Data Report Card · Flo
Flo Data Report Card
Cycle tracking · Flo Health UK Limited (London)
§ Enforcement action
Data
Practices
Practices
2Access1Portability1Friction2Deletion1Sells1Trains AI
=
C
§
6/12
Agent
Readiness
Readiness
2Access
1Portability
0API access
=
C
3/6
Agent Readiness is a derived signal — a synthesis of two existing cells (Access, Portability) plus one sourced factor (API access), not an independently measured grade. API access scale: Best (2) consumer-grantable API · Moderate (1) partial / encumbered · Restrictive (0) manual export only. What is Agent Readiness?
§ This grade reflects a 2-point deduction (severity 1, reduced after 5 years with no further verified action) for a verified regulatory action: 8/12 on data practices − 2 = 6/12 → C. The record is below.
Reviewed Jun 2026 · some cells re-verified Aug 2026 · policies are checked weekly for changes · stated — every cell is read from Flo's published policy; none has been tested (run by us) yet.
2Accessstated
A clearly documented request path with stated scope, format and window: “you can request access to all your personal data and to receive a copy of it, including in a structured and portable form (we use .json files)”, via chatbot or support@flo.health, handled “within one month”; iOS Premium members get a partial in-app download.
Flo Privacy Policy — your rights · accessed Aug 2026 ↗1Portabilitystated
The format is stated (.json) but the export is request-mediated for everyone except iOS Premium members, whose in-app report covers only “some of your personal data” — and Anonymous Mode removes assisted export entirely. Request-only for the general user.
Flo Privacy Policy / Anonymous Mode FAQ · accessed Aug 2026 ↗1Frictionstated
Deletion and some changes are self-serve in settings; other rights run via chatbot or email inside a stated one-month window with an appeal path. GPC: “we will honor opt-out preference signals … at the browser level”, and a “Your Privacy Choices” link exists — but the website “is not programmed to recognize Do Not Track signals”, and unfounded requests may be refused or charged.
Flo — US State Privacy Notice / Cookie Policy · accessed Aug 2026 ↗2Deletionstated
Self-serve in-app deletion with stated timelines and mechanics: identifiers are “immediately unlinked”, processing completes within one month, backups purge “up to 90 days”, and inactive accounts auto-delete after three years — the stated-purge-timeline shape.
Flo Privacy Policy — deletion & retention · accessed Aug 2026 ↗1Sells / sharesstated
“We will never sell your data” and health data never goes to ad platforms — but the US notice concedes that non-health disclosures “may constitute a ‘sale,’ ‘sharing,’ or ‘targeted advertising’ as those terms are broadly defined”, device identifiers flow to AppsFlyer, Firebase and TikTok Ad Manager (and AppsFlyer’s partners include Meta, Pinterest and Google Ads), and AppsFlyer’s functional processing “cannot be opted out”. Opt-out exists via Your Privacy Choices and GPC.
Flo — US State Privacy Notice / marketing analytics · accessed Aug 2026 ↗1Trains AIstated
Machine-learning cycle predictions run on your health data under consent (named processor: Tecton, Inc.), withdrawable only by contacting Flo or deleting the account; no generative-AI training clause and no training-specific opt-out exists.
Flo Privacy Policy — how we use your data / processors · accessed Aug 2026 ↗§Enforcement action — deducts 2 points (severity 1, reduced after 5 years with no further verified action); data practices without the penalty scored C (8/12)verified
The US FTC settled with Flo Health in 2021 (consent order, behavioral remedies, no monetary penalty) over sharing users' health information — including the fact of a user's pregnancy — with Facebook's and Google's analytics divisions, AppsFlyer and Flurry, after promising such information would be kept private. The order requires affirmative consent before sharing health information, an independent privacy review, and destruction of the shared data by recipients.
US Federal Trade Commission · Jan 2021, final Jun 2021 ↗0API access — feeds Agent Readiness, not the /12stated
No consumer OAuth API exists — integrations are device-side imports from Apple HealthKit and Google Health Connect into Flo only; the programmatic self-data path is absent and export runs through the rights request.
Flo Privacy Policy — integrations · accessed Aug 2026 ↗Graded 2026-08-31 against the Flo Privacy Policy (effective Aug 31, 2026), the Supplemental US State Privacy Notice (Nov 13, 2025) and Flo's privacy FAQ pages. Consumer surface = the Flo app and flo.health, operated by Flo Health UK Limited (London) with Flo Health, Inc. as the US subsidiary. Anonymous Mode is the standout stated design: “access to the Flo app without sharing any information that identifies you … if Flo ever receives an official request to identify an Anonymous Mode user by name or email, it won't be possible to satisfy that request” — though it also disables assisted export and deletion requests. Health data is firewalled from ad partners; device identifiers flow to AppsFlyer, Firebase and TikTok Ad Manager with consent, and AppsFlyer's separate functional processing cannot be opted out. The enforcement lane carries the FTC's 2021 consent order, which deducts separately and scores no cell. All cells stated, not tested.
Events
Breaches, policy changes, and export-format changes we’ve recorded at Flo — other parties’ actions, alongside the enforcement record above. An event never changes a grade by itself. All events →
No events on record for Flo.
Grade history
Every change to this company’s grade since it was first published, and why. All grade changes →
No changes since this grade was first published in Jun 2026.
How to request your data from Flo
- Go to https://flo.health/privacy-policy — Flo's data-request entry point.
- In-app: Settings for account deletion; rights via website chatbot or support@flo.health (.json copy); dpo@flo.health.
- Expected wait: stated one-month handling; backup purge up to 90 days — Flo's stated turnaround (we haven't independently timed a request yet).
- No self-serve option, or want a formal request? Contact Flo — Support / DPO: mailto:support@flo.health.
These steps reflect Flo's documented process as of Jun 2026. The wait time is the company's stated figure, not yet independently measured by us.