Are period tracking apps sharing your health data?

The concept of period tracking—monitoring body changes to determine where you are in your monthly reproductive cycle—can help make menstruating more predictable and less of a hassle. If you use a period tracking app, chances are pretty good it knows you better than most people in your life.

The rapidly growing femtech industry has fostered the meteoric rise of apps like Flo, Life, Clue, and Eve, and fitness tracker companies like Fitbit and Oura have updated their companion apps to include period tracking.

Prior to the growth of apps, people tracked periods on paper calendars and diaries, so the idea isn’t new. What is: How that private health information gets commodified. Having an app that knows you inside and out could come at a cost.

What information do period tracking apps ask for?

Using an app, by its very nature, can involve divulging information to the company that runs the technology. With period tracking apps, the data collected can be highly private and very sensitive. The apps vary slightly, but almost always ask users for their birthdate, weight, height, and whether or not they had a period, exercised, dealt with a breakout, were in a good or bad mood, or had sex on each day.

This is all potentially of high value to advertisers—and period tracking app companies know this. If you’re concerned about your privacy rights, you’ll want to thoroughly check the company’s privacy policy before downloading an app.

What are tracking apps doing with my data?

As history shows, a whole lot. In 2019, The Wall Street Journal reported that the Flo app, along with several other health-related apps, had been sharing user data with Facebook. The data was then matched to actual profiles and used for Facebook’s ad targeting services.

Flo’s developers initially claimed they had never sent data to third parties in the first place, then, after the article came out, pledged to stop sharing their data with Facebook.

Period app data has also been shared with users’ places of employment. Another app, Ovia, has been outed for sharing user data with some workplaces. The individual users’ data was anonymized and aggregated, but the app’s 6,000-word terms of use gave the app “royalty-free, perpetual, and irrevocable license, throughout the universe” to “utilize and exploit” their health data.

“In many cases, even if users are de-identified, it might be possible to figure out who is who,” Bruce Umbaugh, a professor of philosophy at Webster University who teaches courses on technology and privacy, told Reviewed. In other words, just as period app user data can be matched with Facebook profiles, it can also be connected with individual employees—with greater real-world implications—within a company.

Why does it matter if this information gets shared?

After the Supreme Court overturned Roe v. Wade, many people who track their menstrual cycles electronically are concerned about their data ending up in the wrong hands—especially those who live in one of the 13 states with trigger laws, such as Texas or Arkansas, where one may be prosecuted, fined, or jailed for having an abortion.

Though the specifics of each law vary by state, exceptions can typically only be made for those with life-threatening pregnancies or in cases of rape or incest, and even then patients are subject to additional trauma and scrutiny.

Since 2019, many period apps have promised to stop selling personal information to third parties. However, many apps still have the right to share your information to comply with the law or law enforcement. This means that if your period app of choice’s privacy policy states they can share your information with law enforcement if legally required, your personal period data could be legally shared with these third parties.

Many companies are looking for new ways to honor users’ privacy moving forward. In light of Roe v. Wade’s reversal, the Flo period tracking app has introduced a feature called “anonymous mode,” which allows you to remove your personal identity—including your name and email address—from your account. In a nutshell, this means that emails and names can’t be linked to an individual person, rendering you (and your health data) unidentifiable while using it.

You may also want to check your app’s policy for sharing information with employers and insurance providers. Ovia claims the information they give companies helps them minimize healthcare costs and provide better benefits for their employees.

Indeed, data such as the average time it takes for employees to get pregnant, the percentage with high-risk pregnancies, how they gave birth, and their timeline for returning to work could inform what benefits may best serve them. Still, it’s extraordinarily private information that employees themselves may not ever have intentionally shared.

In addition, there’s the simple fact that not everyone who gets pregnant stays pregnant. This might be due to miscarriage, which occurs in at least 10 to 15 percent of pregnancies in their first twelve weeks, or termination (195 cases per 1,000 live births in the United States in 2019, according to the CDC).

The dissemination of such sensitive data, then, can feel particularly troubling for someone who has come to think of their tracking app as a kind of private diary or AI confidante, which is how many period tracking apps present themselves.

“Under the guise of giving women greater control over their reproductive health and well-being, these apps [may] exploit women by commodifying intimate and personal information about them,” Umbaugh said. “Rather than empowering women, these apps can facilitate manipulating them or discriminating against them.”

How can I keep my personal data private?

If you’d like to keep your period information locked down, your best bet is to keep track of it the old fashioned way, with pen and paper. But if you prefer the convenience (and electronic reminders) of an app, try to use one that has a clear privacy policy.

Germany-based Clue adheres to the world’s strictest privacy law, the European GDPR; another app, Natural Cycle adheres to similar protocols, and currently states on their website that they are working towards encrypting data for a safer, more private user experience.

Regardless of which app you use, it pays to read privacy policies carefully to learn what else apps might do with your data. Staying informed about internet privacy in general through advocacy sites like Coding Rights and the Electronic Frontier Foundation is a great place to start, according to Umbaugh.

For any app, find out if it continues storing your information even after you delete it, how and if data gets shared with third parties, and how easy it might be to connect your data with your real-world identity.

An ideal app, Umbaugh says, does not require a user to create an account, allows users to control their privacy settings, and stores its data locally on your phone, rather than in its servers on the cloud. (Clue, Dot, Life, and Groove, for their part, allow individuals to use the app without an official account.)

Most importantly, in terms of security and your health, pay attention to changes in the app, both in terms of its privacy policy and how using it makes you feel. Things are rarely ever the same from one day to the next on the internet, which, if you think about it, tends to be the case with human bodies, too. And, who knows? Maybe the right app can help provide you with better control of both.

The product experts at Reviewed have all your shopping needs covered. Follow Reviewed on Facebook, Twitter, Instagram, TikTok, and Flipboard for the latest deals, product reviews, and more. Prices were accurate at the time this article was published but may change over time.