Flo publicly addresses privacy lawsuit - as new complaint emerges in the Netherlands
The campaign marks one of the first times Flo has publicly discussed the lawsuit that resulted in an $8 million settlement in 2025.
Flo Health, the world’s most popular female health app, is publicly addressing years of privacy scrutiny through a new social media campaign featuring its privacy chief, while separately facing a new complaint in the Netherlands over its handling of reproductive health data.
The campaign marks one of the first times the world’s largest period tracking app has directly discussed the lawsuit that led to an $8 million settlement in 2025, with Flo arguing that many public perceptions of the case do not reflect what actually happened.
The initiative includes a series of social media videos and posts featuring Flo's Vice President of Privacy and Data Protection Officer Sue Khan, Flo’s VP of Security Laure Lydon alongside cybersecurity creator Tazin Khan. Together, they address common questions about reproductive health data, privacy protections and the company's approach to handling sensitive information.
Part of the campaign includes a carousel-style "Letter to our community on privacy", outlining the company's position on privacy, data protection and the legal challenges it has faced in recent years.
In the posts, Flo argues that privacy should not be a reason for women to avoid using digital health tools and says users should not have to choose between benefiting from technology and protecting their personal information.
“Privacy is one of the most important topics for our users, and we believe people deserve fact-based and clear information about how their health data is protected,” Sue Khan told FutureFemHealth.
Flo Health also shared that it has created a Trust & Safety Center, where users can access accurate information about all things privacy at Flo.
“The conversation we shared on social media is part of our broader commitment to transparency and education.”
“We know privacy and security can feel complex, and many people have questions about what safeguards are in place. Partnering with an inspiring cybersecurity expert like Tazin Khan helped make these topics accessible and allowed us to address common questions head on."
Revisiting the lawsuit
Much of the campaign, which appeared across Flo’s social media channels between May 28 and June 1, focuses on addressing concerns stemming from the legal challenges that have followed the company over the past several years.
Discussing the lawsuit in one of the videos, Sue Khan says that “sensational headlines and narratives” led many people to believe Flo had sold user data, adding that this “absolutely did not happen.”
She later argues that “if we continue fearmongering in this industry”, “women end up losing out because they don’t have the facts in front of them.”
Part of Flo’s response also comes in the form of a community letter published alongside the campaign. In a slide titled “The lawsuit. What actually happened.”, the company explains that between 2016 and 2019 it used software development kits (SDKs) provided by third-party companies to monitor app performance, fix bugs and improve reliability.
Flo argues that the lawsuit centred on questions around disclosure and transparency regarding how those tools operated, rather than allegations that users’ health data was sold.
“The lawsuit questioned whether this was explained clearly enough and how it was handled,” the community letter states. “We want to be direct: that limited technical information was never sold or used for advertising. Ever.”
The posts also reference court proceedings from the case, with Flo highlighting that a judge had indicated the main claim faced an “insurmountable” lack of evidence before the company ultimately agreed to settle.
The lawsuit relates to allegations that reproductive health data was shared with digital advertising companies without user consent between 2017 and 2019. Last year, Flo agreed to contribute $8 million to a proposed settlement fund while denying wrongdoing.
The campaign also highlights a number of privacy initiatives introduced in recent years, including annual third-party privacy audits, global GDPR-level protections, an independent Privacy and Security Advisory Board and Anonymous Mode, a feature that allows users to use the app without linking identifying information to their health data.
Flo also emphasised that it open-sourced the technology underpinning Anonymous Mode in 2023, allowing other health apps to adopt similar protections.
The campaign also arrives just months after the company advertised for a dedicated PR lead focused on privacy and policy communications.
New complaint filed in the Netherlands
The renewed focus on privacy comes as Dutch digital rights organisation Bits of Freedom has filed a complaint with the Dutch Data Protection Authority over Flo’s handling of sensitive user information.
According to Dutch media reports, the complaint alleges that Flo collects and processes highly sensitive personal information, including data relating to sexual activity, menstrual cycles and pregnancy intentions.
At the time of writing, the full details of the complaint have not been made public.
Flo says it has not yet been provided with sufficient information to respond to the allegations in detail.
“We are surprised by this campaign, particularly as Bits of Freedom has not responded to Flo’s substantive engagement and responses to their questions from 2024,” a Flo Health spokesperson told FutureFemHealth.
“At this stage, we have not been provided with details or the basis for this complaint, which limits our ability to respond in detail.
“Privacy and the protection of sensitive health data are fundamental to Flo and we simply have never and will never sell user data. We have implemented robust privacy and information-security measures, reflected in our ISO 27001 and ISO 27701 certifications, and have been externally recognised for our work on data protection.
“We nevertheless remain committed to constructive engagement to address the facts and any specific concerns Bits of Freedom may have.”
A wider challenge for women’s health
Flo is not alone in placing greater emphasis on privacy.
Following the overturning of Roe v. Wade in 2022 in particular, a number of companies moved quickly to strengthen and publicise their privacy protections amid growing concerns about how reproductive health data could be accessed or used.
Companies including Clue have highlighted privacy as a core part of their offering, while newer entrants such as 28X (which bills itself as the ‘private period tracker’) have incorporated privacy and data ownership into their product design and messaging from the outset.
As scrutiny of reproductive health data continues from regulators, campaigners and consumers, privacy remains one of the most closely watched issues across the women's health sector.
Privacy first should be the default for women’s health apps, particularly as we see women’s rights rolled back in many places. As long as sensitive and linked data is held by companies there is always a risk to women’s privacy - whether that is from third party tech, advertisers or the company itself. Notable also that 28x is free to users as well as privacy first
Privacy first and zero tolerance! FeMTech is about supporting women and people who menstruate, not selling their pain and vulnerability away.