Dutch digital rights organization Bits of Freedom has filed a complaint against popular period-tracking app Flo, accusing the company of unlawfully collecting and sharing highly sensitive user health information. The complaint was submitted to the Dutch Data Protection Authority (AP), which is now being asked to investigate the app’s data practices.
According to Bits of Freedom, Flo allegedly processes large amounts of intimate personal information entered by users into the app, including menstrual cycle details, sexual activity, symptoms, headaches, cramps, moods, pregnancy information, and other health-related data. The organization claims users may not fully understand how extensively this information is collected and potentially shared.
Flo is one of the world’s most widely used fertility and menstrual cycle tracking applications, with millions of users globally. The app allows users to log reproductive health information, receive cycle predictions, and track symptoms related to menstruation, fertility, pregnancy, and overall health.
The complaint argues that health-related information collected through apps like Flo falls under special-category personal data protections under the European Union’s General Data Protection Regulation (GDPR). Under GDPR rules, companies processing sensitive medical or health data must meet stricter legal requirements regarding consent, transparency, and data protection.
Bits of Freedom alleges that Flo’s privacy practices may not satisfy those requirements. The organization specifically raised concerns about whether users are provided with sufficiently clear information about how their data is processed, who may receive access to it, and for what purposes the information could be used.
The complaint also references concerns about online advertising and data-sharing practices involving sensitive personal information. Privacy advocates have repeatedly warned that reproductive health apps can create extensive behavioral profiles because users often disclose highly intimate details about their bodies, relationships, and medical conditions.
Flo has denied wrongdoing and said it takes user privacy seriously. The company stated that protecting health data is a priority and that it complies with applicable privacy regulations. Flo also said users maintain control over their information and that the company has implemented safeguards designed to protect sensitive data.