In a new post on the Covington Digital Health blog, our colleagues discuss a recent settlement between the Federal Trade Commission (“FTC”) and Flo Health, Inc. (“Flo”), the developer of a popular menstrual cycle and fertility-tracking application. The settlement resolves allegations that Flo shared app users’ health information with outside third parties after promising that such information would be kept private. The proposed settlement requires Flo, among other things, to obtain review by an “independent third-party professional” of its privacy practices, obtain users’ consent before sharing their health information, alert users whose data was disclosed, and require third parties that previously received that data to destroy it. This settlement marks the first instance in which the FTC has required a company to provide users with a notice of the privacy action brought by the FTC. Specifically, in its proposed settlement, the FTC requires Flo to “clearly and conspicuously” share with users a pre-written notice that explains what information Flo disclosed to third parties and describes the settlement with the FTC. According to the FTC’s announcement, the agency is “looking closely at whether developers of health apps are keeping their promises and handling sensitive health information responsibly.”
