Fertility app to pay US$200K after sharing sensitive user data

The US fertility and ovulation-tracking app Premom will pay US$200,000 to settle claims that it shared highly sensitive user data with third parties.

Premom, a free app that helps women track ovulation, periods, and other health information, encourages users to provide information about their menstrual cycles, fertility, and pregnancy and import their data from other apps and devices.

Its developer, Easy Healthcare, has been accused by the Federal Trade Commission of deceiving users by sharing their personal information with two China-based firms and other third parties and sharing sensitive health data with AppsFlyer and Google.

The FTC did not disclose the names of the firms that got hold of the sensitive information, but said they had been “flagged for suspect privacy practices”.

The agency has said the Illinois-based company did not notify consumers of the unauthorised disclosures as required under the Health Breach Notification Rule.

The data Easy Healthcare shared with third parties “revealed highly sensitive and private details about Premom’s users and led to the unauthorised disclosure of facts about an individual user’s sexual and reproductive health, parental and pregnancy status, as well as other information about physical health conditions and status,” the FTC has added.

Samuel Levine, director of the FTC’s Bureau of Consumer Protection, said: “Premom broke its promises and compromised consumers’ privacy.

“We will vigorously enforce the Health Breach Notification Rule to defend consumer’s health data from exploitation. Companies collecting this information should be aware that the FTC will not tolerate health privacy abuses.”

According to the complaint, Premom failed to encrypt adequately the data it shared with third parties, including those in China, subjecting this data to potential interception or seizure.

The FTC has announced a proposed order that would have Easy Healthcare pay a US$100,000 civil penalty for violating the Health Breach Notification Rule and another US$100,000 to Connecticut, the District of Columbia and Oregon, for violating their respective laws.

Easy Healthcare Corporation, the FTC has said, would be barred from sharing users’ health data with third parties for advertising, required to obtain users’ consent before sharing health data for any other purpose, and required to tell users how their personal data will be used.

Experts have previously called for greater transparency around women’s health apps, amid concerns that app developers share their users’ data for advertisement and marketing purposes and “hide” data collection practices.

A Secure Data Recovery study has recently found that women’s health applications have secured the “dishonourable crown” of being the least trusted applications in the US.

According to the study, “respondents were most concerned about women’s health apps tracking their data… (with) more people reported having concerns with these apps than people who actually reported using the apps”.