How is your period data being sold?

While some clients use a period or fertility app to track symptoms, this isn’t without concerns about how data is kept and used by the app providers.

“We only have to look at America to see how dangerous period data is […] in terms of what data people can collect on you, what data people have access to,” she said.

Abortion is restricted in 14 states which means seeking an abortion has become a criminal matter.

While data from fertility apps hasn’t been used to prosecute women for procuring an abortion in states where it’s a criminal offence, some reproduction rights activists believe they could in the future.

Some privacy policies – Flo, My Calendar, Pregnancy+, Baby+, What to Expect – note that it can share your data with a law enforcement agency if asked.

While the context of reproductive rights differs in Aotearoa, there are questions about how widely period app data is shared and with whom.

We look at the privacy policies of the most popular apps to see who they’re sharing your data with.

Logging intimate data

We ran a short survey on social media to see what information people were logging on fertility apps.

While most people used the apps to track when menstruation starts and ends, others also used it to track whether they used contraception, their mood, and pregnancy-related information. A small number also logged their sex drive or body changes during ovulation.

Elizabeth said some people use fertility apps to understand their bodies, rather than focusing specifically on fertility.

The clinic supports people facing various concerns about their menstrual health, such as painful periods and hormone imbalances. Commonly, they have inquiries about premenstrual syndrome symptoms (PMS).

“There’s a lot of social media conversations around hormone imbalance, which is great, but a lot of time it’s misguided or straight up misinformation.”

While PMS is linked to changing levels of oestrogen and progesterone, it’s not classed as a hormone imbalance. Yet seeing social media posts can be a catalyst for people to explore whether they have a hormone imbalance, leading them to turn to apps to track their symptoms.

Yet a closer look at the privacy policies can show how these apps capitalise on your health data.

How people come across the apps can show “how the internet works, how marketing works, how data is sold, and how much data we actually give away for free without even realising,” said Elizabeth.

Most app users don’t read the privacy policy

Eighty percent of respondents to our social media survey on fertility apps hadn’t read the privacy policy for the fertility app they use.

Who could blame them? One of the policies is nearly 10,000 words long and has a lot of technical information that would send most of us to sleep.

In other research some respondents thought information about their period would be uninteresting to anyone but themselves.

In her 2021 study, Associate Professor Bryndl Hohmann-Marriott at Otago University interviewed 25 people who use fertility apps. She found most hadn’t given much thought to their data and didn’t think anyone aside from themselves would be interested in it.

Most interviewees didn’t think the data could be used by marketers or for surveillance.

While a few people knew the apps could use their data for other means, they didn’t think they could change this. For some, the benefits of the app outweighed the risk of a privacy breach.

So, who could be using the data, and should you be worried about it?

Who are the period apps sharing your intimate data with?

Dr Katharine Kemp, an Associate Professor in the Faculty of Law and Justice at UNSW Sydney, analysed the privacy statements of popular fertility apps earlier this year and published the pros and cons in Choice – our Australian equivalent.

She found that some fertility apps that claimed to never sell your data are potentially misleading.

While an app may state it will never sell your data, the database or the entire app can be sold to companies with different businesses and different motivations.

The BabyCenter and What to Expect apps (both owned by parent company Everyday Health) use data brokers to supply them with extra information about you from third parties. It also sells “lead generation” services which means selling or renting its contact lists to other companies.

It also discloses some of your information to other companies who already have a record of you to “enhance their records about you.”

Your data is used for targeted ads

The report found BabyCenter and What to Expect also provide data so ads can be targeted to you in the app. It’s not the only one drawing in advertisers.

One of the most popular fertility apps, Flo Health, uses AppsFlyer to distribute your age, subscription status and advertising identifier to social media companies and Google to target ads to you.

Period Calendar uses Google Analytics to track your location, get information about your device, and personalise ads.

Other apps provide your “advertising identifier” to advertisers unless you disable the function on your phone: My Calendar, Period Tracker, and Pregnancy+ (gold membership).

Glow Fertility, Glow Nurture and Eve by Glow are all part of Glow Inc and have the same privacy terms. It enables companies that advertise on the app to track what you do on it to target advertising.

Your data could be kept for up to 7 years

Ovia will keep your data for seven years after you’ve stopped using it. The longer an app keeps your data, the more vulnerable you are to a data breach.

Yet, some apps – My Calendar, BabyCenter, and Glow – say they’re not responsible for any data breaches.

While Flo and Natural Cycles will keep your data for three years, it doesn’t delete your information. Instead, it will anonymise or de-identify it.

Your data could be used for research

Some apps may also use your data for research but don’t give you the option to opt out or are unclear about the ethical guidelines for the research.

While most of the apps studied by Dr Kemp claim data is anonymised or de-identified, she found the apps were too vague about how data was de-identified. In the case of Clue, data is pseudonymised and given a unique number.

Dr Kemp believes this approach still exposes users to their data being reidentified if someone managed to connect the fake name and number to the original data.

You could be asked to put in information not related to the app

Two apps – Ovia and What to Expect – ask for information not necessary for the app’s function, according to UNSW researchers.

Ovia asks about your finances, housing, education and safety. While What to Expect asks for details about your birth experience and your child’s birth date.

Should you stop using a fertility app?

Dr Kemp pointed to some positives with app use.

The BabyCenter and the Glow Inc apps include some privacy settings, though Dr Kemp said these settings were hard to find in the apps and don’t address all privacy issues.

What to Expect doesn’t include intimate data, such as when you have sex or information about your period, but can share sensitive information about which support groups you join.

However, she only named one app as preferred, but still not perfect: Natural Cycles. It got points for having a plain language privacy summary and trying to give clear information and choices about your data.

Dr Kemp advises using other apps in her analysis with caution: Clue, Flo Health, My Calendar, Period Calendar, Period Tracker Pregnancy+ and WomanLog.

While some people will still choose to use an app, Elizabeth from Hekate said there’s a gap between the data the app gathers and the knowledge to interpret it.

Elizabeth would like to see more education, starting at schools, so people are better informed about menstrual health.

She would also like to see an app developed by our health system so it can inform services.

“Why doesn’t the public sector prioritise and invest in an app that can inform health service planning, providing crucial data to meet this unmet need … there are very engaged communities affected by menstrual and hormonal conditions seeking reliable information, support and awareness that may be interested in co-creating this resource.”

Privacy reform needed for fertility apps

We asked the Office of the Privacy Commissioner (OPC) if it was concerned about the flaws in the privacy policies of fertility apps uncovered by Dr Kemp.

Privacy Commissioner Michael Webster said he is concerned about the practices highlighted by the research.

“These incidents really highlight the need for a broader conversation in New Zealand about whether our privacy legislation needs to be updated in order for it to stay fit-for-purpose in the digital era.

Privacy has been, and will continue to be, under threat and we need to continually evolve our legal protections to stay ahead of the curve.”

In the meantime, Webster reiterated that app developers should provide clear, plain English privacy policies, and users should be aware of how their data is being used.

We’d like to see more pressure placed on the app providers to give clear information about how they use and sell data. As well as limits on how long apps can keep data after a person has stopped using them.

How to reduce privacy risks when using fertility apps

Here are some steps recommended by Dr Kemp to reduce some privacy risks while using fertility apps:

• Don’t create an account via social media or use your social media login.
• When you open the app for the first time, don’t agree to tracking of your data.
• Check the privacy settings on your smartphone and delete the advertising ID.
• Don’t add data into the app that you don’t need.
• If the app allows, opt out of tracking and its ability to sell your data or use it for research.
• Be aware that every chat room you contribute to, every article you read and group you join on the app will likely be added to your profile.
• Delete the app when you stop using it.