Flo Health to face jury trial over alleged mishandling of sensitive health data

Class action lawsuit accuses period-tracking app of sharing user data with third parties like Meta

Photo by Jessika Arraes on Unsplash

Flo Health, the world’s most popular female health app, will face a jury trial later this year over allegations that it mishandled users’ sensitive health data between 2017 and 2019, following a federal judge’s ruling.

On May 22, U.S. District Judge James Donato ruled that key claims in a class action lawsuit against Flo Health must go to trial.

The case centres on allegations that the app shared users’ reproductive health data with third parties, including Meta (formerly Facebook), without clear consent or transparency.

Users accuse Flo of violating California’s medical privacy laws, including the Confidentiality of Medical Information Act (CMIA), and of committing intrusion upon seclusion — a legal term for unlawful invasion of privacy.

Judge Donato found there were serious factual disputes over whether Flo clearly disclosed its data-sharing practices and whether the information shared qualifies as protected medical data. He said a jury should decide whether Flo broke the law.

"There is evidence from which a reasonable jury could find that the transmitted Custom Events included personal identifying information," the judge wrote.

Wider implications for women’s health

The trial, which has no confirmed date is reported elsewhere as due to begin in July, will be an important case for how reproductive health apps manage the deeply personal data of millions of users.

A number of high-profile cases and reports in the last decade have highlighted concerns about reproductive health apps collecting more data than is necessary, sharing with third parties (and even potentially selling data to third parties), poor data security measures and a lack of transparency about data privacy (i.e not being open about how data is collected, used and shared).

Back in 2019, Privacy International conducted an analysis of 36 menstruation apps and they found that 61% were automatically transferring data to Facebook when a user opened the app. They also found that some of those apps were routinely sending Facebook incredibly detailed and sometimes sensitive personal data. This was happening even if people were logged out of Facebook or didn’t have an account.

A study by JMIR from 2022 found that “many of the most popular women’s [mobile health] apps on the market have poor data privacy, sharing, and security standards. Although regulations exist, such as the European Union General Data Protection Regulation (GDPR), current practices do not follow them.”

And the issue of data privacy in FemTech apps came to a head in 2022 after protection for abortion was overturned in the US.

There were calls for women to delete their period tracking apps because of the fear that information logged in these apps could be used to prove women had obtained an abortion, which is considered a criminal offence in certain jurisdictions. For example, data from an app may show dates that a woman was pregnant followed by a date that she wasn’t.

In response many leading apps such as Clue have worked hard to demonstrate their commitment to data privacy. And new apps such as Embody and Comma’s app Sara offer privacy-first designs.

Flo Health data concerns

Flo Health has itself previously been in the spotlight for data privacy concerns. In January 2021 it settled with the Federal Trade Commission for sharing user data with marketing and analytics services at Facebook and Google. While Flo Health did not admit wrongdoing it agreed to overhaul its privacy efforts to renew a focus on user consent and transparent communications. Since then, Flo Health has introduced a range of improved practices including open sourcing its anonymous mode in June 2023 and stepping up privacy commitments with a new ISO certification in January 2024. The latter is an internationally recognised standard in privacy and data protection and serves as a formal independent seal of approval for Flo’s privacy program.

Separate class actions are also ongoing in Canada against Flo Health, including a national lawsuit certified in British Columbia and another in Quebec. In that case, Flo Health is accused of sharing users’ intimate health information to third parties like Facebook without their knowledge between June 2016 and February 2019.

The current class action builds upon the same core allegations from the 2021 FTC settlement, while this time seeking damages on behalf of users affected.

In response, a Flo Health spokesperson said:

"We firmly deny all allegations in this case.

Flo has never, and will never, sell its users data. Flo is the only women’s health app to hold dual ISO certifications in privacy and security, and we also offer consumers the ability to use our app in Anonymous Mode, a feature that gives access to Flo without sharing any information that identifies you.

We remain focused on our mission to build a better future for female health, as well as steadfast in our commitment to protecting user privacy and data."

*Please note this article was edited on 5 June to include a comment provided by Flo Health.

You might also be interested to read our weekly newsletter referencing this article:

You might also be interested to read: