A period tracking app can know far more about you than when your next period is due.
Over months or years, the information you enter can build an incredibly personal picture of your life – from your menstrual cycle and sexual activity to whether you’re trying for a baby or monitoring a pregnancy.
That’s what makes the allegations surrounding Flo so significant.
Legal action in the US has alleged that some of the intimate information users entered into the Flo app was shared with third-party technology companies without their knowledge or consent.
So, what information was allegedly involved?
What information do the allegations involve?
The allegations concern information entered into Flo between 30 June 2016 and 23 February 2019. This included details relating to users’:
- Menstrual cycles
- Ovulation and fertility
- Pregnancy status and intentions
- Sexual activity
- Symptoms and other reproductive health information.
The claims also concern technical information associated with users and their devices.
Taken individually, some of these details might not seem particularly revealing. Together, they could provide a much more intimate picture of someone’s health and private life.
Who was the information allegedly shared with?
The US legal action involved several third-party technology companies, including Google, Meta and Flurry.
Apps commonly use technology provided by other companies for purposes such as analytics – helping developers understand how people use an app, monitor its performance and improve their services.
Using this type of technology isn’t in itself unusual or necessarily unlawful. The issue raised by the Flo allegations is whether users understood what information was being transmitted to third parties and whether they had given appropriate consent.
Why is period and fertility data so personal?
Imagine using an app every day for several years. You might record a missed period one month. A positive pregnancy test the next. Perhaps months of trying for a baby, fertility difficulties or symptoms you’re worried about.
You might also record information about your sexual activity, contraception or changes to your body that you haven’t discussed with anyone else.
For many people, these aren’t simply data points. They can represent some of the happiest, most difficult or most private moments of their lives.
That’s why the possibility of this information being shared somewhere you didn’t expect can feel like such a profound loss of privacy.
Does this mean all of my Flo information was shared?
Not necessarily. The allegations do not mean that every piece of information entered by every Flo user was shared with every third party.
Exactly what information may have been transmitted could depend on factors including when and how someone used the app and the technology operating within it at the time.
It’s therefore important not to assume that because you used Flo during the relevant period, all – or indeed any – of the information you entered was necessarily disclosed.
Why does health data receive extra protection?
UK data protection law recognises that information about your health is particularly sensitive.
Health information is generally classed as special category data under UK GDPR. Organisations processing this type of information must meet additional legal requirements, as well as complying with the wider rules governing personal data.
People should also be given clear information about how their personal data is being used and, where relevant, who it may be shared with.
When you’re sharing details about your reproductive health, being able to understand where that information goes is particularly important.
What has happened since?
Flo’s historic data practices have faced significant scrutiny in the US. In 2021, Flo reached a settlement with the US Federal Trade Commission following allegations that it had disclosed sensitive health information to third parties after making promises about keeping that information private. Further litigation followed.
More recently, Flo Health, Google and Flurry agreed to a proposed $59.5 million settlement resolving certain claims relating to the alleged sharing of users’ information.
The companies have not admitted liability.
The settlement applies to the US legal action and does not mean UK Flo users will receive compensation.
What has happened since?
You may also want to keep any information you still have that shows when you used the app, such as old emails, account information or subscription records.
Join the Claim is monitoring developments affecting UK users. You can find out more about the Flo data privacy allegations on our dedicated page.
Join the Claim connects consumers with SRA-regulated lawyers. Visit the claim page to check your eligibility if a claim is open with one of our trusted legal partners. If a group action has not yet been launched, you can register your interest and we’ll keep you informed if a partner firm decides to take a claim forward.
