always accumulated and the performance graphs displayed data per day. Level and progress bars were mostly solely used as additional displays. The elements for specific goals were only described exemplary. However the daily goals were simpler than badges. Finally the leaderboard does not record data itself but needs other elements (e.g. points) which record data. The privacy issues concerning the used gamification elements were not discussed in the investigated examples and should be evaluated further.

6 Addressing Privacy Risks of Gamification Elements

Since gamification is an important mean to foster motivation for continuous use of mHealth apps [18], it is not the main aim of the mHealth app but nevertheless supports the corresponding goals. Therefore, these additional elements should not include additional privacy risks. Hence the principle of data minimisation should be a central design criteria and since in some cases (e.g. mental health) already the use of an mHealth app may result in stigmatization of patients, anonymization or at least a strong pseudonymization of patient data and the privacy protection goal of unlinkability [15] are important. To realize these central goals beside data minimization, decentralization [30] as a guiding principle is important. Data for gamification elements should be processed only on the device of the user where possible. In the following it is analyzed how these principles could be applied in the context of the gamification elements employed in the context of the examples for mHealth applications.
Based on the classification of the gamification elements in chapter 2 in the following the privacy risks are further investigated. *Regain*, *More Stamina* and *bant* used in each case only two gamification elements while in addition for *More Stamina* and *bant* the level and progress bar was only a further representation. The Heart Game and Fitrust are both applications of the archetype 1 (see chapter 5.1). Because of this as leading examples the applications *Fitrust*, *Sana* and *Let's Farm* are used. None of these already addressed privacy risks (see chapter 5.2). All three applications use elements with *social focus* and will be compared for the investigation. The elements with a focus on *continuous monitoring* will be further described by the examples *Let's Farm* for points and level as well as *Sana* for the progress bar and the performance graph. The elements for *specific goals* and the leaderboard as example for *complementary elements* are investigated based on the example *Fitrust*.

<figure><img src="image_2.png" /><figcaption>Fig. 1: Avatars</figcaption></figure>

## 6.1 Elements with social focus

Elements with *social focus* offer many opportunities for personalization. The more options are available, the more information about the user might be revealed. In *Let's Farm* the users can upload an individual user picture (see figure 1b). These pictures can reveal a lot about a person especially when interconnected with other users like in a leaderboard or in a team context. For example a user could upload a picture that shows the person itself in the living room. This reveals on the one hand the person behind this user. On the other hand the background shows how this person lives and for example possibly the wealth
<figure><img src="image_3.png" /><figcaption>Fig. 2: Storytelling</figcaption></figure>

status or some clues about the location. In contrast in *Fitrust* users can choose from a given selection of abstract pictures. Additionally the users can choose and arrange different titles describing themselves and provide a freely choosable name (see figure 1a). Although the options of pictures and titles are limited, the same issue of revealing personal aspects might occur. Since this privacy issue is mostly based on users choices, it is advisable to use a privacy awareness panel. In such a panel the users can be warned about the consequences of specific shared data and which data are visible to others and to whom [10].

The more adapted a story is to a specific user the more information about the person is needed. *Fitrust* only provides a short story at the beginning independent of the users interests (see figure 2c) creating a frame the users can draw further in their minds while using the application. This implementation does not lead to privacy issues. However personalization can be desirable because a story is particularly inspiring and motivating if it is in line with the personal interests of the user [25]. For that *Sana* simulates a physiotherapist encouraging the user to create a familiar environment. Only expressing encouragement by cheering up users during an exercise with motivational messages like “A little bit more” (see figure 2b) does not need permanent storage of data, only the current progress within the exercise. To personalize this encouragement without recording data over a longer period, it is possible to solely store the performance of the last time. Saying that the user have done better than yesterday as an additional motivation factor. Furthermore *Sana* additionally encourages users outside the exercises by messages which for example address the decrease of users average pain score. For this feedback the recording of the pain score is needed. Personalized feedback like that is based on processing of personal data. Even though the adjustment of feedback appropriate to the level of the patient is crucial [26],
<figure><img src="image_4.png" /><figcaption>Fig. 3: Elements for continuous monitoring and teams in Let's Farm [19]</figcaption></figure>

it is important to investigate for each context which amount of personalization and data is needed for a meaningful feedback.

As noted before gamification elements should not include additional privacy risks. However to effectively simplify a complex matter within a story, it is often necessary to process additional data. As example in *Sana* the users have to train their knee. The application wraps this activity in the simple goal of reaching a green circle instead of only specifying a specific angle the knee shall reach (see figure 2b). This can be implemented in two ways. On the one hand the users can be provided with this goal but still have to monitor the position of their knee themselves. On the other hand, if the users should get specific feedback so that they do not have to monitor the angle themselves, it is necessary to measure the performance of the users leg. How much the user is embedded in the wrapping story and for that is motivated by simplification depends on the implementation. To this end it is important to discuss for each context what level of personalization and simplification is actually needed.

## 6.2 Elements for continuous monitoring

Gamification elements for *continuous monitoring* often need to record data for longer periods. Points based on a reward system like in *Let's Farm* (see figure 3b) and level persist, though the raw data needed to earn a level or a specific amount of points does not have to be stored permanently when aggregation is applied and data storage is limited. *Let's Farm* rewards the users after an exercise with
<figure><img src="image_5.png" /><figcaption>Fig. 4: Elements for continuous monitoring in Sana [17]</figcaption></figure>

coins per execution. After each exercise the earned coins can be aggregated and added to coins a user already earned so far such that only the sum of coins and the actual level needs to be stored.

However, the direct conversion from one execution of an activity to a specific amount of coins might lead to the issue of deriving additional information, like how many activities were executed. To avoid this issue differing amounts of points per specific activity can be chosen or the data can be perturbed by adding random points. Nevertheless these principles depend on the attacker model and which information is available to the attacker. Even if aggregation is always recommendable an attacker who can observe the changes could reveal which kind of activities a user did or reduce the possibilities if different amount of points per activity were chosen.

A progress bar is another typical element for visualizing progress. As mentioned in section 5 most of the applications use the progress bar as additional visual element and use data already needed by other elements like for example points. As of that aggregation and storage limitation shall be applied in this case as well. Two data points are needed for each progress bar, the current status and the intended goal (see figure 4a). Recorded data can be aggregated to one current progress point. After reaching the goal, all information about the progress and the specific goal can be deleted and at most the information about the completed goal needs to be saved.

In a performance graph the data is time-related and aggregation is limited. These graphs provide information about the users performance compared to their
<figure><img src="image_6.png" /><figcaption>Fig. 5: Elements for specific goals in Fitrust [29]</figcaption></figure>

preceding performance over a fixed period. The users focus on improvements by evaluating their own performance over time [25]. The recorded data can still be minimized by recording and saving only relations between data points and not time-stamps. In *Sana* for example the users can check their accuracy over the days using the application without any precise dates (see figure 4b).

## 6.3 Elements for specific goals

A relatively comprehensive set of data is needed in case of defining specific goals. The more goals are provided and the more complex and diverse these goals are, the more corresponding specific progress data is needed and has to be captured. To render it more difficult to combine or correlate this data it might be useful to separate it by isolating the data in different databases. In *Fitrust* for example all data needed for badges concerning the exercise mode could be stored in a different database than data referring to the monitoring of intake (see figure 5).

A badge consists of its visualisation, the achievement and the condition for fulfillment (see as example figure 5b). The condition defines which data and what amount of data is needed. The achievement of a badge can be recorded via a single data point. After completing the condition of a specific badge, the related data is not necessary anymore and can be deleted. Only the information about the achieved badges has to be stored.

## 6.4 Leaderboard as complementary element

The main issue concerning a *complementary element* like a leaderboard, that shares information with other users, is the possibility of deducing additional
<figure><img src="image_7.png" /><figcaption>Fig. 6: Complementary element (Leaderboard) in Fitrust [29]</figcaption></figure>

information. In *Fitrust* the leaderboard shows to other users generally the picture and the name of the avatar and the earned points of a user. By clicking on a specific user the chosen titles as well as all earned badges of this user are revealed. In figure 6 for an explanatory example, the leading place in the leaderboard is actually a user with an avatar name “Johnny Gh”. Furthermore this user has earned all badges regarding the leaderboard as well as two badges for using the exercise mode. As title the user has chosen “Enthusiast and Runner”. With this information it can be assumed that this user is male and actively involved in sports, mainly in running activities. He is not monitoring his intake since he has not got any badges regarding the option of recording intake (see figure 5, 6). Since the badges suggest that he is using the application only for doing workout but still got a lot of points, this user is doing a lot of workout and is probably using *Fitrust* for a longer period than most of the others.

Because of this issue of deduced information, it is important to inform users about potential risks and to be careful with the decision to connect multiple users and elements. An important factor is that the more elements are visible to other users the more information about a specific user can be deduced. Furthermore it should be possible to hide personal data by, for example, restricting the access to this information.

# 7 Conclusion

The investigation of privacy risks of gamification elements in mHealth applications is often not considered. Especially in an healthcare context motivational aspects are important but should be integrated in a privacy aware manner. Privacy risks should be taken into account for developing a gamification strategy in the context of a privacy by design process. Gamification elements could be clus-
tered according to their focus. As central goals data minimization, unlinkability and decentralization should be considered as central principles.

## References

1. Aljaroodi, H.M., Adam, M.T.P., Chiong, R., Cornforth, D.J., Minichiello, M.: Em-pathic avatars in stroke rehabilitation: A co-designed mhealth artifact for stroke survivors. In: Maedche, A., vom Brocke, J., Hevner, A. (eds.) Designing the Digital Transformation. pp. 73–89. Springer International Publishing, Cham (2017)

2. Bilbey, T., Sandikkaya, M.T.: Effects of gamification to private data collection. Journal of Computational Design 1(3), 131–152 (2020)

3. Cafazzo, J.A., Casselman, M., Hamming, N., Katzman, D.K., Palmert, M.R.: De-sign of an mhealth app for the self-management of adolescent type 1 diabetes: a pilot study. Journal of medical Internet research 14(3), e70 (2012)

4. Cheng, V.W.S., Davenport, T., Johnson, D., Vella, K., Hickie, I.B.: Gamification in apps and technologies for improving mental health and well-being: Systematic review. JMIR Mental Health 6(6), e13717 (06 2019)

5. Deci, E.L., Ryan, R.M.: The "what" and "why" of goal pursuits: Human needs and the self-determination of behavior. Psychological inquiry 11(4), 227–268 (2000)

6. Deterding, S., Dixon, D., Khaled, R., Nacke, L.: From game design elements to gamefulness: defining" gamification". In: Proceedings of the 15th international academic MindTrek conference: Envisioning future media environments. pp. 9–15 (2011)

7. Dithmer, M., Rasmussen, J.O., Grönvall, E., Spindler, H., Hansen, J., Nielsen, G., Sørensen, S.B., Dinesen, B.: "the heart game": Using gamification as part of a telerehabilitation program for heart patients. Games for Health Journal 5(1), 27 – 33 (2016)

8. Garett, R., Young, S.D.: Health care gamification: A study of game mechanics and elements. Technology, Knowledge and Learning 24(3), 341 – 353 (09 2019)

9. Giunti, G., Mylonopoulou, V., Romero, O.R.: More stamina, a gamified mhealth so-lution for persons with multiple sclerosis: research through design. JMIR mHealth uHealth 6(3), e51 (2018)

10. Graf, C., Wolkerstorfer, P., Geven, A., Tscheligi, M.: A pattern collection for pri-vacy enhancing technology. In: The 2nd Int. Conf. on Pervasive Patterns and Ap-plications (PATTERNS 2010). pp. 21–26 (2010)

11. Groh, F.: Gamification: State of the art definition and utilization. Institute of Media Informatics Ulm University (2012)

12. Guo, X., Han, X., Zhang, X., Dang, Y., Chen, C.: Investigating m-health accep-tance from a protection motivation theory perspective: Gender and age differences. Telemedicine and e-Health 21(8), 661 – 669 (2015)

13. Hamari, J.: Do badges increase user activity? a field experiment on the effects of gamification. Computers in Human Behavior 71, 469 – 478 (2017)

14. Hamari, J., Hassan, L., Dias, A.: Gamification, quantified-self or social network-ing? matching users' goals with motivational technology. User Modeling and User-Adapted Interaction 28, 35 – 74 (2018)

15. Hansen, M., Jensen, M., Rost, M.: Protection goals for privacy engineering. In: 2015 IEEE Security and Privacy Workshops. pp. 159–166 (2015)

16. Koivisto, J., Hamari, J.: The rise of motivational information systems: A review of gamification research. International Journal of Information Management 45, 191 – 210 (2019)
17. Kungwengwe, T., Evans, R.: Sana: A gamified rehabilitation management system for anterior cruciate ligament reconstruction recovery. Applied Sciences **10**(14), 4868 (2020)

18. Lee, C., Lee, K., Lee, D.: Mobile healthcare applications and gamification for sustained health maintenance. Sustainability **9**(5) (2017)

19. Li, C.: Gamified rehabilitation service designed for stroke patient. Master's thesis, Høgskolen i Oslo og Akershus. Institutt for Produktdesign (2017)

20. Mavroeidi, A.G., Kitsiou, A., Kalloniatis, C.: The role of gamification in privacy protection and user engagement. In: Security and Privacy From a Legal, Ethical, and Technical Perspective. IntechOpen (2020)
https://doi.org/10.1109/ACCESS.2020.2999934

21. Mavroeidi, A.G., Kitsiou, A., Kalloniatis, C., Gritzalis, S.: Gamification vs. privacy: Identifying and analysing the major concerns. Future Internet **11**(3), 67 (2019)

22. Nurgalieva, L., O'Callaghan, D., Doherty, G.: Security and privacy of mhealth applications: A scoping review. IEEE Access **8**, 104247-104268 (2020).
https://doi.org/10.1109/ACCESS.2020.2999934

23. Papageorgiou, A., Strigkos, M., Politou, E., Alepis, E., Solanas, A., Patsakis, C.: Security and privacy analysis of mobile health applications: The alarming state of practice. IEEE Access **6**, 9390-9403 (2018).
https://doi.org/10.1109/ACCESS.2018.2799522

24. Pires, I.M., Marques, G., Garcia, N.M., Flórez-Revuelta, F., Ponciano, V., Oniani, S.: A research on the classification and applicability of the mobile health applications. Journal of personalized medicine **10**(1), 11 (2020)

25. Sailer, M., Hense, J.U., Mayr, S.K., Mandl, H.: How gamification motivates: An experimental study of the effects of specific game design elements on psychological need satisfaction. Computers in Human Behavior **69**, 371-380 (2017).
https://doi.org/https://doi.org/10.1016/j.chb.2016.12.033

26. Sardi, L., Idri, A., Fernández-Alemán, J.L.: A systematic review of gamification in e-health. Journal of Biomedical Informatics **71**, 31-48 (2017).
https://doi.org/https://doi.org/10.1016/j.jbi.2017.05.011

27. Schmidt-Kraepelin, M., Toussaint, P.A., Thiebes, S., Hamari, J., Sunyaev, A.: Archetypes of gamification: Analysis of mhealth apps. JMIR MHealth uHealth **8**(10), e19280 (2020)

28. Seaborn, K., Fels, D.I.: Gamification in theory and action: A survey. International Journal of Human-Computer Studies **74**, 14-31 (2015).
https://doi.org/https://doi.org/10.1016/j.ijhcs.2014.09.006

29. Setiawan, S.S., Suryadibrata, A.: Fitrust: Promoting healthy lifestyle through gamified mobile health application. In: 2019 5th International Conference on New Media Studies (CONMEDIA). pp. 26-30 (2019)

30. Troncoso, C., Isaakidis, M., Danezis, G., Halpin, H.: Systematizing decentralization and privacy: Lessons from 15 years of research and deployments. Proceedings on Privacy Enhancing Technologies **4**, 307-329 (2017)

31. Vaghefi, I., Tulu, B.: The continued use of mobile health apps: Insights from a longitudinal study. JMIR Mhealth Uhealth **7**(8), e12983 (Aug 2019),
https://doi.org/10.2196/12983

32. Westmattelmann, D., Grotenhermen, J.G., Stoffers, B., Schewe, G.: Exploring the adoption of mixed-reality sport platforms: A qualitative study on zwift. ECIS 2021 Research Papers (2021)

33. Zuckermann, O., Gal-Oz, A.: Deconstructing gamification: evaluating the effectiveness of continuous measurement, virtual rewards, and social comparison for promoting physical activity. Personal and Ubiquitous Computing **18**(7), 1705-1719 (2014), https://doi.org/10.1007/s00779-014-0783-2