Young woman hand holding iphone with logo of Flo application. Flo - is tracking menstruation and menopause, and ovulation calendar.

How your health data may have been used by big tech in the Flo period tracker breach

Your period tracker knows a lot about you — and it may not be keeping it private.

We’re used to apps knowing things about us. But when it comes to period trackers and fertility apps, the information we share is deeply personal. From cycle symptoms to sexual activity and pregnancy plans, it’s a level of detail that goes far beyond your average app — and it’s why growing numbers of people are asking serious questions about how that data is used.

Right now, Flo Health Inc. is facing class action lawsuits in Canada and the US. The accusations? That Flo shared intimate health data with Facebook, Google and others — even after promising users their data would remain private.

But how exactly could that data be used? And why would tech giants want it in the first place?

Targeted ads powered by your most personal details

At the heart of the case is something called an SDK — a piece of software that allows apps to collect data and send it back to platforms like Facebook and Google. These SDKs help apps monitor user behaviour, but they also allow big tech companies to build up digital profiles that power targeted advertising.

Let’s say you’re tracking your period in Flo. You log information about your cycle, symptoms, sex life, or whether you’re trying to get pregnant. If that data is passed to a third-party ad network, it could be used to:

  • Show you fertility treatments or pregnancy-related products

  • Predict your likelihood of wanting baby products, supplements or contraception

  • Influence what content you see in social media feeds

  • Track your future online behaviour using a unique digital profile

It turns your intimate health information into a commodity — and you’re the product.

Why this matters for UK users

Here in the UK, we’re protected by GDPR, which places strict controls on how companies handle sensitive health data.

Consent must be freely given, specific and informed. So if any of this data sharing happened without your knowledge or agreement, it could be a breach of your rights — and you may be entitled to compensation.

This is about trust. And it’s about holding companies accountable when they misuse our data.

At Join the Claim, we’re following this case closely. If a UK group action launches with one of our law firm partners, we’ll let you know more.

Join the Claim connects consumers with SRA-regulated lawyers. Visit the claim page to check your eligibility if a claim is open with one of our trusted legal partners. If a group action has not yet been launched, you can register your interest and we’ll keep you informed if a partner firm decides to take a claim forward.  

This information is for general guidance only and does not constitute legal or financial advice.

You may also like:

BMW faces legal action over emissions-cheating software. Learn what the scandal involves, who is affected, and what it means for UK diesel car owners.
Capita’s data breach exposed pension holders’ personal data. Stay updated on the latest legal action, investigations, and regulatory responses.
Confused about Jaguar Land Rover DPF claims vs. Dieselgate? Learn the key differences, legal actions, and how to check if you qualify for compensation.

Latest news & insights

Did you know we have a newsletter?

Sign up for our newsletter to stay up to date.