- Key issues
What do women’s health apps do with your data?
- 5 minutes
- By Klara Lee, El Blackwood and Talia Goury
Unfortunately, a lot.
Millions of women use health apps every day. Apps to track their menstrual cycle, for weight maintenance, and even apps to help navigate life with breast cancer.
Many of these apps are genuinely useful. However, in order for them to function they collect a large amount of intimate personal data, some of which wouldn't even be shared with close friends or family.
In this blog, we'll cover:
✔️ What information is typically collected by these apps
✔️ Why this information is so valuable
✔️ What the most popular health apps collect and share specifically
✔️ What metadata is and how it's used
✔️ How you can prevent your sensitive data being shared
Information that women's health apps typically collect:
- Name & address
- Gender and date of birth
- Place of residence
- Cookies and IP address
- Menstrual activity and cycle dates
- Sexual activity and sexual health
- Fertility and pregnancy plans
- Sexual orientation
- Cervical mucus quality
- Contraceptive history
- Sleep activity
- Health diagnoses and medications
- Details of partners and children
- Dietary restrictions
- Fitness level and heart rate
While this information might be necessary for the app to function properly, what most apps don't fully inform their users of is that they share a lot of this information with third parties. Just as these details are personal and likely dear to you, they can be equally as valuable to advertisers.
Why is women's health data so valuable?
One of the reasons it's so valuable to advertisers is because it allows them to target you more effectively. It allows advertisers to understand exactly what you feel, why you're feeling it and when you do.
For example, the data of expecting mothers, who could be using menstrual apps to track fertility, mood and symptoms. In the US, an average person’s data is worth $0.10, while a pregnant woman’s will be $1.50.
What do the most popular health apps, like Flo and Clue, collect about you?
Our team went through the privacy policies of the most popular women's health apps, so you don't have to. You can read our investigation below and let us know what you think @rightlydata.
Let’s start with period tracking apps. These apps can help demystify the reproductive cycle and explain why you may feel a certain way some days and when in the month you are most and least fertile.
Everyday, Flo asks its 100 million users to enter intimate data about their bodies such as their libido, weight, length of periods, vaginal discharge, and mood.
Flo offers the option to join a community of like-minded women to have open and honest conversations about fertility, contraception and more. Flo and Clue recently introduced tools to assess a user’s risk of PCOS, a hormonal disorder that can affect a woman's fertility.
What data does Flo collect on you?
- Name, email address, gender, date of birth
- Place of residence and associated location information
- Body temperature
- Menstrual cycle dates
- Various symptoms related to your menstrual cycle and health
- Other information about your health (including sexual activities), well-being, and related activities, ‘including personal life’
Does Flo share your data with third parties for advertising purposes?
- Your IP address (which may also provide general location information), User agent, IDFA (Identifier for advertisers), Android ID (in Android devices), Google Advertiser ID, Customer-issued user ID and other similar unique technical identifiers
- Your age group
- Your subscription status
Flo share your data with the following companies:
Last year, the Guardian reported how menstruation apps such as Flo store excessive data on its users, especially since Flo even stores a users’ notes section, where they can include intimate details about their personal life.
The German period tracker and fertility app Clue has more than 10 million installs, on Google Play. Clue lets you track any physical symptoms of your cycle and your mood, throughout the month and allows you to link the app to wearable devices, such as an apple watch or fitbit. You can also download their Cycle Report to send to your doctor or obstetrician.
What data does Clue collect on you?
It claims to collect data ‘such as Device Data, Event and usage data and IP-address’.
When you open the app, however, you are able to track data such as your mood, energy levels, physical pain, when you were last sexually active, discharge, hair condition and more.
Do Clue share your data with third parties for advertising purposes?
‘We do share a minimal amount of data about our users with advertising networks (but we never share the menstrual or other health data you track in the app)’
Although Clue aren’t specific about what ‘minimal’ data includes, the data it previously shared with Facebook, until 2019, was metadata - such as whether the user installed the app, how often the user is using the app and if the user bought something from the app.
Clue shares data with:
- Google Adsense
Clue also shares your data with ‘carefully-selected health researchers at a trusted research institution’. But, they ‘don’t make any money from this’.
Last year, Clue was also reported to store excessive data on its users, and in 2016, was cited in an article that warned a women about the reliability and data collection of ‘booming’ period tracker apps.
Natural Cycles is the only app that comes with a basal body thermometer and is approved by the US Federal Drugs Administration (FDA) for the purpose of contraception. Women must input their temperature every day, and the firm claims 93/100 women do not fall pregnant, which would make the app as reliable as the pill (although many have challenged the app's reliability).
What data does Natural Cycles collect on you?
Natural Cycles collects:
- ‘Health and sex data’; whether you want to prevent or plan a pregnancy, contraceptives history, body temperature, menstruation and intercourse data, ovulation, pregnancy test results and personal notes
- ‘Usage data’ such as traffic data and the features you access
- Name, address, date of birth, email, phone number and IP address
- Whether or not you have an active prescription
Do Natural Cycles share your data with third parties for advertising purposes?
Natural Cycles share your data with a number of third parties, including:
No, there are currently no news headlines related to the data sharing practices of Natural Cycles.
Glow is another popular women’s health app that focuses on tracking cycles and fertility. Users are asked to record when they have their period, their weight, medications, the position of their cervix, any history of abortions, their mood, and much more.
What data does Glow collect on you?
Glow collects a lot of sensitive information about you; since it is heavily focused on fertility, you can input all of your medications and even input personal details about your children.
- Name, email address, password, date of birth and mobile phone number
- Payment and transaction data
- (you choose to provide) name, profile photo, location, ethnicity, gender, relationship status, interests, preferred language, occupation and insurance type
- your physical attributes, sexual orientation, fertility, pregnancy, sexual activity, menstrual activity, sleep activity, mood, health conditions, medications, and number of children
- (data about others) such as the names and contact details of the spouses or partners to whom you choose to grant access to information in your Glow app and any information you choose to share about your children, such as ‘name, date of birth, ethnicity, height, weight, other physical attributes, photos, feeding activity, sleep activity, developmental milestones, health and medications’.
Do Glow share your data with third parties for advertising purposes?
By legal definition, Glow ‘sells’ your personal information but allows you the option to opt-out of this sale.
‘Advertisers whose ads are posted on our Service may be able to infer information about you when you click on those ads (e.g., that you have a newborn if you click on an ad about a newborn product)’
Glow sells your data to:
Although it is illegal to share ‘health data’ for advertising purposes, since this data is all stored and collected on the app, it is vulnerable to security breaches like hacking. Last year, California settled with the Glow App after alleged privacy and security violations for $250,000.
Cycles allows you to track your period whilst also letting you share your cycle phases with your partner so they can get discreet notifications about when you're fertile, when you're on your period, and when you're PMSing.
What data does Cycles collect on you?
- ‘Usage data’ such as ‘how often certain symptoms are tracked, or how often Cycles is used’
- ‘Health data’ such as basal body temperature, pain, cravings, sexual activity, cervical mucus quality etc.
- The contact details you provide
- IP addresses, timestamps, log files, and operating system
Do Cycles share your data with third parties for advertising purposes?
‘We may share anonymous, aggregate statistics with outside parties, such as common symptoms during different phases of the menstrual cycle, average cycle lengths etc’.
Since this data is ‘anonymous’ it is not illegal to share, but many studies have shown that de-anonymising data is very easy.
Unfortunately, the policy does not specify the companies that your data is shared with.
Period Calendar is the top period tracking app on Google and similarly to the other apps mentioned, you can track and rate physical and other symptoms when logging your cycle.
What data does Period Calendar collect on you?
Period Calendar collects: ‘usage details, metadata, and real-time information about the location of your device’.
Do Period Calendar share your data with third parties for advertising purposes?
Period Calendar share your data with the following companies:
They have also stated in their policy: ‘We do not control all of the Advertisers’ tracking technologies or how they may be used. If you have any questions about an advertisement or other targeted content, you should consult the respective privacy policies of the Advertisers’.
Ovia is an app focused on helping users become pregnant, tracking your fertility and basal body temperature as well as your period and cervical position.
What data does Ovia collect on you?
Ovia collects the following data:
- IP address, the Advertising ID of your mobile device, device type and operating system
- Your activity in the apps such as the articles and ads you view
- Name and email address
For example, games on your phone can infer your IQ based on your score, Google is known to infer very accurate details about your age, gender, profession and hobbies, based on your searches. It is likely that most of the apps we have listed do so too, which makes it that much more refreshing to hear that Ovia are being honest about it. It's the little things.
Do Ovia share your data with third parties for advertising purposes?
Ovia has said that they ‘show you advertising and to advertise Ovia on third party platforms, we share indirect identifiers, such as the Advertising ID of your device, with advertising networks and platforms, and advertising technology providers’.
Ovia are not specific about the companies they share your data with but do say that ‘an ad network, third party platform or advertising technology partner may reuse that information to make inferences about your interests and to show you other advertising outside the Services’.
Although this app is not solely targeted at women, a 2018 study of a large Dutch population showed that, whilst men were more likely to use fitness apps than women, women were more likely to use nutrition and dieting apps than men. So, it made sense to share what the most popular dieting app in the UK does with your data.
What data does MyFitnessPal collect on you?
- Name, username and password, email address, date of birth, payment information and Location Data.
- Imputed ‘Fitness and Wellness Data’ collected or inferred from mobile device sensors. This includes lifestyle information like your sleeping habits, life events, dietary restrictions, fitness goals, height, weight, measurements, fitness level, heart rate, sleep data, BMI and biometric data.
- If you connect to your social media accounts, personal data can be connected from that platform. For example, when you log in with your Facebook details, ‘with your consent, we may collect Personal Data from your Facebook profile such as your email address, profile picture, and friend list’.
- When you leave reviews, or enter information into comment fields, blogs, message boards, or events this personal data is also collected.
Do MyFitnessPal share your data with third parties for advertising purposes?
MyFitnessPal claims that ‘its advertising partners collect and use information about you (such as workout, nutritional, purchasing history, demographic information like gender and age, your device information, and your location) to serve you advertising that’s relevant and useful to you based on that information’.
The app only claims to share your data with ‘advertising and marketing partners...including but not limited to Facebook.’
In 2018, 150 million accounts on MyFitnessPal were compromised and at risk of a data breach and Under Armour (the owner of MyFitnessPal) notified users of this.
Another app not limited to female users but dominated by them nonetheless, The Breast Cancer Healthline app provides a platform for newly diagnosed and long-term survivors of breast cancer to connect with one another. The app includes live discussions of community leaders and lets you search the app for whatever is on your mind to find relevant conversations, members and articles.
What data does Breast Cancer Healthline collect on you?
- When you search for and schedule medical care
- Name, email address, physical address, birth date, gender, zip/city
- Marital status and health information (diagnosis, when you were diagnosed, what medications you're taking, or what type of care you're looking for
- ‘Social Media’; If you share an article or post a comment or other content with a friend/contact.
Do Breast Cancer Healthline share your data with third parties for advertising purposes?
‘A profile can be built about you and your interests to show you personalised ads that are relevant to you’. You can read our blog about the building of user profiles if you’d like to know more about this.
Breast Cancer say that they ‘share your information with third parties...such as ad technology providers’ including:
- Integral Ad Science
Powered by AI, Skin Genius lets you take a picture of your skin and tells you what should be treated first in a matter of seconds’, you are then able to objectively dissect the ageing of your skin, using 5 dimensions analysis. It also claims to be very effective, matching 95% of dermatologists evaluation of skin types. This app is targeted largely at women, as is it’s make-up owner, L’oréal, but can be used by both men and women.
What data does Skin Genius collect on you?
Since Skin Genius is part of the bigger beauty company L’oreal, it can collect and store a variety of information on you, including:
- Name, gender, address, number, e-mail address, IP address, social handle and device identifiers
- Payment details and purchase history
- Precise and general location
- Photographs that you upload or share with the app
- Inferences drawn from personal data such as ‘beauty and related preferences, characteristics, behaviors on and off site, purchase patterns, demographic, household’
Do Skin Genius share your data with third parties for advertising purposes?
Skin Genius say that they ‘use third party companies to serve advertisements, measure the performance and engagement with our ads, provide analytic, preference, and interest information...these ad network providers...may use their own tracking technology to capture information about your device, use and engagement online’.
L’oreal share your personal information with the following companies:
What is metadata, and why is it a problem that these apps share it?
Metadata is any information that can reveal answers to questions like who, what, when and why? All of the apps we've mentioned share your 'metadata' with advertisers. Sharing your metadata can include your IP location address and the times you open and closed the app in question.
For instance, if you've visited a sexual health clinic, the app will inform advertisers on how often and why you visited, based on other information linked to you. Or, you might have a favourite song that you listen to on repeat. The app in question would provide advertisers with the name and genre of your favourite song as well as how often you listen to it. The only thing it wouldn't share would be the song tune itself!
Minor as it may seem, the cumulation of such data can provide advertisers with a detailed and revealing user profile. In the past, alike metadata shares have enabled advertisers to gain information on users' political inclinations, health status, family relationship and financial status.
Over the last few decades we've seen the rise of the 'she-conomy'. With that, more and more apps are being made and targeted specifically at women. As we've revealed in our investigation, this often involves the collection and analysis of their health data. Although this data logging and analysis can be very useful to women in navigating their personal lives, this data is hugely valuable and often deliberately shared with advertisers to increase profits.
We know that it's practically impossible to read the privacy policies of each of these apps before you use them, but we hope this article shows just how much personal information they take and share. With this information, you can now take action if you want to.
If you'd like to delete your data from any women's health app, you can here. Alternatively, if there is a health app that you're concerned about that wasn't mentioned in this article, get in touch and we'll research it for you.
How your mental health data and information is sold to advertisers
- Key issues
Our mental health data, for many of us the most personal, is regularly shared with advertisers and data brokers.
- 8 minutes
What is the ‘Ad Tech’ industry, and why have I never heard of it?
- Data basics
AdTech is shorthand for the Advertising Technology industry – the technology which powers the ads you see online.
- 3 minutes