Are period tracking apps really private?

by Jane Harkness

When my alarm went off at 6:30 AM, I reached for the tiny thermometer on my nightstand and stuck it under my tongue, catching one more precious minute of sleep until it beeped and prompted me to log my temperature. No, I didn’t have a fever—I had just used up my last packet of birth control, and after five years of religiously swallowing a pill each day, I was about to start tracking my cycle.

Like many other women who once relied on the pill (or another form of hormonal birth control), the side effects I was experiencing eventually began to outweigh the benefits. While the pill had undoubtedly been the right choice for me for several years, my lifestyle and circumstances had changed, and it was time to begin researching other options.

Shortly before I discontinued my use of the pill, I learned that it was possible to track my cycle by noting my basal body temperature each morning, and although I didn’t intend to solely use this method to avoid pregnancy, I wanted to educate myself. Rather than charting in a notebook, I immediately downloaded a cycle tracking app called Flo to record all of my data.

Flo quickly became my little companion—it did the math for me, letting me know what my body was up to at each phase in my cycle. I could log how I was feeling each day, chart my temperature, see my chances of getting pregnant, and get insights on how to address common PMS symptoms like hormonal acne and headaches.

Cycle tracking apps fall under the growing category of “femtech” products, a now-billion dollar market that continues to grow. Femtech refers to devices and software designed for women to track their health data or manage their reproductive health. New examples seem to be popping up every day, from the wearable fertility tracking bracelet called “Ava” to Nurx, a telemedicine service for birth control.

These apps are some of the most popular femtech offerings, and people download them for a variety of reasons. For those like myself, cycle tracking apps present an opportunity to learn more about your cycle after going off hormonal birth control. Although only one of these apps, Natural Cycles, has been approved as a form of contraception (a decision which was met with controversy after users began reporting unplanned pregnancies), a small number of women do rely solely on the Fertility Awareness Method, or FAM, as their primary form of birth control. These apps can help users figure out when they’re ovulating so that they can practice abstinence during that window and ideally avoid pregnancy.

Although Flo can send me push notifications to alert me about where I’m at in my cycle, I chose to turn them off—I didn’t really want a random person looking over my shoulder when a message popped up to let me know that I about to start my period. But after a couple months of using the app, this small effort to protect my private information about my reproductive health from strangers suddenly struck me as a little odd. If I wanted to keep my info private, didn’t my app usage seem a bit contradictory? I had no idea who really had access to this data, or what they could legally use it for.

I reached out to a few friends who also use cycle tracking apps to see if they had any of the same concerns. After chatting with them, it seemed as though the reason behind their usage—and how much data they willingly entered—had an influence on their opinions.

“I’m on on the pill, so I use my app just to keep track of when my cycle is going to start. I really only need it so that I’m notified when day one is going to roll around,” Nicole told me. “I could put in all kinds of other information if I wanted to—there are options to track lots of symptoms. But I don’t really bother with that right now, so privacy isn’t a huge issue for me.”

Another friend of mine had a slightly different take. “I have an irregular cycle, and I’ve never used hormonal birth control like the pill to manage that, so I’ve been using a tracking app to try to predict when my next period will come,” said Anne. “Unfortunately, it still likes to surprise me and show up whenever it wants.”

“I am definitely a private person when it comes to most of my information, so I think it’s fair to ask what really happens to the health data from apps like these,” Anne clarified. “I don’t really have any social media accounts, and I wouldn’t purchase a product that collects data like Alexa or Google Home does—I do use my smartphone for plenty of things, but honestly, I am skeptical about a lot of these big tech companies, and we never really know what they might use our data for.”

So, do we have a right to be skeptical? As it turns out, the data on these cycle tracking apps isn’t exactly private.

While some companies are straightforward about using this data solely for research purposes, many others don’t even have a privacy policy. HIPAA, the privacy law that prevents American doctors from doling out personal medical records, doesn’t apply to health apps. To some, this may not seem like a big deal—who wants to scroll through another Terms and Conditions pop up, anyway? But the lack of regulation means that there are no legal boundaries around selling or trading this highly personal information. The companies behind cycle tracking apps can legally dish out this data to developers, data brokers, and marketers, and few of these apps are even subjected to any data security testing before becoming available to consumers.

In Canada, the Personal Information Protection and Electronic Documents Act (PIPEDA), is supposed to protect health information regardless of the source, and sales of data should be restricted to instances in which individuals specifically consent to the sale. However, data that does not explicitly identify individuals can be legally used for noncommercial purposes, and health privacy laws can also vary across provinces.

Perhaps most unsettling is that there is growing evidence that health insurance companies may be able to use digital data to determine policy rates, which carries worrisome implications for people who do not have access to affordable public healthcare options. Data brokers can collect a range of personal details about individuals, including everything from race to net worth to their online purchases to social media posts, and feed that information into algorithms that predicts how much their health care policy could cost the insurance company. The algorithm uses these details to determine if a client might carry any risks that could raise costs. This data is supposed to be used in order to flag clients for services they may need, but when journalists working with NPR and ProPublica questioned whether or not this data was also being used to set prices, they received a vague response, with one research scientist from an unnamed insurance company stating, “I can’t say it hasn’t happened.”

Reproductive health data is especially valuable to advertisers. Expecting first-time parents typically need to purchase a lot of new products, and women who are trying to conceive are a prime demographic for companies offering supplements and treatments that claim to boost fertility or help with hormonal imbalances. In theory, this type of targeted advertising may seem helpful, but in practice, it can come across as invasive. For example, one cycle tracking app, Glow, even prompted users to consider egg freezing, a method which is prohibitively expensive for most women and rarely effective for actually getting pregnant. Before downloading Flo, I researched different cycle tracking apps and methods, and within days, I was bombarded by ads on social media for products intended to help women conceive, such as the Ava bracelet. None of these products or services were useful to me, and seeing these ads on a regular basis only served to exacerbate my worries about unintended pregnancy after going off the pill.

There are also valid concerns over potential data breaches. A security oversight at Glow meant that for a period of time, anyone with an app user’s email address could access their full profile. Although the issue was remedied, it raised questions about whether or not these apps were actually secure in terms of data storage. And in February 2019, an investigative report from the Wall Street Journal revealed that several cycle tracking apps, including Flo, were sharing data with Facebook—despite the fact that Facebook supposedly prevents app developers from sending “sensitive data."

Despite the pitfalls around privacy, using these apps can still be a good choice for some. A person who is trying to conceive will likely want to know the ins and outs of her cycle to increase their chances of getting pregnant faster. Furthermore, someone who is struggling with a medical problem related to their cycle may want to log and chart all of their data in one organized file to pass along to a doctor in order to get a diagnosis. After all, there are no definitive diagnostic tests for conditions like polycystic ovarian syndrome or endometriosis. Despite affecting approximately 200 million women worldwide, endometriosis in particular is under-researched compared to similarly prevalent conditions, and on average, it can take over eight years for someone with this condition to receive an actual diagnosis. This could be related to the fact that women are more likely to have their pain dismissed as a psychosomatic phenomenon rather than a medical problem with a physical root cause. If cycle tracking apps can help women work with their doctors to manage these conditions, it seems like a net positive.

The team behind the cycle tracking app Clue, one of the first on the market, is open about sharing the data they collect with medical researchers at various universities. They have contributed anonymous user data to studies on diseases and medical conditions like breast cancer, PMS, and mental health in relation to the menstrual cycle. Data like this can be valuable for this sort of research, but there are some caveats.

Unfortunately, self-reported health data is not always accurate, and in terms of the info that a user can actually input on these apps, there are a few glaring blind spots. For example, I could select “Pregnancy Mode” on Flo to record pregnancy data for nine months—but if I terminated a pregnancy or had a miscarriage, my only option would be to delete all of the pregnancy data and render my previous information moot. When it comes to under-researched reproductive health issues, incomplete data is certainly better than nothing, and analyzing it could yield some important results—but there are still going to be some gaps in the data from these apps.

In my own grasp for body literacy, I had handed the responsibility for my reproductive health from a pill to an app. Sure, Flo was “learning” all about my cycle, but so were marketers who couldn’t care less about my overall wellbeing, unless my data indicated that there was an opportunity to sell me something. Sharing this kind of data felt intensely personal in comparison to posting a photo of my morning coffee on Instagram or tweeting about my plans for the day. I couldn’t imagine myself giving out this data to anyone I knew, so why was I handing over every detail of my cycle to advertisers and platforms like Facebook? While I could appreciate the value in these apps for some women, I realized that I didn’t necessarily have a need for Flo, and I could afford to keep my data to myself.

Like many of Silicon Valley’s latest offerings, these apps present a mixed bag of benefits and ethical conundrums. As for me, I think it’s time to go back to basics—tracking by pen and paper might be less convenient, but at least I know it’s private.

Jane Harkness is a freelance writer based in New Jersey. Her writing has been published on Thought Catalog, Student Universe, Pink Pangea, and more.