A class-action certification case currently underway in B.C. Supreme Court alleges an online app that tracks menstrual and ovulation cycles shared private health information of possibly millions of Canadian women with third parties.
A March 2022 amended notice of civil claim said defendant U.S.-based Flo Health Inc.’s AI-powered tool provides users with “menstruation and ovulation cycle predictions, personalized daily health insights, an ovulation calendar, a period tracker, a pregnancy guide and a ‘secure’ community of experts and peers.”
The company said it took all reasonable precautions to protect users’ information, including de-identifying it before sharing it with analytics companies.
The claim said women are asked to input information on dates and duration of menstrual cycles, timing and frequency of sexual intercourse, pregnancies, bodily functions, weight, temperature and self-assessments of mood and wellness.
Further, it said, Flo encouraged the representative plaintiff, Jamie Kah Cate Lam, and other class members to verify their identities including name, birthdate, gender, email and residence.
The claim said Flo’s privacy commitment said information would not be shared unless a user instructed the company to do so. It said it would not disclose information to Apps Flyer and Flurry. It further singled out Facebook, Google and Fabric, saying those third parties would only receive non-personally identifiable and other data.
Despite those assurances, the claim said, the company made unauthorized disclosure of identification to those companies “for targeted advertising and other commercial exploitation."
"The representations made by Flo in its privacy policies were false, deceptive, and misleading, violated the duty of honest performance of contract and constituted an unfair and unconscionable business practice,” the claim said.
The claim asserted the app has 150 million users worldwide.
The court documents state the U.S. Federal Trade Commission (FTC) has alleged Flo violated the European Union-U.S. Privacy Shield and Swiss-U.S. Privacy Shield frameworks, which protect personal data from being transferred to third parties.
Company response
In a March 24, 2022 response to the amended notice, the company denied many of the allegations.
“The data collected was not ‘health data,’” it said.
As for the FTC, the company response said there was a Jan. 13, 2021 order approving a settlement with Flo that contained no finding or admission of wrongdoing and imposed no fines or penalties.
“Every person who used the app during the proposed class period was required, as a condition of use, to explicitly and affirmatively consent to the terms of use and the privacy policy before they could even open the app,” the company response said.
And, it said, the company clearly explained it would share personal data with third parties.
Flo denied improperly requiring or encouraging users to enter personal information.
“App users willingly and voluntarily provided their personal information and benefited from using the app,” the response said, refuting claims it had violated provincial privacy laws.
“Flo did not owe a duty of care to the plaintiff or those class members who reside in British Columbia, Manitoba, Newfoundland and Labrador, or Saskatchewan,” the response said.
The lawsuit seeks damages for negligence, breach of contract, breach of privacy and for the torts of intrusion upon seclusion and breach of confidence. It further seeks special punitive and aggravated damages.
