America's FTC reaches settlement with Flo health app after breach in women's health data
A woman looks at her phone in Milan
America's Federal Trade Commission(FTC) reached a settlement with Flo Health after it allegedly shared personal user data with third-party marketing services including Facebook's analytics division, Google’s analytics division, Google’s Fabric service, AppsFlyer, and Flurry.
The Flo app which tracks period and fertility among women has over 100 million users allegedly included information to third parties on whether users were ovulating.
The FTC has proposed Flo Health, Inc to obtain an "independent review of its privacy practices" and get app users’ consent before sharing their health information.
Andrew Smith, director of the FTC’s bureau of consumer protection said: “Apps that collect, use, and share sensitive health information can provide valuable services, but consumers need to be able to trust these apps,” adding,"We are looking closely at whether developers of health apps are keeping their promises and handling sensitive health information responsibly.”
According to the complaint received by the FTC, Flo disclosed sensitive health information, such as a user’s pregnancy to third parties in the form of “app event”.
The FTC alleged that Flo violated the "EU-US Privacy Shield" and "Swiss-US Privacy Shield" frameworks.
The FTC also issued guidance to consumers about health apps, with tips for consumers on how to select and use these types of apps while reducing privacy risks.
The FTC asked Flo to notify affected users about the disclosure of their personal information and instruct any third party that received users’ health information to destroy data.