Digital Therapeutics: When Apps Become Medicine

By: Rachel Slaughter-Thury

Digital therapeutics have moved from novelty toward clinical practice. Unlike ordinary wellness apps, these programs deliver software-based interventions intended to manage or treat disease.[1] The U.S. Food and Drug Administration (“FDA”) recognizes that software functions can qualify as medical devices regardless of the platform on which they run.[2] Its De Novo database includes reSET for substance-use disorder and EndeavorRx for attention-deficit/hyperactivity disorder.[3] These products highlight the legal dilemma: an app can resemble a game while functioning as regulated treatment.[4]

The starting point is the Federal Food, Drug, and Cosmetic Act (“FDCA”), not the product’s appearance. The statute defines a device to include an article intended to diagnose, cure, mitigate, treat, or prevent disease when it does not achieve its primary purpose through chemical action or metabolism.[5] Congress nevertheless excluded certain software functions, including those intended to encourage a healthy lifestyle when they are unrelated to diagnosing or treating a disease.[6] Federal law therefore does not treat every health-related app as a medical device.

The most important characteristic is intended use. A developer’s therapeutic claims can supply evidence of objective intent because federal regulations expressly identify labeling, advertising, and other statements as relevant.[7] Courts have long applied the same principle. In United States v. Article Consisting of 216 Cartoned Bottles, More or Less, ‘Sudden Change,’ claims promising a temporary face-lift helped bring a cosmetic product within the FDCA’s drug definition.[8] Although that case involved a cosmetic, its reasoning transfers to software: regulators examine what the seller represents the product will do.[9] Accordingly, EndeavorRx’s game-based design does not prevent its classification as digital therapeutic software for ADHD.[10]

Evidence presents the harder policy question. Requiring drug-style trials for every minor software update could impose costs poorly matched to iterative development, and FDA does not require re-evaluation for every minor change.[11] Yet unsupported treatment claims can mislead patients and displace effective care, so objective health claims require reliable substantiation.[12] The better approach is proportional evidence: oversight should rise with the specificity of the claim and the danger of error, consistent with the FDCA’s risk-benefit framework and least-burdensome principles.[13] FDA also permits sufficiently reliable real-world data to generate evidence for device regulatory decisions.[14]

FDA jurisdiction is only part of the framework. The Federal Trade Commission (“FTC”) may challenge deceptive or inadequately substantiated advertising even when an app is not under active FDA oversight. Its Health Products Compliance Guidance applies to health-related apps and generally expects randomized, controlled human clinical testing for health-benefit claims.[15] The Lumosity matter illustrates the consequence of unsupported disease-related promises: the company agreed to pay $2 million to settle charges involving claims about cognitive performance, dementia, and Alzheimer’s disease.[16] The settlement also required competent and reliable scientific evidence for specified future claims.[17]

Data practices create another regulatory layer. Many health apps operate outside the Health Insurance Portability and Accountability Act (“HIPAA”), but the FTC’s amended Health Breach Notification Rule expressly reaches many health apps and similar technologies not covered by HIPAA.[18] Covered vendors must notify consumers, the FTC, and sometimes the media after breaches of unsecured identifiable health information.[19] Thus, describing these products as simply ‘unregulated’ obscures the division of authority among product-safety, advertising, and privacy regulators.

A defensible framework is claim-based and risk-sensitive. Specific treatment claims should trigger FDA analysis under the device definition and applicable software exclusions; stronger claims and greater risks should demand stronger evidence. Lower-risk wellness tools should retain room to develop, but their advertising must remain truthful and their data practices lawful. Software becomes medicine when its intended function and claims place it within the law’s therapeutic category, not when it adopts a clinical appearance.

[1] U.S. Food & Drug Admin., Device Software Functions Including Mobile Medical Applications (2026), https://www.fda.gov/medical-devices/digital-health-center-excellence/device-software-functions-including-mobile-medical-applications.

[2] Id.

[3] U.S. Food & Drug Admin., De Novo Classification Request for reSET, DEN160018 (2017), https://www.accessdata.fda.gov/scripts/cdrh/cfdocs/cfpmn/denovo.cfm?id=DEN160018; U.S. Food & Drug Admin., De Novo Classification Request for EndeavorRx, DEN200026 (2020), https://www.accessdata.fda.gov/scripts/cdrh/cfdocs/cfpmn/denovo.cfm?id=DEN200026.

[4] U.S. Food & Drug Admin., Policy for Device Software Functions and Mobile Medical Applications: Guidance for Industry and Food and Drug Administration Staff 4-5 (2022), https://www.fda.gov/regulatory-information/search-fda-guidance-documents/policy-device-software-functions-and-mobile-medical-applications.

[5] 21 U.S.C. § 321(h)(1).

[6] 21 U.S.C. § 360j(o)(1)(B); U.S. Food & Drug Admin., General Wellness: Policy for Low Risk Devices: Guidance for Industry and Food and Drug Administration Staff (2026), https://www.fda.gov/regulatory-information/search-fda-guidance-documents/general-wellness-policy-low-risk-devices.

[7] 21 C.F.R. § 801.4.

[8] United States v. Article Consisting of 216 Cartoned Bottles, ‘Sudden Change,’ 409 F.2d 734, 739 (2d Cir. 1969).

[9] Id. at 739.

[10] U.S. Food & Drug Admin., De Novo Classification Request for EndeavorRx, DEN200026 (2020), https://www.accessdata.fda.gov/scripts/cdrh/cfdocs/cfpmn/denovo.cfm?id=DEN200026.

[11] U.S. Food & Drug Admin., Device Software Functions Including Mobile Medical Applications (2026), https://www.fda.gov/medical-devices/digital-health-center-excellence/device-software-functions-including-mobile-medical-applications.

[12] Fed. Trade Comm’n, Health Products Compliance Guidance §§ II.A, III.B.2 (2022), https://www.ftc.gov/business-guidance/resources/health-products-compliance-guidance.

[13] 21 U.S.C. § 360c(a)(2)-(3).

[14] U.S. Food & Drug Admin., Use of Real-World Evidence to Support Regulatory Decision-Making for Medical Devices: Guidance for Industry and Food and Drug Administration Staff (2025), https://www.fda.gov/regulatory-information/search-fda-guidance-documents/use-real-world-evidence-support-regulatory-decision-making-medical-devices.

[15] Fed. Trade Comm’n, Health Products Compliance Guidance §§ I, III.B.2 (2022), https://www.ftc.gov/business-guidance/resources/health-products-compliance-guidance.

[16] Fed. Trade Comm’n, Lumosity to Pay $2 Million to Settle FTC Deceptive Advertising Charges for Its ‘Brain Training’ Program (2016), https://www.ftc.gov/news-events/news/press-releases/2016/01/lumosity-pay-2-million-settle-ftc-deceptive-advertising-charges-its-brain-training-program.

[17] Id.; Stipulated Final J. and Order for Permanent Inj. and Other Equitable Relief, FTC v. Lumos Labs, Inc., No. 3:16-cv-00001-SK (N.D. Cal. Feb. 2, 2016).

[18] Fed. Trade Comm’n, FTC Finalizes Changes to the Health Breach Notification Rule (2024), https://www.ftc.gov/news-events/news/press-releases/2024/04/ftc-finalizes-changes-health-breach-notification-rule.

[19] 16 C.F.R. pt. 318; Fed. Trade Comm’n, Health Breach Notification Rule, https://www.ftc.gov/legal-library/browse/rules/health-breach-notification-rule.