A period tracker can remember the date you forgot. A telehealth appointment can be conveniently scheduled from any location between class and work. An online prescription can spare you a long drive or an uncomfortable waiting room. For young women trying to manage their health, these conveniences have real value.
But before we inform an app about a missed period, a medication, or a mental-health concern, we should be able to answer a basic question: Who else might receive that information?
Many of us associate medical information with HIPAA, the Health Insurance Portability and Accountability Act. Yet HIPAA’s protections depend partly on which organization holds the information. HIPAA covers health plans, healthcare clearinghouses, qualifying healthcare providers, and their business associates. An independent femtech or wellness app may fall outside that framework. Information entered into a period tracker can therefore receive different legal protections from the same information recorded in a physician’s chart.
This distinction is easy to miss when both services ask medical questions and promise privacy; however, a polished website or reassuring phrase in a lengthy privacy statement may not accurately depict where our information is going.
This is especially important for women who are turning to technology to track symptoms, access healthcare, or record menstrual cycles. According to the Centers for Disease Control and Prevention (CDC), 33.8% of women reported using telemedicine in 2022, compared with 26.3% of men. Those figures do not measure how much information anyone disclosed, but they do show that women are more likely to use this form of care.
Cycle-tracking apps add another dimension. Depending on the app, women may share intimate information regarding menstrual cycle symptoms, fertility, pregnancy, and sexual activity. Some apps also collect device or location information. Usually we share this information under the assumption that the data will remain private and will not not be shared with third parties.
Unfortunately, based on available evidence, the assumption that our health information will remain private may be incorrect. For example, the Federal Trade Commission (FTC) alleged that Flo shared sensitive health information with outside analytics providers despite promising privacy. A 2021 settlement required consent before sharing health information and an independent review of its privacy practices. In 2023, The Justice Department, acting on the FTC’s behalf, sued Easy Healthcare, alleging that its Premom fertility-tracking app shared users’ identifiable information, location data, and device identifiers with third parties despite privacy promises. The complaint alleged that these practices violated the FTC Act and that the company violated the Health Breach Notification Rule by failing to provide required notices of unauthorized health-data disclosures.
The concerns extend beyond femtech apps. According to an Associated Press report, regulators accused Hims & Hers of sharing sensitive health information with advertising platforms despite privacy promises. They also alleged misleading billing practices and obstacles to canceling subscriptions.
One important consideration is the cost that is often associated with the choice to not share personal information. Journalist Geoffrey Fowler outlines this cost in an article detailing his experience with Amazon One in 2023. After declining an authorization concerning his health information, Fowler found that treatment through a partner would cost substantially more. His experience illustrates a difficult question: How freely can someone choose privacy when the alternative is considerably more expensive or even completely unaffordable?
While most apps provide users with a privacy statement, a lengthy agreement offers little reassurance if it leaves the practical consequences unclear. Companies should clearly explain what information they need for care, what they want for other purposes, and which organizations will receive it. Permission for advertising should be presented separately from permission needed to deliver a service. Retention and deletion policies should be easy for the user to access and understand before he or she creates an account.
We should urge companies to be transparent and clear when it comes to what information will be shared with third parties. Additionally, it is prudent to find out whether it is possible to request that data be deleted at any point.
Ultimately, responsibility cannot rest on the patient reading the fine print while worried, sick, or pressed for time. Providers should help explain privacy risks, and companies should make their practices transparent, accessible, and understandable.
Young women should be able to use technology with confidence knowing that they have full control over their data and their health information will be kept private. When we share information about our bodies, we are placing trust in a company. The company should earn it.
*Sara Smith Colvin is a 2026 Young Women for America (YWA) Fellow.
