Period app Flo Health reaches settlement in US data privacy lawsuit

The period tracking app has settled a US lawsuit over claims it shared users’ personal data with Meta without permission.

Flo Health says it has agreed to settle the class action lawsuit in which it was accused of sharing users’ health data with Meta for targeted advertising.

Founded in 2015, the Flo Health app now has over 75 million active users, becoming Europe’s first femtech unicorn after raising $230 million (£155.7m) in Series C investment in July 2024.

The app allows users to track period and ovulation cycles, monitor symptoms and access personalised health insights and educational content on topics such as pregnancy and perimenopause.

The case against Flo, which began on Monday, 21 July in San Francisco, involved five named claimants who said they did not permit personal data, including the dates and lengths of the periods, to be shared with the social media platform.

Flo Health denied all of the claims against it, while Meta denies receiving any sensitive data from the company.

No admission of wrongdoing

The company announced the settlement on Thursday, 31 July, after the judge presiding over the trial said the lack of evidence for the Plaintiff’s claim was an “insurmountable” problem.

“We are pleased to confirm that the matter has been resolved and that the facts came out at the trial,” a spokesperson for Flo Health said in a statement.

“We have always maintained that the claims lacked merit, and as the case progressed, the lack of evidence to support these allegations became increasingly clear in Court.”

They added: “Importantly, this settlement includes no admission of wrongdoing. We can now put the matter behind us so we can continue to focus on serving our customers and delivering our mission to advance the future of women’s health.”

Implications for the femtech sector

The high-profile case comes as some reports have raised questions around the governance of women’s health apps, suggesting users could be at risk of data breaches.

Stephanie Caird, life sciences partner at UK law firm Mills & Reeve, told Femtech World that calls for stricter regulations and “red tape” could affect user confidence in how their data is being used by femtech apps, leading to “nervousness”, with potential impacts for the wider sector.

Caird notes that jurisdictions such as the UK and the EU already have robust regulations in place regarding data compliance.

“There are already a variety of frameworks in place in the UK which, when taken together, should be providing a sufficiently robust framework to protect users’ data,” she says.

“From a data privacy perspective, the core takeaway from the case is that ‘privacy by design’ and ‘privacy by default’ are still very much core tenets of data privacy compliance, especially under EU and UK GDPR, which should be factored into the technology build stages.”

In 2023, the UK Information Commissioner’s Office (ICO) carried out a review of period and fertility apps, which did not identify any serious compliance issues or evidence of harm, in connection with the feedback received from app providers and app users.

“There was a reminder from the ICO to developers to ensure that data processing is undertaken in a compliant way,” Caird adds.

“That should continue to be a guiding principle for femtech companies collecting personal data.”

Flo says it ‘has never and will never’ sell users’ data, and its ‘commitment to user trust, data minimisation and security-by-design is rigorous, measurable and independently verified’.

It has recently introduced new privacy features such as Anonymous Mode, which it says demonstrates its ‘ongoing commitment to user trust’.