A period tracking app keeps reproductive health data in an account that falls outside the main United States health privacy law, and named apps have passed that data to analytics and advertising firms. One managed alias per app, kept live while the app remains in use, keeps the account apart from the address used for banking and work.
What a period tracking app records#
Cycle dates, symptoms, sexual activity, birth control and pregnancy status are the health detail a tracker records, next to an email address, a name, device identifiers and an IP address. The app turns that detail into predictions of the next period and the fertile window. Mozilla examined 25 reproductive health apps and wearable devices in 2022 and recorded the same combination, with email addresses, device IDs and advertising IDs held next to cycle length, date of last period, sexual activity and pregnancy due date. The Mozilla Foundation review carries the full findings.
On its own a cycle date reads as a calendar entry. Joined to an email address, a name and a device identifier, the same date becomes a record that identifies a person and states facts about that person's reproductive health. The companion guide on separate addresses for health and fitness apps covers the wider category.
HIPAA and personal health apps#
Covered entities under HIPAA are health plans, most health care providers and health care clearinghouses, plus their business associates. A tracker downloaded from an app store for personal use is generally none of those. HHS puts the position in plain terms in its guidance on personal phones: "The HIPAA Rules generally do not protect the privacy or security of your health information when it is accessed through or stored on your personal cell phones or tablets." The same guidance leaves unprotected data downloaded or entered into mobile apps for personal use, unless the app comes from a covered entity or its business associate. The HHS guidance carries the full statement.
Information collected by a device or app may be viewed by other entities, used to send specific ads, or sold to a data broker, HHS adds. The FTC Act and the FTC Health Breach Notification Rule cover the gap instead. A final rule effective 29 July 2024 extended the Rule to developers of health apps and counts an unauthorised disclosure as a breach of security. The Federal Register carries the amendment text.
Documented sharing of health data#
The record rests on three enforcement cases, each turning on the same pattern: health data reached analytics and advertising firms despite privacy promises.
On 17 September 2020 Glow settled with the California Attorney General, agreeing to pay a $250,000 civil penalty over alleged failures to protect users' personal and health information. Information was shared without authorisation through a partner-connect feature, and a password-change flaw allowed anyone to reset a user's password. Wyrick Robbins' account describes the case.
On 13 January 2021 the FTC announced a settlement with Flo Health, whose period and fertility tracking app was used by more than 100 million consumers. The complaint alleged that Flo promised users their health data would stay private, then sent health data from millions of users, including whether a user was pregnant, to five outside firms as "app events": Facebook's analytics division, Google's analytics division, Google's Fabric service, AppsFlyer and Flurry. The practice ended only after a February 2019 news article exposed it and hundreds of users complained. Under the settlement Flo must obtain user consent before sharing health information and undergo an independent privacy review. The FTC press release gives the full account.
The same pattern appeared at Premom two years later. On 17 May 2023 the FTC charged Easy Healthcare, the operator of Premom, with passing sensitive health data to AppsFlyer and Google through software development kits, and precise geolocation to two China-based analytics firms, Umeng and Jiguang. A $100,000 civil penalty, a permanent bar on sharing health data for advertising, and a further $100,000 to Connecticut, the District of Columbia and Oregon were in the proposed order. It was the FTC's second enforcement action under the Health Breach Notification Rule. The FTC press release has the details.
Mozilla's review of the category, published 17 August 2022, found the problem went beyond the three named apps. Of the 25 apps and devices reviewed, 18 received a Privacy Not Included warning, and eight failed to meet Mozilla's Minimum Security Standards. A class action, Frasco v. Flo Health, was filed in 2021, and a settlement of nearly $60 million was reported in September 2025. Flo denies liability and settled during the jury trial, so no verdict exists on its conduct; a jury did find Meta liable for violating the California Invasion of Privacy Act. Ifrah Law's account of the reported settlement describes it.
Law enforcement access after Dobbs#
Dobbs v. Jackson Women's Health Organization was decided by the US Supreme Court on 24 June 2022, overturning Roe v. Wade. Almost eight weeks later Mozilla published its review, raising the concern that app data could be used by authorities to determine whether users were pregnant or seeking abortion services.
Access in law is narrower than the concern. A legal analysis published by the Cincinnati Bar Association notes that no reported cases existed of law enforcement requesting period app data in an abortion prosecution, and that a request to a third party company needs only a subpoena, while a request to the individual directly needs a warrant. The Cincinnati Bar Association article carries the analysis.
An alias leaves that position untouched. A subpoena served on the app company reaches the account record, and the alias forms part of that record. Only the identifier changes: the company holds the alias rather than the address used for banking and work, so the account cannot be linked to those accounts by email alone. What an alias provides is isolation of one channel; it is not a barrier to legal process.
The email address in a tracking account#
The signup address also becomes the channel for the marketing mail that follows. When a tracker shares data with an analytics or advertising partner, mail arriving later on that address cannot be traced to its source unless the address belonged to one app only. A distinct alias per app makes the source visible in the address itself, the same attribution mechanism described in the guide to one alias per website. The guide on protecting email when booking medical care sets out the same separation method for a different channel.
At signup the email address becomes two things at once: the contact and recovery route for the account, and the key the app company and its analytics partners use to join the account to other records. One address shared across a tracker, a bank and a workplace account means a breach at any one of them hands the same identifier to whoever holds the file.
One alias per tracking app#
One alias goes to each tracker, created before signup and labelled with the app name. Mail on that alias belongs to that app alone, and any marketing mail arriving on it names its source. Closure of the alias comes only after the account itself has been closed or moved, once the app is no longer used.
While the app holds health history, its alias stays live. Closing the alias first breaks password resets and account recovery, so closure comes only after the account itself is closed.
Recovery through an alias works only while the alias stays in service and forwards to a controlled inbox, as set out in the guide on using an alias for account recovery.
A short-lived address does not fit an account holding health history, which needs an address that lasts as long as the account. A managed alias is a persistent forwarding address, not a throwaway inbox, as the guide on whether aliases are safe states.
A check on Have I Been Pwned identifies which address was exposed when an alias appears in breach data. The guide on checking whether an email was leaked walks through reading that result, and the guide on finding every account linked to an email address lists the accounts tied to the main address before any change is made.
App choice and data exposure#
The choice of app determines what data the app collects and where that data goes, while the address determines only the channel for account mail. Flo released Anonymous Mode on 14 September 2022, a setting under which users access the app without a name, email address or technical identifiers being associated with their health data. Cloudflare's Oblivious HTTP system sits behind the setting. Flo's own announcement states the trade-off: once Anonymous Mode is activated, data cannot be recovered if the device is lost, changed or stolen. Flo's announcement is the source.
Some apps keep data on the device rather than in a company cloud. Euki stores data locally on the user's device and was the only app to earn Mozilla's "Best Of" place in the 2022 review. With no server copy to breach, share or hand over, at the cost of sync and recovery if the device is lost. The FTC's consumer guidance on apps and tracking recommends reviewing app permissions and opting out of personalised ads.
Which third parties receive data, and what the company does on a legal request, is stated in the privacy policy before signup. The cases above show a policy can promise privacy and still be followed by sharing, so the policy is read alongside the enforcement record. No claim is made here about the current practice of any named app.
Limits of an email alias#
Nothing beyond the email channel is contained by an alias. Health data collection continues, the alias encrypts nothing, sharing under the app's policy continues, and an address already stored in a system is not removed. The company still holds the name, the cycle data and the usage history, and the account is not anonymous.
The address already given away is not fixed by the alias, and acceptance is not guaranteed: no verified count of alias acceptance at these apps was found.
AliasFleet and period tracking accounts#
Managed email aliases from AliasFleet forward to a verified destination inbox. A distinct alias is created for each tracker and given at signup. Account mail for that app arrives through the alias, and replies route back through it, so the destination address stays out of the app's records. The alias can be paused or closed when the app is no longer used, without changing the destination inbox. How email aliases actually work describes the mechanism: the alias is a forwarding address under the user's control, not a separate inbox.
10 active aliases, 1 verified destination inbox, 3 managed subdomains and 100 MB of monthly forwarding bandwidth are covered by the free tier, per the pricing page. AliasFleet holds no health data and makes the account no more anonymous. A permanent real address used only for financial accounts stays with the bank account, and a tracker keeps its own alias.
