Context:

Fertility or menstrual cycle trackers have been used by nearly a third of women in the U.S., according to a recent Kaiser Family Foundation survey. They are part of the burgeoning market for “femtech,” which are technology-based products and services focused on women’s health. The market for all digital tools for women’s health needs—such as apps for personalized nutrition advice, weight-loss coaching, and high-tech breast pumps that record when and how much is pumped—could be worth as much as $50 billion by 2025, according Frost & Sullivan, a research and consulting firm.

Sensitive data collection:

Fertility or menstrual cycle trackers, broadly categorized as reproductive health  trackers, can be used for a wide variety of reasons in addition to monitoring menstruation. Professional athletes, such as those on the U.S. women's soccer team and several British Olympic hockey gold medalists, use them to tailor workouts and nutrition plans to their body's cycles. Clue, Ovia, and Flo say that medical researchers use anonymized information from the apps to study women’s health concerns. Some even have features that manufacturers claim will help diagnose medical conditions. Flo and Clue recently introduced tools to assess a user’s risk of polycystic ovary syndrome (PCOS), a hormone disorder that can affect a woman's fertility. Period tracker apps are billed as useful tools for people who are trying to have a baby, want to prevent pregnancy, or need to monitor menstrual-cycle-related health problems such as hormone-triggered migraines. 

Personal information at risk:

But to provide these services, the apps collect deeply personal information that can go well beyond the dates of your period. Depending on the app, that can include how often you engage in sexual activity, if you are trying to conceive, and whether you engage in unprotected sex, have experienced a miscarriage, or are approaching menopause.

Data sharing to third parties and marketing:

Consumer Reports’ Digital Lab found in a recent examination of five popular reproductive health tracking apps—BabyCenter, Clue, Flo, My Calendar, and Ovia—that even anonymous users have no guarantee that their information won’t be shared in some way with third parties for marketing and other purposes.

[Excerpts gathered from CR Article: What Your Period Tracker App Knows About You]

The graphic scorecard illustrates some of the top categories to highlight throughout the experience. 

Findings reported in CR article:

Consumer Reports reported the findings through an article that highlighted the apps are popular, but raises concerns about what happens to the very personal data they collect. None of the apps guarantee that all of your information will be used only in ways you intend. That’s because they all share some user data with external partners for purposes such as targeted advertising. And those partners may then share or resell your personal information to third parties who make no promises to you about how they handle it. 

Letter to app companies:

CR’s Digital Lab also found shortcomings among all five apps in how they protect the sensitive user data they gather. The advocacy team wrote an email that urged these apps to: 

1. Only use collected data for the purpose of the health app;
2. Limit the data you collect to only information needed to operate the app;
3. Decline to share or sell user information;
4. Safely destroy collected data once it is no longer needed to operate the app; and
5. Give consumers clear and concise information about what you do with their data and why.
6. When CR alerted the companies to these findings, some moved quickly to make fixes. 

Flo app made changes:

Flo dropped Facebook as an ad-tracking and data-analytics partner after The Wall Street Journal revealed in February 2019 that the app shared personal data, such as whether a user intended to become pregnant, with the social media giant, which used the information for targeted advertising. Now Flo uses only one partner for ad targeting and app usage analysis while the other apps CR evaluated use a half-dozen or more.

Identified shortcomings in data collection:

While CR’s Digital Lab didn’t uncover any major security issues, it did find shortcomings in the way all five apps handle the sensitive user data they collect, says Maria Rerecich, CR’s senior director of product testing. For example, none require users to log in by default every time they open the app, or offer multi-factor authentication (which requires that users input a code sent by text to their phone), or require an additional security step before accessing the app.