The Federal Trade Commission finalized a settlement that will require Flo Health Inc. to obtain the affirmative consent of users of the company’s fertility-tracking app before sharing their personal health information with others and to obtain an independent review of their privacy practices.
In a complaint first announced in January, the FTC alleges that despite promising to keep users’ health data private, Flo shared sensitive health data from millions of users of its Flo Period & Ovulation Tracker app with marketing and analytics firms, including Facebook and Google.
As part of the settlement, Flo Health must notify affected users about the disclosure of their health information and instruct any third party that received users’ health information to destroy that data. Flo also is prohibited from misrepresenting:
- the purposes for which it (or entities to whom it discloses data) collect, maintain, use, or disclose the data;
- how much consumers can control these data uses;
- its compliance with any privacy, security, or compliance program; and
- how it collects, maintains, uses, discloses, deletes, or protects users’ personal information.