Health app broke its privacy promises by disclosing intimate details about users

Health app broke its privacy promises by disclosing intimate details about users

• The FTC says users were willing to trust Flo Health with such intimate details because the company claimed to protect their information and keep it secret a representation repeated in multiple places and in multiple ways in the companys Privacy Policy.
• Elsewhere in its Privacy Policy, Flo Health mentioned Facebook, Google, and other marketing and analytics firms, but claimed those third parties would receive only non-personally identifiable information.
• Thats what Flo Health said, but according to the complaint, the companys practices were at odds with its promises.
• As far back as June 2016, the app included tools software development kits (SDKs) from numerous third-party marketing and analytics firms, including Facebook, Flurry, Fabric, AppsFlyer, and Google, that gathered app users sensitive health information.
• Specifically, those SDKs gathered what are called App Events records of users interactions with different features of the app.
• Typically, these App Events contain only innocuous data, like when an app was opened or closed.
• For example, if an app user entered pregnancy-related information, Flo Health disclosed App Events with the word pregnancy in the title to the analytics divisions of those third parties.
• According the news report, the Journal was able to intercept unencrypted identifying health information transmitted by the Flo App to Facebook.
• In addition, Flo Health must ask third parties to delete health information obtained from users of the app.
• Your privacy representations must line up with how your app operates behind the scenes and must stay in line over time.
• Despite that provision, Flo Health shared health data that consumers input into the app.