Period Tracking App Privacy: What Cycle Apps Collect and Who Sees It

Period and fertility tracking apps collect cycle dates, symptoms, moods, sexual activity, pregnancy status and test results, plus the device identifiers, IP addresses and sometimes location that every app gathers. Who can reach that data depends on where it is stored: only on your phone, in the app maker's cloud, or copied to analytics and advertising partners through software kits inside the app.

In the United States, HIPAA usually does not cover these apps because the companies that make them are not doctors, hospitals or health plans. The rules that do apply are the FTC Act, the FTC's Health Breach Notification Rule (which since 2024 names fertility and sexual health apps explicitly), state laws such as Washington's My Health My Data Act, and in Europe the GDPR's rules for health and sex life data. The practical answer for users is to pick an app that keeps data local or end to end encrypted, use it without an account where possible, turn off analytics and ad tracking, and delete what you no longer need.

This guide is for people who use these apps and the teams who build them. Legal rules come from their primary texts, and named companies are described only through regulators' findings or their own pages, with dates. It is not legal advice.

Key takeaways

• A cycle app holds some of the most sensitive data a phone can store, plus inferences such as "likely pregnant" derived from it.
• HIPAA covers health plans, clearinghouses, providers who bill electronically and their business associates. A consumer app you download yourself is usually none of these.
• The FTC's Health Breach Notification Rule, as amended in a final rule announced on 26 April 2024, covers apps that track "fertility, sexual health" and similar data, and treats an unauthorized disclosure, not only a hack, as a breach.
• The FTC's 2021 order against the maker of the Flo app and its 2023 case against the maker of the Premom app both turned on the same pattern the FTC alleged: health events passed to analytics and advertising software kits despite privacy promises.
• Washington's My Health My Data Act, in force for most businesses since 31 March 2024, requires separate consent to collect and to share consumer health data, a signed authorization to sell it, and bans geofences around in-person health care facilities used to track or target people.
• Data that sits only on your device is reachable mainly through the device. Data in a vendor's cloud can be reached through a breach, a data sharing deal or legal process served on the vendor, unless it is end to end encrypted so the vendor cannot read it.
• App store privacy labels and Google Play's Data safety section are self declared by developers: useful for comparison, not an audit.

What do period and fertility tracking apps collect?

Cycle apps collect three kinds of data, and the privacy risk of each is different.

The first kind is what you type or tap in: period dates and flow, symptoms, mood, basal body temperature, ovulation or pregnancy test results, sexual activity and protection, contraception, whether you are trying to conceive, pregnancy status and, in some apps, pregnancy loss, plus date of birth, height, weight and free text journal entries.

The second kind is what a connected device measures, such as temperature from a smart thermometer or ring, or sleep and heart rate from a watch. On iPhone that usually flows through HealthKit with your permission; on Android through Health Connect or a companion app.

The third kind is technical data almost every app collects: device model, a mobile advertising identifier, IP address (which reveals approximate location), session events, crash logs and the screens you opened. Some apps also request precise location, contacts or a linked partner account.

A fourth category is derived. A model that predicts your fertile window or flags a late period produces new health information from the raw entries. Washington's law explicitly treats derived and inferred data as consumer health data, including information "derived or extrapolated from nonhealth information (such as proxy, derivative, inferred, or emergent data by any means, including algorithms or machine learning)".

What independent research found

Two peer reviewed studies give a sense of how common weak practices have been. In a 2020 study in Proceedings on Privacy Enhancing Technologies, researchers at Royal Holloway, University of London examined the privacy policies and behaviour of 30 Android menstrual apps with nearly 200 million combined downloads. They reported that while ordinary personal data such as name and email was usually covered, reproductive data was in most cases not covered by the privacy policies at all, even when the app needed it to work.

A 2022 scoping review in JMIR mHealth and uHealth by researchers at the University of Zurich assessed 23 popular women's health apps on the App Store and Google Play. All 23 collected personal health data and allowed behavioural tracking; 61 percent (14 of 23) allowed location tracking. Only 70 percent displayed a privacy policy, 52 percent requested consent, 13 percent collected data before obtaining consent, and 87 percent (20 of 23) shared user data with third parties. Only 57 percent gave users information on data security.

Both studies are snapshots of a particular app set on a particular date. They say nothing about any one app today, but they show why reading an app's own disclosures is worth ten minutes.

Where is cycle data stored?

Cycle data can live in four places, and an app can use more than one at once.

1. On the device only. Entries sit in the app's private storage, which iOS and Android encrypt at rest on a phone with a passcode.
2. In a platform backup. Even an "offline" app's data can be copied into an iCloud or Google device backup. Whether the backup provider can read it depends on the backup's encryption mode.
3. In the app maker's cloud. Apps with accounts usually sync entries to a server. The company, its hosting providers, an attacker who breaches it, or anyone who lawfully compels it can potentially reach that copy, unless it is end to end encrypted with keys only you hold.
4. In third party systems through software development kits (SDKs). Analytics, attribution, crash reporting and advertising kits run inside the app and send events to their own servers. If an app sends an event named after a health action, such as logging a pregnancy, the SDK provider receives a health fact. The FTC's Flo and Premom cases were about exactly this route, the one users can see and control least.

Why does HIPAA usually not apply to period tracking apps?

HIPAA's Privacy and Security Rules apply to "covered entities" and their "business associates". Covered entities are health plans, health care clearinghouses and health care providers who transmit health information electronically in connection with standard transactions such as billing. A business associate is a company that handles protected health information on a covered entity's behalf, such as a billing service or a cloud host under contract to a hospital.

A period app you download from an app store and use on your own is, in the normal case, neither. The definition of covered entity in 45 CFR 160.103 lists only a health plan, a health care clearinghouse and a health care provider who transmits health information electronically in a covered transaction. The app maker is not your doctor, is not billing your insurer, and is not acting for a hospital, so what you enter is not "protected health information" under HIPAA, even though it is health information in every everyday sense.

There are exceptions. If your clinic or health plan gives you an app and the app maker works for that clinic under a business associate agreement, HIPAA can apply to that app's handling of your data. Some fertility clinics and employer benefit programs work this way. The test is who the app works for, not what kind of data it holds. For a deeper walk through that test from the developer's side, see our post on whether HIPAA applies to your health app or the FTC rule does.

Which laws do apply to period and fertility app data?

FTC Act Section 5

Section 5 of the Federal Trade Commission Act prohibits unfair or deceptive acts or practices in commerce. If an app's privacy policy or onboarding screens say one thing and the app does another, the FTC can treat that as deceptive. The Flo case was brought under Section 5.

The FTC Health Breach Notification Rule, as amended in 2024

The Health Breach Notification Rule (16 CFR Part 318) applies to vendors of personal health records and related entities that are not covered by HIPAA. The FTC announced amendments on 26 April 2024 by a 3 to 2 vote. Three changes matter most for cycle apps:

• Apps are named. The rule now defines "health care services or supplies" to include any online service "such as a website, mobile application, or internet-connected device" that provides mechanisms to track, among other things, "fertility, sexual health", symptoms, bodily functions and vital signs.
• Disclosure counts as a breach. The current text says a breach of security includes an unauthorized acquisition of unsecured health information "that occurs as a result of a data breach or an unauthorized disclosure". Sharing data with an advertising platform without the user's authorization can trigger the notice duty even if no attacker was involved.
• Notices must name recipients. Notices to consumers must identify the third parties that acquired the information (or describe them if naming them would itself create risk), must go out without unreasonable delay and within 60 calendar days of discovery, and for breaches affecting 500 or more people the FTC must be notified at the same time as consumers. Email notice is allowed more broadly.

The rule's practical meaning for developers who embed analytics kits is covered in our post on health app analytics SDKs and the FTC breach rule.

Washington My Health My Data Act

Washington's My Health My Data Act (chapter 19.373 RCW) passed the legislature on 17 April 2023 and was signed on 27 April 2023, according to the Washington Attorney General. The Attorney General describes it as the first privacy focused law in the country to protect personal health data that falls outside HIPAA. Key points from the statute's text:

• Broad definition. "Consumer health data" includes "reproductive or sexual health information", bodily functions and symptoms, precise location that could indicate an attempt to get health care, and data derived or inferred from non health data.
• Consent to collect, separate consent to share. A regulated entity may not collect consumer health data except with consent for a specified purpose or as necessary to provide the product the consumer asked for. Sharing needs consent "separate and distinct" from the consent to collect, unless sharing is necessary to provide the requested product.
• Authorization to sell. Selling consumer health data requires a valid authorization signed by the consumer.
• Rights. Consumers can confirm whether their data is collected, shared or sold, get a list of all third parties and affiliates it was shared with or sold to, withdraw consent, and have it deleted, including from archives and backups, with the deletion request passed on to processors and third parties.
• Geofence ban. It is unlawful for any person to place a geofence around an entity that provides in person health care services to identify or track people seeking care, collect their health data, or send them health related ads or messages. The statute defines a geofence as a virtual boundary of 2,000 feet or less.
• Enforcement. A violation is a per se violation of Washington's Consumer Protection Act, enforced by the Attorney General and through private lawsuits.

The Attorney General's FAQ gives the effective dates: the geofence section applied to all persons from 23 July 2023; regulated entities that are not small businesses had to comply with the core sections from 31 March 2024; small businesses from 30 June 2024.

Other states have added consumer health data provisions of their own; check the text that applies where you live.

GDPR in the EU and the UK GDPR

Under the EU General Data Protection Regulation, "data concerning health" and "data concerning a natural person's sex life" are special categories of personal data. Article 9(1) prohibits processing them unless an exception in Article 9(2) applies; for a consumer app the usual exception is the user's explicit consent under Article 9(2)(a). Users have rights of access (Article 15), erasure (Article 17) and data portability (Article 20). Processing special category data at large scale is one of the cases where Article 35 requires a data protection impact assessment. The maximum administrative fine for infringing the basic principles and conditions for consent, including Article 9, is 20 million euros or 4 percent of worldwide annual turnover, whichever is higher. The UK keeps an equivalent regime in the UK GDPR.

The practical difference from US law is the default. In the EU, a cycle app needs a lawful basis and an Article 9 exception before it processes your cycle data at all. In most of the US, outside states like Washington, the main constraint is that the app must not mislead you about what it does.

What did the FTC's fertility app cases establish?

Flo Health (proposed January 2021, final June 2021)

On 13 January 2021 the FTC announced a proposed settlement with Flo Health, Inc., developer of the Flo Period and Ovulation Tracker, which the FTC said was used by more than 100 million consumers. The FTC alleged that, despite promising to keep users' health data private, the company disclosed health information from millions of users to third parties providing marketing and analytics services, which the release named as Facebook's analytics division, Google's analytics division, Google's Fabric service, AppsFlyer and Flurry. According to the FTC, the information was sent as "app events", including the fact of a user's pregnancy, the company did not limit how the third parties could use the data, and it did not stop until a news article revealed the practice in February 2019. The FTC also alleged violations of the EU-U.S. and Swiss-U.S. Privacy Shield frameworks.

The Commission voted 5 to 0 to accept the proposed consent agreement. Two commissioners wrote a joint statement arguing that the conduct also violated the Health Breach Notification Rule, which the complaint did not allege. On 22 June 2021 the FTC announced it had finalized the order by a 4 to 0 vote with one commissioner not participating. The order requires the company to obtain users' affirmative consent before sharing their health information with others, to get an independent review of its privacy practices, to notify affected users, to instruct third parties that received the data to destroy it, and not to misrepresent its data practices.

Premom (May 2023)

On 17 May 2023 the FTC announced a proposed order against Easy Healthcare Corporation, developer of the Premom ovulation and fertility app. The FTC alleged that the company disclosed users' sensitive health data, revealing details such as sexual and reproductive health and parental and pregnancy status, through software kits from AppsFlyer and Google, and shared data with two China based firms; the release named Umeng and Jiguang as kit providers that received data including precise geolocation, device data and Wi-Fi network identifiers. The FTC said the company "repeatedly and deceptively promised users in its privacy policies" that it would not share health information without consent, did not adequately encrypt data shared with third parties, and did not limit how they could use it.

The FTC brought the case as a violation of the Health Breach Notification Rule as well as Section 5. Under the proposed order the company would pay a 100,000 dollar civil penalty for the rule violation and a further 100,000 dollars in total to Connecticut, the District of Columbia and Oregon. It would be permanently barred from sharing personal health data with third parties for advertising, would need consent to share it for other purposes, would have to keep personal data only as long as necessary for the purpose collected, ask third parties to delete data they received, notify users and run security and privacy programs. The order was filed in federal court in the Northern District of Illinois and needed court approval to take effect.

What the cases established

Together with the GoodRx case cited in the FTC's 2024 rule announcement, the cases set out a clear pattern:

How can period tracking data be reached by third parties?

There are five routes. Each has a different fix.

1. Analytics, attribution and advertising kits

This is the route in the FTC cases. Each kit has its own servers and terms, and when a developer logs events like "pregnancy_mode_on", the kit receives them. Users cannot see this directly; privacy labels are supposed to disclose it.

2. Data brokers and the advertising ID

Your phone's advertising identifier lets many apps and brokers join records about the same device. On 29 August 2022 the FTC sued Kochava, a data broker, alleging it sold precise geolocation data from hundreds of millions of mobile devices that could be used to trace people to and from sensitive locations, including reproductive health clinics, places of worship, shelters and addiction recovery facilities. On 4 May 2026 the FTC announced a proposed stipulated order that would bar Kochava and its subsidiary from selling, licensing or sharing sensitive location data except with affirmative express consent and to provide a service the consumer requested; the order needs a federal judge's approval to take effect. A cycle app does not need to sell your period dates for location from the same phone to suggest a clinic visit. Resetting or deleting your advertising ID and denying location permission reduce this route; our post on mobile advertising IDs and how to reset them covers the steps in detail.

3. Legal process served on the app maker

Data a company holds and can read can be sought by subpoena, court order or warrant in civil or criminal cases. A company cannot produce data it does not have or cannot decrypt, which is the strongest argument for on device storage or end to end encrypted sync, and for deleting old data on a schedule.

4. Account takeover and breaches

A reused password lets anyone holding another site's leak into your cloud account, and a breach at the app maker exposes the whole cloud copy. A unique password, two step verification, or no account at all reduce this route.

5. People with access to your phone or accounts

Anyone who knows your passcode, shares a family cloud account or is linked through a "partner view" can see entries. For many users this is the most realistic risk; an app lock, a separate account and reviewing linked partners address it.

What changed in the United States after June 2022?

On 24 June 2022 the US Supreme Court decided Dobbs v. Jackson Women's Health Organization, holding that the Constitution does not confer a right to abortion and returning the question to the states. After the decision, attention turned to whether reproductive health data held by apps, brokers and health care organizations could be sought in investigations in states that restrict abortion. Three federal threads followed, with different outcomes.

• FTC enforcement. The Kochava suit in August 2022 and the Premom case in May 2023 put location and reproductive health data at the centre of FTC privacy work, and the 2024 Health Breach Notification Rule amendments wrote fertility and sexual health apps into the rule.
• HHS HIPAA rule. HHS published the "HIPAA Privacy Rule To Support Reproductive Health Care Privacy" in the Federal Register on 26 April 2024. It would have restricted covered entities from using or disclosing protected health information for investigations into lawful reproductive health care. On 18 June 2025 the US District Court for the Northern District of Texas entered a memorandum opinion and judgment in Purl v. Department of Health and Human Services (No. 2:24-cv-00228) granting summary judgment against the rule; published legal analyses describe the result as a nationwide vacatur of the reproductive health provisions, with notice of privacy practices changes for substance use disorder records left in place, and report that the appeal was dismissed in September 2025. In any case the rule only ever applied to HIPAA covered entities, not to consumer cycle apps.
• State law. Washington's law, and amendments in several other states, added consent, sale and geofence rules for consumer health data. These apply to apps directly, but they differ by state, and enforcement depends on state agencies and courts.

The result for app users in October 2026 is that the federal rules that bind cycle apps are mainly the FTC Act and the Health Breach Notification Rule, which govern honesty, consent to disclosure and breach notice. Neither limits what a court can compel a company to produce. Technical design, meaning what the company holds and whether it can read it, is what limits that.

Which app features reduce exposure?

Look for these features in an app's own documentation and settings. Each is described by what it does, not by brand.

• Local only mode. Entries never leave the device. You lose sync and own your backups, but there is no server copy to breach, share or subpoena.
• End to end encrypted sync. Data is encrypted on your device, with keys the company does not hold, before upload. A quick test: if the company can recover your data after you forget your password, it can usually read it.
• No account or anonymous mode. You can use the app without an email address or name. Some apps also strip IP addresses on the way in. For example, as retrieved on 25 October 2026, Flo's own Anonymous Mode page says the feature lets users track without name, email, IP address or other identifiers being linked to their health data and that it uses the Oblivious HTTP (OHTTP) protocol; the page states that "No one, not even Flo, can identify you in Anonymous Mode." That is the company's own description, not an independent audit.
• Analytics and personalised ads off by default, or a clear toggle inside the app, separate from the operating system's tracking controls.
• App lock, export in a standard format, account deletion with a stated timeline, and a published policy on legal demands.

How to read an Apple App Store privacy label

Apple requires developers to disclose, in App Store Connect, the app's privacy practices including those of third party partners whose code is integrated into the app; the information is required to submit new apps and updates. The label on the App Store groups the data types the app collects and states whether each is linked to your identity and whether it is used to track you across other companies' apps and websites.

What to check on a cycle app's label:

1. Look under Health and Fitness. Apple's definition of "Health" covers health and medical data including data from the HealthKit API and "any other user provided health or medical data". A cycle app that syncs your entries should list it.
2. Look for tracking. Apple defines tracking as linking data from the app with third party data for advertising or measurement, or sharing it with a data broker. A cycle app that lists any data used to track you deserves a closer look at its settings.
3. Check whether health data is linked to you. Data linked to an account or device identity is more exposed than data the developer says is not linked.

How to read Google Play's Data safety section

Google says the Data safety section gives developers a way to show users "if and how they collect, share, and protect user data, before users install an app". Developers fill it in themselves. Points to check:

1. Data types. "Health info" (medical records or symptoms) and "Fitness info" are separate data types. A cycle app should list Health info as collected, and say whether it is shared.
2. Collected versus shared. Shared means transferred to a third party. Look at the purpose listed for each.
3. Encrypted in transit and deletion. Developers declare both. Encryption in transit is a baseline, not end to end encryption.
4. Independent security review. Developers may optionally declare that the app was independently validated against a global security standard through the Mobile Application Security Assessment (MASA) programme, carried out by authorised labs. Google describes this as optional and paid for by developers.

A label is only as accurate as the developer's knowledge of every SDK in the app.

Comparison: four ways cycle data can be stored

On the platform row: Apple's iCloud data security overview says that even under the default standard data protection, Health data is end to end encrypted and Apple does not have the keys; Advanced Data Protection extends this to iCloud Backup and more. These categories change between releases, so check the current documentation.

Step by step: lock down your period tracking app

Work through these steps in order. They take about 20 minutes the first time.

Step 1: Decide what you need from the app

List the features you actually use. Every feature you skip is data you do not give; if you only need predictions, local only mode with no account is enough.

Step 2: Read the label and the policy before you enter more data

Check the privacy label or Data safety section as described above, then search the privacy policy for "advertising", "partners", "sell", "law enforcement" and "retention". In Washington, look for the separate consumer health data privacy policy the law requires.

Step 3: Review app permissions on iPhone

• Settings, then Privacy and Security, then Location Services. Find the app and set it to Never unless a feature you use needs location. Turn off Precise Location for apps that do not need it.
• Settings, then Privacy and Security, then Health. Review which health data types the app can read and write. Grant only what you use.
• Settings, then Privacy and Security, then Tracking. Turn off "Allow Apps to Request to Track", or deny the app individually.
• Settings, then Privacy and Security, then App Privacy Report. Turn it on for a week, then check which domains the app contacts. Many domains belonging to analytics or ad companies is a signal worth acting on.

Step 4: Review app permissions on Android

• Settings, then Apps, then the app, then Permissions. Deny Location, Contacts, Nearby devices and anything else a cycle feature does not need. Choose "Allow only while using the app" when a feature needs it.
• Settings, then Security and privacy (or Privacy), then Ads. Delete or reset the advertising ID. On recent Android versions, deleting it gives apps a string of zeros instead of an identifier.
• Health Connect. Review which apps can read and write cycle tracking and other data types.

If you are comfortable with developer tools, you can check an Android app's granted permissions from a computer with USB debugging enabled. Replace the package name with the app's own:

# List granted runtime permissions for one app (read only)
adb shell dumpsys package com.example.cycleapp | grep -E "permission|granted=true"

# Show app ops, including background location and other sensitive operations
adb shell appops get com.example.cycleapp

# Revoke a runtime permission the app does not need
adb shell pm revoke com.example.cycleapp android.permission.ACCESS_FINE_LOCATION

These commands change only permissions, not app data. Turn USB debugging off afterwards.

Step 5: Turn off analytics and personalised ads inside the app

Open the app's own privacy settings. Turn off product analytics, personalised content based on your data, personalised advertising and research participation you did not choose. If the app offers an anonymous or local only mode, consider switching to it, and read the app's own description of what happens to data already on its servers when you switch.

Step 6: Lock the app and secure the account

Turn on the app's passcode or biometric lock if it has one. If the app uses an account, give it a unique password from a password manager and turn on two step verification if offered. Check partner or family sharing features and remove anyone who should not be linked.

Step 7: Check your backups

A local only app is only as private as the backup that copies it. On iPhone, consider Advanced Data Protection for iCloud, which also makes you responsible for recovery; on Android, check what your device backup includes.

Step 8: Export, then delete what you no longer need

Before switching apps, export your history, then delete the account in the old app, not just the app from your phone. In the EU, cite GDPR Articles 15, 17 and 20; in Washington, RCW 19.373.040. Elsewhere, use the app's deletion process and keep the confirmation.

A simple request you can adapt:

Subject: Request to access and delete my consumer health data

I use [app name] with the account [email or account ID].
Please (1) confirm whether you collect, share or sell my health data,
(2) send me a copy of it and a list of every third party and affiliate
it was shared with or sold to, and (3) delete all of it, including from
backups, and instruct your processors and third parties to do the same.
Please confirm when this is complete.

Repeat steps 2 to 5 after a major app update or a new privacy policy email.

Common mistakes

• Trusting "we never sell your data" without reading the sharing terms. Selling and sharing are different words. An app can truthfully say it does not sell data while still sharing events with analytics and advertising partners. Look for what is shared, with whom, and for what purpose.
• Syncing to a shared family account. A family cloud account, shared tablet or shared Google or Apple account can expose cycle entries to everyone on it. Use your own account and device lock.
• Leaving old accounts open after switching apps. The data stays on the old company's servers until you delete the account. Export, delete and keep the confirmation.
• Treating uninstall as delete. Removing the app removes only the copy on your phone; the account and server data remain.
• Assuming HIPAA protects you. For a consumer app it usually does not.
• Granting every permission at setup, and leaving the advertising ID on. Location and contacts are rarely needed for predictions, and the advertising ID is the thread brokers use to join records.
• Treating a privacy label as a guarantee. It is a developer's declaration, useful for comparison, not verification.
• For developers: naming analytics events after health actions. An event called "pregnancy_logged" sent to a third party SDK is a disclosure of health data. Log neutral, minimal events, or none, and inventory every kit in the build.

FAQ

Do period tracking apps sell your data?

Some apps have shared health data with analytics and advertising companies; the FTC alleged this in its 2021 Flo and 2023 Premom cases. Whether a given app sells or shares data today is a question for its current privacy policy, privacy label and settings. Look for "share" as well as "sell".

Is my period tracker covered by HIPAA?

Usually not. HIPAA covers health plans, clearinghouses, health care providers who bill electronically and their business associates. A consumer app you download yourself is normally none of these. The FTC Act, the FTC Health Breach Notification Rule and state laws apply instead.

Can police get data from a period tracking app?

Law enforcement and civil litigants can seek data a company holds through subpoenas, court orders or warrants, under the rules of the relevant jurisdiction. A company cannot hand over what it does not store or cannot decrypt, so on device storage and end to end encrypted sync reduce what can be produced. The device itself can also be searched under a warrant.

Which period tracking apps are the most private?

We do not rank apps. Compare them on features: local only storage, end to end encrypted sync with keys only you hold, no account required, analytics off by default, no tracking in the privacy label, and a clear deletion process. Check each claim in the app's own current documentation.

Is the cycle tracking in Apple Health private?

Apple's iCloud data security overview, as retrieved on 25 October 2026, lists Health data among the categories that are end to end encrypted even with standard data protection, and says Apple does not have the keys. Data on the phone is protected by the device passcode. As with any app, someone who can unlock your phone can see it.

What does Washington's My Health My Data Act mean for cycle apps?

Regulated entities must get separate consent to collect and to share consumer health data, a signed authorization to sell it, publish a consumer health data privacy policy, honour access and deletion requests including the list of third parties, and may not geofence health care facilities to track or target people. Violations can be enforced by the Attorney General and through private lawsuits.

Is period tracking data special category data under GDPR?

Yes. Menstrual, fertility and sexual activity data is data concerning health and often data concerning sex life, both special categories under Article 9. Processing needs an Article 9(2) exception, usually explicit consent for a consumer app.

Should I stop using a period tracker?

That is a personal decision, and many people get real value from cycle tracking. The steps above keep the benefit while reducing who can see the data.

Where Safeguard fits

Safeguard does not review apps for consumers, audit privacy labels or give legal advice. Its fit with this topic is on the builder's side and it is indirect. A cycle app is an ordinary software project assembled from open source libraries and third party SDKs for analytics, crash reporting, attribution and messaging, and the FTC cases show that what those kits receive is a privacy question as much as a technical one. Safeguard can build a software bill of materials for an app's repositories and container images, so a team has an accurate list of every component and SDK version in each build, match those components against vulnerability databases, show which projects carry a given component version, and open fix pull requests when a fixed version exists. That inventory is a starting point for mapping data flows. It does not tell you what data a kit sends; that still takes code review and network testing.

A health app that ships an outdated networking or encryption library puts the same sensitive records at risk as a careless analytics event, and mobile apps pull in hundreds of transitive dependencies. Keeping those components current, and knowing quickly which builds carry a vulnerable version, is part of protecting the people who trust the app with their cycle data.

Fix it without waiting for upstream

Whatever the vulnerability, most of the risk sits in two gaps. The first is the time between a fix being published and that fix actually running in your production builds. The second, and worse, is the time before any fix exists at all, while a maintainer works out a patch and a release schedule. Waiting through both gaps is a habit, not a requirement. Safeguard gives teams three ways to close them.

1. Autonomous remediation: pull requests, not tickets

When a fixed version exists, Safeguard's Griffin models open a tested, policy gated pull request that moves the affected dependency to the safe version. You can run it on one repository or in bulk across every project that carries the vulnerable version. Remediation categories include dependencies, licenses, security posture and findings, and each one is set separately. Reachability analysis ranks the vulnerable code paths your application actually calls first, so the first pull requests you merge are the ones that matter most. Autonomous remediation ships switched off, with every category set to Manual, so your team decides how much runs on its own and what still needs a human approval.

2. Gold Open Source: the safe version in seconds, free

gold.safeguard.sh is free and needs no login. Search any CVE or package to see affected and fixed versions, CVSS, EPSS, CISA KEV status and a recommended safe version, or use the "Am I affected?" checker. The same data is available through a free read API, README status badges and RSS threat feeds.

3. Gold Registry: start from components that are already fixed

Gold Registry provides hardened, drop in replacements for upstream packages and container images. Every Gold artifact is held continuously to zero exploitable critical or high CVEs and a completed license check, with signed build provenance (signed with Safeguard's key and verifiable with cosign, SLSA Build Level 3 as the design target) and a public evidence page you can hand to an auditor. An artifact loses its Gold badge if it regresses. Teams can point their own package directory at the registry so hardened equivalents resolve without changing how developers install anything.

When upstream has no fix yet, or will not ship one, Safeguard first works to get the fix accepted upstream. If the issue is severe or upstream will not move, Safeguard builds a fork, fixes the vulnerability there and publishes a hardened Gold build, so you are not stuck on a maintainer's release schedule. You can also request a hardened, compatibility tested build of a specific package. Ask which packages it covers before you plan around it.

One honest limit: when the vulnerable code lives in a vendor appliance, a hosted service or an operating system runtime you do not build yourself, the fix still has to come from that vendor or distribution. The steps above apply to the open source dependencies and container images you build and ship, which is where most teams carry the largest and least tracked share of their exposure.

See how Safeguard would help

The first demo is a real Safeguard CLI session: you ask the assistant to fix a lodash CVE, it reads the finding and advisory, asks before any command that changes something, edits package.json to lodash 4.17.21, runs npm install and npm test with approval, and pushes nothing. The same flow applies when a health app's web dashboard or backend carries an outdated library.

Click through it at your own pace, or open it full screen.

The second demo sets up the local runner on your own machine, approves it with a device code and scans from the terminal. It suits a team that wants a component inventory of an app's repositories as the first step of a data flow review, without sending source code anywhere.

Click through it at your own pace, or open it full screen.

The third demo connects Claude to the Safeguard MCP server with OAuth and chooses which tools Claude can use. A privacy or engineering lead could then ask which projects carry a given SDK version before a release.

Click through it at your own pace, or open it full screen.

To try it on your own projects, download Safeguard and follow the CLI documentation.

Quick check

Sources

• FTC: Developer of popular women's fertility tracking app settles FTC allegations (13 January 2021)
• FTC: FTC finalizes order with Flo Health (22 June 2021)
• FTC: Ovulation tracking app Premom will be barred from sharing health data for advertising (17 May 2023)
• FTC: FTC finalizes changes to the Health Breach Notification Rule (26 April 2024)
• eCFR: 16 CFR Part 318, Health Breach Notification Rule (current text)
• FTC: FTC sues Kochava for selling data that tracks people at reproductive health clinics (29 August 2022)
• FTC: FTC to ban Kochava and subsidiary from selling sensitive location data (4 May 2026)
• Washington State Legislature: chapter 19.373 RCW, Washington My Health My Data Act
• Washington Attorney General: Protecting Washingtonians' personal health data and privacy (FAQ)
• eCFR: 45 CFR 160.103, HIPAA definitions including covered entity
• US Supreme Court: Dobbs v. Jackson Women's Health Organization, No. 19-1392 (decided 24 June 2022)
• CourtListener: Purl v. HHS, No. 2:24-cv-00228 (N.D. Tex.) docket
• GDPR, Regulation (EU) 2016/679
• Apple Developer: App privacy details on the App Store
• Apple Support: iCloud data security overview
• Google Play Console Help: Provide information for Google Play's Data safety section
• Flo Health: Anonymous Mode (retrieved 25 October 2026)
• Shipp and Blasco, "How private is your period?: A systematic analysis of menstrual app privacy policies", PoPETs 2020(4)
• Alfawzan et al., "Privacy, Data Sharing, and Data Security Policies of Women's mHealth Apps: Scoping Review and Content Analysis", JMIR mHealth and uHealth 2022

Last reviewed: 25 October 2026. Health privacy laws, FTC orders, court rulings and app settings change; check the linked statutes, regulations, orders and the app's own current documentation before relying on them. This is not legal advice.