Health apps share more than you think, and you can lock yours down

Key takeaways

• The Federal Trade Commission says the Flo period app, used by more than 100 million people, sent health details, including the fact that a user was pregnant, to marketing and analytics firms after promising privacy.
• In 2023 and 2024, the FTC settled with a fertility app and two online mental health and addiction services over health data shared with advertisers; in July 2026, it sued Hims & Hers over similar allegations.
• A federal court struck down most of a 2024 HIPAA rule on reproductive health privacy in June 2025, and that rule never reached consumer apps anyway.
• Californians can tell covered businesses to limit how they use health data, and since January 2026 can send one free deletion request to more than 600 data brokers.
• A 30-minute routine, included here, covers app permissions, ad tracking, location, deletion requests and what to do after a breach notice.

The app was built for one of the most private parts of life. Flo helps people track their periods and fertility, and more than 100 million people have used it, according to the Federal Trade Commission¹.

In January 2021, the FTC said Flo had passed users’ health information to outside firms that provide marketing and analytics services. The recipients included analytics divisions of Facebook and Google, along with AppsFlyer and Flurry¹. Among the details sent: the fact that a user was pregnant¹.

Flo had promised to keep that information private. The FTC said the sharing stopped only after a news article exposed it in February 2019¹. Flo settled, and the order became final in June 2021². It required Flo to notify users and tell the outside firms to destroy the data¹.

The story didn’t end there. In August 2025, a California jury in a class action found that Meta had violated the state’s Invasion of Privacy Act, TechCrunch reported. The suit accused Meta of collecting Flo users’ period and fertility information without permission³.

Flo and Google had settled before the verdict. At the time, Meta said it disagreed with the outcome and was exploring its legal options, so the case may not be over³.

None of this required a hacker. The data left through ordinary code built into the app. That’s the part most people never see, and it’s what this guide helps you control.

HIPAA follows your doctor, not your data

HIPAA, the federal health privacy law, covers health plans, health care clearinghouses, certain health care providers and the contractors who work for them¹⁵. Your period tracker, smartwatch app, symptom checker and DNA kit company usually aren’t on that list. The FTC itself describes many health apps as falling outside HIPAA⁸. For the full background, see our article on the HIPAA gap.

Even rules that sound protective can vanish. In April 2024, the Department of Health and Human Services (HHS) issued a HIPAA rule to shield records of lawful reproductive health care⁹. On June 18, 2025, a federal court in Texas declared it unlawful and vacated most of it, in a case called Purl v. HHS⁹.

Most of the rule’s updates to the privacy notices that clinics hand patients survived, with a compliance date of February 16, 2026⁹. HHS said it would decide its next steps after reviewing the decision⁹.

That rule applied only to organizations HIPAA covers, such as clinics, insurers and their contractors⁹¹⁵. It never protected what you type into a consumer app.

How your data leaves the app: code you never see

Many apps are built partly from ready-made code supplied by other companies. Software development kits, or SDKs, add features such as analytics or ad measurement. Tracking pixels do something similar on websites. Both can send what you do to the company that made them.

The FTC’s case against Premom, an ovulation-tracking app, shows how much can flow. In 2023, the agency said Premom used SDKs that shared data with AppsFlyer, Google and two analytics firms, Umeng and Jiguang, sending some of it to recipients in China⁴.

The data included sexual and reproductive health details, pregnancy status, precise location and phone identifiers that users could not reset⁴. Premom’s privacy policy had promised no sharing without consent and described the data as non-identifiable⁴.

Websites leak too. Monument, an online alcohol treatment service, sent labeled records of what users did on its site to ad platforms including Meta and Google from 2020 to 2022, the FTC said in 2024⁶. One event was titled “Paid: Weekly Therapy.” Monument paired events like that with email addresses and other identifiers, so the platforms could tie them to real people⁶.

Your phone adds its own tracking tag. Phones carry a unique advertising identifier that advertisers can use to track you, the FTC explains¹³. You can reset or delete it, as the routine below shows.

What the FTC found, case by case

Here is a quick map of recent FTC health privacy cases. These cases add to the GoodRx and BetterHelp cases covered in our group privacy article.

Company and year	What the FTC said happened	Outcome
Flo Health, 2021	Pregnancy and other health details sent to marketing and analytics firms1	Order requiring notice to users and data destruction; no money penalty announced12
Premom, 2023	Reproductive health data and precise location shared through SDKs4	$100,000 federal civil penalty, $100,000 more to Connecticut, Oregon and D.C., ban on sharing health data for ads4
Monument, 2024	Therapy-related events and identifiers sent to ad platforms6	$2.5 million penalty, suspended because the company couldn’t pay; ad-sharing ban6
Cerebral, 2024	Health data on nearly 3.2 million people shared with LinkedIn, Snapchat and TikTok5	More than $7 million in refunds and penalty; ban on using health data for most advertising5
Hims & Hers, 2026	Alleged sharing of health information with Meta, Snap and others7	Lawsuit filed by FTC, Utah and California; allegations only, pending as of October 20267

Cerebral’s case had a strange, low-tech twist. The online mental health company mailed promotional postcards, without envelopes, to more than 6,000 patients, with wording that could reveal a diagnosis or treatment⁵. Its order also set a $10 million civil penalty, but Cerebral had to pay only $2 million of it because it couldn’t afford the rest⁵.

The Hims & Hers case is the newest. In July 2026, the FTC, Utah and California sued the telehealth company, alleging it shared information about customers’ medical conditions with advertising platforms and made cancellation hard⁷. These are allegations. As of October 2026, the FTC listed the case as pending, and the court had not ruled⁷.

Promises didn’t protect anyone. Read the rules instead

Most of the companies in that table told users their information was safe, according to the FTC¹⁴⁶⁷. Monument went further. It promised users their data would be “100% confidential” and said it complied with HIPAA. An outside assessor Monument hired had found it did not fully comply⁶.

The penalties often can’t match the harm. Two of the biggest penalties were wholly or partly suspended because the companies couldn’t pay⁵⁶. And no settlement can guarantee that every company that received the data deletes it.

There is one useful lever. The FTC’s Health Breach Notification Rule, updated in 2024, treats an unauthorized disclosure of app health data as a breach, not just a hack⁸. Companies must notify you within 60 days, and the notice must identify the third parties that got your data⁸. Our group privacy article covers the rule in more detail.

Data brokers, companies that buy and sell information about people, are another place health-related data can end up. Our group privacy article covers that market.

When a company struggles, your data can change hands

A company’s customer data can be one of the most valuable things it owns. When the business runs into trouble, that data may end up with a new owner whose promises you never agreed to.

In March 2025, 23andMe reported serious financial distress. California Attorney General Rob Bonta urged Californians to consider deleting their genetic data and having their test samples destroyed¹². His alert walked people through the account settings for deleting data, changing sample storage and withdrawing research consent¹². California’s Genetic Information Privacy Act gives residents those deletion and destruction rights¹².

The lesson applies well beyond genetics. Before you hand over sensitive data, ask what happens to it if the company is sold or closes. Our article on consumer genetic tests covers what happened to 23andMe next.

New rights, if you live in the right state

California’s privacy law, the California Consumer Privacy Act (CCPA), treats information about your health, sex life or sexual orientation, genetic data and precise location as “sensitive personal information”¹⁰.

Under the law, Californians can tell covered businesses to limit their use of that data to what’s needed to provide the service¹⁰. They can also ask to see or delete their data, and businesses generally have 45 days to respond, with one 45-day extension¹⁰. Opt-outs of data sales must be honored within 15 business days¹⁰.

California also accepts a browser signal called Global Privacy Control. When you turn it on in a browser that supports it, covered businesses must treat it as a request to stop selling or sharing your information¹⁰.

For data brokers, California built a shortcut. Since January 2026, residents can use a free state platform called DROP to send one deletion request to more than 600 data brokers. Brokers began processing those requests in August 2026¹¹.

Washington and Connecticut have their own health data protections, described in our group privacy article. Elsewhere, your rights depend on your state’s law and the company’s own policy.

Privacy is part of caring for yourself

Many people drawn to natural health already guard what goes into their bodies. They read labels, ask where food came from and question products they’re told to trust.

Your health data deserves the same care. Your cycle, your moods, your prescriptions and your DNA describe your body. Deciding who sees them is a matter of autonomy. Choosing fewer apps, sharing less and deleting what you no longer need is a form of self-protection that costs nothing.

A 30-minute phone and app lock-down routine

Set aside half an hour. Then repeat the routine twice a year, perhaps when the clocks change.

1. List your health apps. Include period, fertility, sleep, fitness, mood, meditation, telehealth, pharmacy and wearable apps. Delete any you no longer use, and consider deleting apps that ask for permissions they don’t need¹³.
2. Trim permissions. In your phone’s privacy settings, check what each app can reach, such as location, contacts and photos. Turn off anything the app doesn’t need to work¹³.
3. Shut down ad tracking. In the advertising section of your phone’s privacy settings, opt out of personalized ads, and reset or delete your advertising identifier¹³. Do it on every phone and tablet.
4. Limit location. Set location to “never” or “while using” for health apps. Block location sharing in your web browser too¹³.
5. Clean up your browser. When a site asks about cookies, allow only the types you want, and turn on Global Privacy Control if your browser offers it¹⁰¹³.
6. Check each app’s own settings. Look for options to share data with partners, research programs or “personalized offers.” Switch off any you didn’t knowingly choose.
7. Use less identifying details. Where an app allows it, skip your real birth date, use a separate email address and leave optional health questions blank.
8. Delete accounts, not just apps. Removing an app from your phone doesn’t erase what the company stores. Use the company’s account deletion or privacy request process. Californians have a legal right to ask, and can use DROP for data brokers¹⁰¹¹.
9. Handle genetic data separately. If you’ve used a DNA kit, decide whether to delete your data, destroy your sample and withdraw research consent¹².

How common beliefs hold up

What people assume	What the record shows	Evidence level
“HIPAA protects my health app data.”	HIPAA covers plans, clearinghouses, certain providers and their contractors; many apps fall outside it815	Evidence says no for most apps
“A privacy promise means my data stays put.”	Flo, Premom and Monument all promised privacy, the FTC said, then shared data146	Evidence says no
“A ‘HIPAA compliant’ label settles it.”	Monument claimed HIPAA compliance its own assessor didn’t back up6	Evidence says no
“Deleting the app deletes my data.”	Removing an app doesn’t send a deletion request; you have to ask the company, as California law lets residents do10	Evidence says no
“Phone privacy settings stop apps from sharing my data.”	The FTC recommends these steps but warns that tools like ad blockers don’t stop all tracking13; Flo’s and Premom’s sharing ran through code inside the apps14	Evidence says no, though the steps still cut some tracking

Questions readers ask

The bottom line

The health data you create on your phone, watch and laptop is mostly governed by company promises, not HIPAA. FTC cases show those promises have failed repeatedly, often through quiet code rather than hackers, and penalties rarely pull the data back.

You can’t control every company, but you can control what you share. Fewer apps, tighter permissions, no ad tracking, regular deletion requests and a plan for breach notices will shrink the trail you leave behind.

Keep exploring: AI health information.

Related reading

• What protects your data when HIPAA doesn’t cover most health apps
• How wellness groups protect privacy, since a closed group isn’t a confidential one
• AI chatbots pass medical exams, yet people using them don’t diagnose better
• The wellness subscription you meant to cancel
• “FDA registered” isn’t “FDA approved”: a buyer’s map to wellness devices

Sources

1. Federal Trade Commission. “Developer of Popular Women’s Fertility-Tracking App Settles FTC Allegations that It Misled Consumers About the Disclosure of their Health Data.” FTC, 2021. ftc.gov
2. Federal Trade Commission. “Flo Health, Inc.” Case page, FTC, 2021. ftc.gov
3. TechCrunch. “Jury rules Meta violated California privacy laws by collecting menstrual health data from Flo.” TechCrunch, 2025. techcrunch.com
4. Federal Trade Commission. “Ovulation Tracking App Premom Will be Barred from Sharing Health Data for Advertising Under Proposed FTC Order.” FTC, 2023. ftc.gov
5. Federal Trade Commission. “Proposed FTC Order will Prohibit Telehealth Firm Cerebral from Using or Disclosing Sensitive Data for Advertising Purposes, and Require it to Pay $7 Million.” FTC, 2024. ftc.gov
6. Federal Trade Commission. “Alcohol Addiction Treatment Firm will be Banned from Disclosing Health Data for Advertising to Settle FTC Charges that It Shared Data Without Consent.” FTC, 2024. ftc.gov
7. Federal Trade Commission. “FTC, States Act Against Hims & Hers for Deceptive, Unlawful Privacy Practices.” FTC, 2026. ftc.gov
8. Federal Trade Commission. “FTC Finalizes Changes to the Health Breach Notification Rule.” FTC, 2024. ftc.gov
9. U.S. Department of Health and Human Services, Office for Civil Rights. “HIPAA Privacy Rule Final Rule to Support Reproductive Health Care Privacy.” HHS, 2025. hhs.gov
10. California Department of Justice, Office of the Attorney General. “California Consumer Privacy Act (CCPA).” State of California, 2026. oag.ca.gov
11. California Privacy Protection Agency. “About DROP and the Delete Act.” CalPrivacy, 2026. privacy.ca.gov
12. California Office of the Attorney General. “Attorney General Bonta Urgently Issues Consumer Alert for 23andMe Customers.” State of California, 2025. oag.ca.gov
13. Federal Trade Commission. “How Websites and Apps Collect and Use Your Information.” FTC Consumer Advice. consumer.ftc.gov
14. Federal Trade Commission. “What To Know About Medical Identity Theft.” FTC Consumer Advice, 2024. consumer.ftc.gov
15. U.S. Department of Health and Human Services, Office for Civil Rights. “Filing a Complaint.” HHS, 2026. hhs.gov