Health information sharing legal dispute resolved between Flo Health and class action group
In a significant development, Flo Health, the creator of the popular menstrual cycle and fertility tracking app Flo, has agreed to settle a class action lawsuit over allegations that it unlawfully shared sensitive health data from its users with third parties. The plaintiffs sought $1,000 in statutory damages for each of the 13 million users affected, which could have amounted to $13 billion in total.
The lawsuit, filed in 2021 with the US District Court for the Northern District of California, accused Flo Health of violating the Stored Communications Act, the California Confidentiality of Medical Information Act, and the US Civil Code. Google and Meta were named as defendants, alongside advertising analytics company AppsFlyer and now defunct data analytics company Flurry.
Investigation by the FTC
The allegations against Flo Health over the past few years are likely to derail its leading position at the top of the women's health app market. The US Federal Trade Commission (FTC) launched a probe into Flo Health's data privacy and disclosure practices and charged the company with making fraudulent misrepresentations in breach of users' privacy rights. Flo Health reached a settlement with the FTC in 2021.
The Settlement
The settlement agreement does not include any admission of wrongdoing by Flo Health. The company maintained throughout that the claims lacked merit, and as the case progressed, the lack of evidence to support these allegations became increasingly clear in court.
The settlement awaits final court approval as of July 31, 2025. The actual final settlement amount and specific terms have not been disclosed. Flo Health stated that it was "pleased" at the resolution of the matter and "that the facts came out at the trial".
Class Counsel and Legal Representation
Carol Villegas, Michael Canty, Jake Bissell-Linsk, Danielle Izzo and Gloria Medina of Labaton Keller Sucharow serve as co-lead class counsel, alongside Christian Levis and Amanda Fiorilla of Lowey Dannenberg, and Diana Zinser and Jeffrey Kodroff of Spector Roseman & Kodroff. Brenda Sharton and Benjamin Sadun of Dechert represent Flo Health in the Frasco v Flo Health Inc case.
Lawyers from Adamski Moroski Marren Cumberland & Green, the Law Offices of Ronald A. Marron, Siri Glimstad and Harris Legal Advisors are also acting as counsel for separate individual claimants.
Background
The complaint drew on a 2019 Wall Street Journal report that exposed Flo Health's years-long intimate health-data-sharing practices. The lawsuit attempted to argue that the app should be classified as a health application and that the company should therefore be found to have infringed the California Confidentiality of Medical Information Act.
The lawsuit alleged that Flo Health shared users' private health information with third parties like Meta and Google, among others, without explicit consent. This practice, if true, would be a breach of users' privacy rights and a violation of several federal and state laws.
Implications
In 2022, the state passed Assembly Bill 2089, extending protections under the Act to expressly include mental health data under its definition of medical information, and to classify any business offering a mental health digital service to a consumer as a health care provider subject to the obligations of the Act. This development underscores the growing importance of data privacy and the need for companies to handle sensitive user information with care and transparency.
[1] [Source 1] [2] [Source 2] [3] [Source 3] [4] [Source 4] [5] [Source 5]
- The lawsuit against Flo Health, initially filed in 2021, accused not only Flo Health but also Google, Meta, AppsFlyer, and Flurry of violating privacy rights.
- The settlement awaiting final court approval in 2025 does not include an admission of wrongdoing by Flo Health, as the company maintained throughout that the claims were without merit.
- In response to concerns about data privacy and disclosure practices, the US Federal Trade Commission (FTC) launched an investigation into Flo Health in recent years.
- Senate Bill 2089, passed in 2022, extends protections under the California Confidentiality of Medical Information Act to include mental health data and classifies any business offering a mental health digital service as a health care provider subject to the Act's obligations.
- The Wall Street Journal reported in 2019 on Flo Health's years-long practices of sharing intimate health data, bringing attention to the need for companies to handle sensitive user information with care and transparency.
[Insert Sources Here]
