At Walgreens and CVS, a push to collect customer health data by dangling discounts

Want $50 off your next purchase at Walgreens? You’ll have to run 2,000 miles. Or step on a scale 2,000 times. Or take 2,000 readings of your blood glucose level.

And you’ll have to let the global pharmacy chain track all that data — and give them permission to mine it to target you with ads.

Walgreens this month launched a new smartphone app that customers can sync up wirelessly with their blood glucose and blood pressure monitors so they can feed their personal health information directly into the chain’s data system in exchange for discounts. The app is novel. But the practice is increasingly familiar.

Pharmacies across the US are dangling perks to coax their customers to relinquish all sorts of personal information, ranging from daily fluctuations in their weight to their progress in quitting smoking to their real-time location every minute of the day.

At CVS, you can get $5 back for every 10 prescription refills — if you waive your right to health care privacy protected under the federal health law known as HIPAA. And Rite Aid is experimenting with a service that other retailers are using to collect tons of data: special lockers that you can use to charge your cell phone for free, if you’ll give up your phone number, insurance costs, and shopping preferences.

Drugstores say they’re collecting your data to encourage you to be healthy and save you money. But the growing practice is also a boon for their bottom line because it helps them target their marketing efforts more precisely.

How precisely? If you allow your drugstore to track your location, you might get a text offering a coupon for a specific cough syrup or recommending that you try a neti pot for sinus relief — while you’re standing in the aisle that sells cold and flu medication.

The trend alarms consumer and privacy advocates.

“It’s extremely concerning,” said Paul Stephens, director of policy and advocacy at the nonprofit Privacy Rights Clearinghouse.

In exchange for modest discounts, he said, patients are giving up “very, very valuable” information and leaving themselves open to a barrage of advertising about potentially sensitive health conditions. They may also be at risk of having their data shared more widely than they want — or even stolen.

“There is no free lunch,” Stephens said.

Michelle De Mooy, a consumer privacy advocate at the Center for Democracy & Technology, worries that these programs have the potential to be discriminatory in their impact. Low-income customers may not be able to afford to say no to a discount, even at the cost of personal data they would otherwise keep private, she said.

Retailers of all stripes have long mined purchase data obtained through their loyalty rewards programs for clues about their customers. What’s new is that drugstores are increasingly taking advantage of the proliferation of “connection points” available to them, according to Alan Lipson, a retail industry marketing manager for the analytics firm SAS.

“Now it’s coming on your smartphone, and they’re texting you, and they’re being more invasive,” Lipson said.

And while a grocery store may know how many boxes of Cheerios you buy in a week or what brand of pasta sauce you prefer, Walgreens can collect far more sensitive data about your health, down to how many milligrams of sugar per deciliter of blood you have in your veins. And you have to share an awful lot of those data points to earn the discount.

You don’t have to earn your reward points by giving the chain just one kind of data, of course. You can report all sorts of “healthy behaviors,” like using a nicotine patch or setting a weight loss goal or biking for 10 miles, earning points for each bit of information you feed the app. (You can also earn rewards for refilling prescriptions or spending money at Walgreens, but you’re capped at a certain number of points per day and month.)

Walgreens vice president Adam Pellegrini wouldn’t disclose how many customers had downloaded the new app, called “Walgreens Connect,” which makes it easier and quicker for customers to transmit their blood pressure and blood glucose readings in exchange for rewards. (They used to have to go to a website to log all their health data.)

But Pellegrini said the company had doled out 2 billion rewards points — the equivalent of 50,000 discounts of $50 — since it started rewarding customers for logging their health data last year.

When asked how Walgreens was using all that health data, company spokeswoman Mailee Garcia said the company “does not sell personally identifiable information to third parties,” but may sell de-identified information.

Garcia said Walgreens is not currently using health data to market to the customers who provide it. But the app’s privacy policy explicitly states that Walgreens may use customer data to personalize advertising. The store can also combine data entered into the health app with personal information collected by other companies to create a more robust profile of individual customers.

The policy also gives Walgreens the right to change its privacy terms at any time and says customer data will be sold as an asset if Walgreens is acquired by another company.

All that concerns De Mooy, the consumer privacy advocate.

“It’s becoming less and less possible to truly de-identify data, especially when it’s at such a detailed personal level,” she said. “When you’re talking about really specific biometric information like your blood pressure or other metrics like that, the bar needs to be raised very high” in terms of data privacy, security, and transparency, she said.

Rite Aid, which recently agreed to be acquired by Walgreens, is testing out another way of trading perks for customer data. The drugstore is among a number of retailers — including Bloomingdale’s, Whole Foods, and Nordstrom — that have installed stations where customers can securely store and charge their cell phones at no cost while they’re shopping.

Rite Aid spokeswoman Kristin Kellum said the company has not collected or retained any customer information from the program, but that doesn’t mean it can’t in the future. The charging stations are designed to collect information from shoppers, including phone numbers, insurance plan benefits, and shopping preferences  — with the free power source serving as enticement for volunteering the data.

“It’s really important for the retailer to offer something in return for getting information,” said Doug Baldasare, chief executive of the Philadelphia-based startup ChargeItSpot, which installs the phone-charging stations.

The pharmacy chain Duane Reade — a Walgreens subsidiary — is experimenting with another way to reach customers: tracking their physical locations through the GPS on their phones and then pushing out relevant promotions through an app. Duane Reade is testing the tactic in 10 of its New York City stores. Last year, Walmart said it was rolling out the technology in some of its stores, as well, but the company didn’t respond to multiple requests for comment on how it’s being used.

Customers don’t even have to be in the stores to get targeted.

An older Walgreens app can beam smartphone users a notification offering them a discount when they’re nearby a Walgreens location.

Every time Lipson goes to see his mother in Raleigh, N.C., he drives past a Walgreens and — once he’s within the range of about a block — he gets a mobile notification hawking him a promotion via his Walgreens app. “Sometimes,” he said, “I just want to turn it off.”