Flo Health App: The FTC Case on Shared Health Data
A health app promised privacy, and the FTC said the data went to marketing and analytics firms.
By Siddharth ShankarUpdated October 24, 2026On June 22, 2021 the FTC finalised an order against Flo Health, the developer of the Flo Period & Ovulation Tracker app. The FTC alleged Flo shared sensitive health data from millions of users with marketing and analytics firms, including Facebook and Google, even though it promised to keep health data private. The order requires Flo to get users’ affirmative consent before sharing personal health information, undergo an independent review of its privacy practices, notify affected users and instruct third parties that received the data to destroy it.
Your email is the key to most of your accounts. Has it already leaked?
Free · About 30 seconds · No sign-up · Email not stored
Health apps feel private because they deal with private subjects. Whether the data stays private depends on what the company does with it. This guide follows the FTC’s announcement of its final order with Flo Health.
What happened
The FTC announced on June 22, 2021 that it had finalised its settlement with Flo Health, Inc. after receiving public comments. The Commission voted 4-0-1, with Chair Lina Khan not participating. The case concerns the Flo Period & Ovulation Tracker app, a fertility-tracking app.
What the FTC alleged
The FTC alleged that Flo shared sensitive health data from the app with marketing and analytics firms, including Facebook and Google. The data came from millions of users, though the FTC’s page gives no exact number. It also alleged that Flo told users it would keep their health data private, and that this promise was false. The FTC’s announcement does not list the specific data fields in the text we reviewed, so this guide does not name them.
What the order requires
Under the order, Flo must:
- obtain users’ affirmative consent before sharing their personal health information with others;
- get an independent review of its privacy practices;
- notify affected users that their health information was disclosed;
- instruct any third party that received the data to destroy it;
- stop misrepresenting the purposes for collecting, using or disclosing data, and how much control users have over those uses;
- stop misrepresenting its compliance with privacy, security or compliance programmes;
- stop misrepresenting how it collects, maintains, uses, discloses, deletes or protects personal information.
Quick check before you read on: is your email in a known data breach? Free, about 30 seconds.
Free · About 30 seconds · No sign-up · Email not stored
Why health app data is sensitive
Information about periods, pregnancy plans or symptoms can reveal things about your health, relationships and plans. Once it reaches advertising and analytics companies, it can be linked to device identifiers and used to build profiles. Even a list of the apps you use can say something about you. Read what metadata is and why it matters.
How to check an app before you trust it
- Read the privacy policy for sharing. Look for words like “advertising partners”, “analytics” and “service providers”.
- Look at permissions. Does the app need your contacts, location or advertising ID to do its job?
- Check the settings inside the app for options to limit sharing or turn off personalised ads.
- Use your phone’s tracking controls. See app tracking on iPhone and resetting your Android advertising ID.
- Share only what you need. If a field is optional, you can leave it blank.
- Delete your data when you stop using the app. Delete the account, not just the app, and ask the company to erase your information.
Other health data cases
The FTC has brought similar cases about health data and advertising. Read the BetterHelp case and the GoodRx case. In Washington State, a separate law covers consumer health data; see the My Health My Data Act guide.
Your records versus app data
Health data in apps is often outside the protections that apply to medical providers. If you want a copy of records held by a doctor or insurer, see the HIPAA right of access guide.
Sources
- FTC: FTC finalizes order with Flo Health (June 22, 2021) (allegations, recipients, order terms)
Frequently asked questions
What did the FTC allege against Flo Health?
That it shared sensitive health data from its Flo Period & Ovulation Tracker app with marketing and analytics firms, including Facebook and Google, despite promising privacy.
When was the order finalised?
June 22, 2021.
What must Flo do under the order?
Get affirmative consent before sharing health information, undergo an independent privacy review, notify affected users and tell third parties to destroy the data.
How many users were affected?
The FTC says millions of users, without giving an exact number.
How can I protect my health app data?
Read the privacy policy, limit permissions, use phone tracking controls, share only what you need and delete accounts you no longer use.
See if your email has already leaked
- Checks your email against known data breaches
- Shows which sites leaked it, when, and what leaked
- We do not store the email you check
Compare data removal services
See which services work in your country, what they cost, and the free do-it-yourself route.
Compare removal services →Prefer a one-time report first? Scan My Shadow, our sister service, $9.99.