Secrets for Sale: Menstruation cycle tracking apps like Flo sell data to third parties for profit, which raises concerns about privacy specifically after overturn of Roe v. Wade

Since the overturn of Roe v. Wade, East students with the capacity to menstruate have become increasingly cautious about their private health information, including how they keep track of their cycle. 

Junior and former app user Eve Benditt deleted her tracking app after learning that many companies aren’t legally required to follow Health Insurance Portability and Accountability Act regulations — instead, she’s opted to keep track in her notes app to assure her health information is kept private. 

Period tracking app users like Benditt are expressing concerns about how secure these companies are keeping their data and how it might be used against them, especially in states with abortion bans.

The data can be sold to third parties like big tech or insurance companies, who could then use it to target marketing or advertising, or expose users’ health information if abortion becomes illegal at a federal level, according to Politico.

These tracking apps monitor when a user is ovulating, as well as when they are — or aren’t — on their period. According to Politico, this data could be used as evidence to prosecute people accused of having or seeking an abortion. 

According to an Instagram poll of 232 East community members, 51% use period-tracking apps to plan ahead, track when they are ovulating and monitor other health effects. As a result, these apps have an abundance of data regarding their users’ health.

“You shouldn’t have to worry about an app that’s just supposed to help you keep track of your period giving your information away,” senior and tracking app user Livia Barbre said. “It’s not fair that it’s something [users] even have to think about.”

Privacy policies vary substantially among companies, according to information security expert Laura Shipp — specifically, whether the apps sell information, use the data for advertising, share it for research or keep it solely within the app.

Since many of these apps are free and companies own all data, they’re often not covered under HIPAA and therefore aren’t prohibited from sharing users’ anonymous information, according to Verify News.

However, for former app users like Benditt, cycle tracking is still crucial for monitoring overall health and is required when prescribed acne or other hormone-altering medications. 

“My dermatologist recommended that I stop using [the apps] after Roe was overturned,” Benditt said. “She taught me how to count out the days by hand to estimate — basically the same thing the apps do.”

Health app Flo settled a lawsuit with the Federal Trade Commission last year over allegations that the company — after marketing promises of privacy — shared health data of users using its fertility-tracking app with outside data analytics companies, including Facebook and Google.

Flo’s roughly 10,000-word privacy policy details how the company may share or sell users’ health data and uses tracking technologies for advertisements and analytics on the app’s free version. However, not all period-tracking apps will disclose private information. Health app Clue promises users in its privacy policy that it does not do any advertising or selling of data to third parties, deriving profit solely through subscriptions.

“I feel pretty safe using the Clue app since it’s supposedly the safest one,” Barbre said. “I find all their health information and resources really helpful, but sometimes I do worry about my privacy.”

Multiple bills have been introduced to keep users’ data secure within these apps. Last year, Sen. Ron Wyden (D-Ore) introduced the Fourth Amendment Is Not For Sale Act, though this has yet to be voted on, it would prohibit data brokers from selling personal information to law enforcement or intelligence agencies without court oversight. 

Without legal protection, this data may be subpoenaed in criminal prosecution in states — such as Missouri — where abortion is outlawed. However, some apps assure users that this is not a pressing concern.

“We completely understand this [privacy] anxiety, and we want to reassure you that your health data, particularly any data you track in Clue about pregnancies, pregnancy loss or abortion, is kept private and safe,” Clue co-CEO Carrie Walter said in an emailed press release.

Health app Ovia’s privacy policy says that without a federal law, the company may give data to law enforcement if required by law or subpoena. However, there is an option in Ovia’s account settings for users to delete account data “entirely and permanently.”

However, users like Barbre believe that it shouldn’t be the users job to protect their data within the app, but that it’s the company’s duty to protect their users.

“It’s like we’re being forced to choose one or the other,” Barbre said. “Privacy or convenience.”