Many health, period-tracking and mental health apps share sensitive data with advertisers and analytics companies, often contrary to their own privacy promises. Mozilla’s independent reviews flagged 18 of 25 reproductive health products in 2022 and 23 of 27 mental health apps. Since 2021, the US Federal Trade Commission has acted against Flo, GoodRx, BetterHelp and Premom for this kind of sharing. The more private options tend to store data on your device, collect less and avoid advertising SDKs. Some fitness wearables also scored well.
Why health app data is uniquely exposed
Most people assume health data is protected by medical privacy law. For most consumer apps, it isn’t. In the US, HIPAA covers doctors, insurers and their contractors, not the period tracker or meditation app you download yourself. That gap is why the FTC updated its Health Breach Notification Rule in April 2024, explicitly covering health apps and connected devices that fall outside HIPAA. Under the updated rule, sharing health data without permission counts as a breach that users must be told about (FTC, 2024).
The stakes rose after the US Supreme Court overturned Roe v. Wade in 2022. Mozilla timed its August 2022 review of reproductive health apps to that decision. It warned that the data these apps collect could be used to track or prosecute people seeking abortions (Mozilla, 2022).
The scorecard: apps, ratings and enforcement
| App or category | What happened with the data | Rating or enforcement | Year | Source |
|---|---|---|---|---|
| Flo (period tracker) | Shared users’ health data with marketing and analytics firms, including Facebook and Google, despite privacy promises | FTC order requiring consent and notice (no fine); class settlement of $56M with Google and Flo, tentatively approved; jury found Meta liable | 2021; 2025-2026 | FTC, 2021; Courthouse News, 2026 |
| Period trackers (10 reviewed) | Broad data collection and sharing; vague policies on law-enforcement requests | 8 of 10 got a warning; Natural Cycles and Euki did not; Euki rated “Best Of” | 2022 | The Register, 2022 |
| Pregnancy apps (10 reviewed) | Collected due dates, symptoms, appointments and identifiers | 10 of 10 got a warning | 2022 | The Register, 2022 |
| Fertility-tracking wearables (Garmin, Fitbit, Apple Watch, Oura, Whoop) | Collect cycle-related data | 0 of 5 got a warning | 2022 | The Register, 2022 |
| GoodRx (prescription discounts) | Shared prescription and health-condition data with Facebook, Google, Criteo, Branch and Twilio | $1.5M civil penalty; first case under the Health Breach Notification Rule | 2023 | FTC, 2023 |
| BetterHelp (online therapy) | Shared emails, IP addresses and health questionnaire answers with Facebook, Snapchat, Criteo and Pinterest for ads | $7.8M for consumer refunds; ban on sharing health data for ads | 2023 | FTC, 2023 |
| Premom (ovulation tracker) | Shared health data with AppsFlyer and Google, and data with China-based analytics firms Umeng and Jiguang | $100,000 federal penalty plus $100,000 to Connecticut, D.C. and Oregon | 2023 | FTC, 2023 |
| Mental health apps (27 reviewed) | Weak passwords, ad-driven sharing, questionnaires before privacy notices | 23 of 27 flagged in 2022; about 17 worse or still poor in 2023; Wysa and PTSD Coach rated “Best Of” | 2022-2023 | Mozilla, 2023 |
| Apoteket and Apohem (Swedish online pharmacies) | Meta Pixel sent data on purchases of medicines, self-tests and STI treatments to Meta | SEK 37M and SEK 8M fines under GDPR | 2024 | IMY, 2024 |
Period and pregnancy trackers
Mozilla reviewed 10 period trackers, 10 pregnancy apps and 5 wearables in 2022. Eighteen of the 25 received its *Privacy Not Included warning. Every pregnancy app was flagged. Among period trackers, only Natural Cycles and Euki avoided a warning, and Euki, which keeps data on the device, was the only “Best Of” pick (The Register, 2022). Mozilla’s researchers found that most apps were vague about how they would respond to law-enforcement requests for data.
In the Flo case, the FTC alleged that the app passed health information from millions of users to marketing and analytics firms, including Facebook and Google, after promising to keep it private. The 2021 order required Flo to get users’ consent before sharing health data and to tell users about past sharing. It did not include a fine (FTC, 2021).
Private lawsuits went further. In August 2025, a federal jury in San Francisco found that Meta violated the California Invasion of Privacy Act by recording sensitive data from Flo users through software built into the app (Courthouse News, 2025). Google and Flo settled for $48 million and $8 million. In April 2026, the judge gave tentative approval to that $56 million settlement for about 10 million users who entered data between November 2016 and February 2019 (Courthouse News, 2026).
Mental health and therapy apps
Mental health apps did even worse. Mozilla flagged 23 of 27 at launch in 2022. When it re-reviewed them in 2023, it found improvements at about eight apps, including Youper, Woebot and Moodfit. However, about 17 were worse or still poor, among them Headspace, BetterHelp and Talkspace (Mozilla, 2023). Mozilla called the chatbot Replika possibly the worst app it had ever reviewed. Wysa and PTSD Coach remained its “Best Of” picks.
In the FTC’s BetterHelp case, the company had promised not to share health information for advertising, yet it sent email addresses, IP addresses and intake-questionnaire answers to social media and ad platforms to find similar customers. It paid $7.8 million for refunds (FTC, 2023).
Data that leaks into the wider market can be resold. Researchers at Duke University contacted 37 data brokers in 2023, and 11 were willing to sell data about people’s mental health conditions. One quoted $275 for 5,000 aggregated records (Duke, 2023).
The legal picture in 2026
- No comprehensive US federal health privacy law covers consumer apps. The FTC enforces against deceptive or unauthorized sharing using its Health Breach Notification Rule and its consumer protection powers.
- For reproductive health, a 2024 HIPAA rule that limited disclosure of reproductive health records for investigations was struck down nationwide by a federal court in Texas on June 18, 2025 (Hunton, 2025). The rule applied only to HIPAA-covered providers in any case, not to consumer apps.
- Among US states, Washington’s My Health My Data Act took effect on March 31, 2024. It requires separate opt-in consent to collect and to share consumer health data, signed authorization to sell it and a ban on geofencing around health facilities. Consumers can also sue (Goodwin, 2024).
- In the EU, health data is a special category with stricter rules under the GDPR. Sweden’s regulator fined two online pharmacies after a Meta Pixel feature sent customers’ purchase data to Meta (IMY, 2024).
How to choose a more private health app
- Prefer local storage. Apps that keep data on your device, or offer an account-free mode, give advertisers and investigators less to request. Euki was Mozilla’s top pick for exactly this reason.
- Check what the app connects to. Look at the App Store privacy label or the Google Play Data safety section, and be careful with apps that list “tracking” or share health data with third parties.
- Skip social logins. Signing in with Facebook or Google links your health app to your advertising profile.
- Read the law-enforcement section of the privacy policy. Look for a commitment to require a warrant and to notify users.
- Limit permissions. Turn off location, contacts and ad tracking (iOS “Ask App Not to Track” and Android’s ad ID controls).
- Delete what you don’t need. Use in-app deletion, or a data-deletion request under GDPR, CCPA or Washington’s law. Delete your account, not just the app.
- Consider a dedicated device or a paper journal for highly sensitive tracking if you are worried about legal exposure.
Methodology
The scorecard draws on Mozilla Foundation’s *Privacy Not Included reviews (2022 reproductive health review and 2023 mental health update), FTC press releases on final or proposed orders, court reporting by Courthouse News on the Flo class action, the Swedish data protection authority’s decision announcement, Duke University’s data broker study, and legal analyses of the HIPAA ruling and Washington’s law. Mozilla moved Privacy Not Included to a new format in August 2026 and points readers to the Internet Archive for older reviews; the Mozilla citations refer to the archived versions of its articles. The per-category counts from the 2022 review come from The Register’s report of the launch.
Mozilla’s ratings reflect the apps’ privacy policies and practices when they were reviewed, from 2022 to 2023, and apps may have improved or gotten worse since then. Enforcement covers only what regulators found: an app that has not faced an FTC action is not necessarily private. Claims in FTC complaints that end in a settlement order are allegations, and settling companies typically do not admit wrongdoing. Most enforcement examples are from the US; GDPR enforcement involving consumer health apps specifically is sparse in public records.
Some widely quoted percentages, such as a “59%” share of mental health apps with warnings in 2023, are excluded because they could not be confirmed on Mozilla’s own pages.