alternatives

Published by Floriva · Updated 2026-04-28 · How Floriva checks its guides

What Data Does Flo Have on You, and How to Get It Deleted

A plain-language breakdown of what Flo collects, stores, and has shared, and the exact steps to request deletion of your Flo data under CCPA and GDPR.

If you have ever used Flo, the company holds your reproductive health data whether or not the app is still on your phone. This guide covers what categories of data Flo collects, what was shared and with whom (per the FTC and the 2025 settlement), and the exact steps to request deletion under CCPA and GDPR.

What Flo has collected about you

Flo collects data in several categories. Here's what the app records and what the FTC documented was shared:

Reproductive health data

• Period start and end dates

• Flow intensity (spotting, light, medium, heavy)

• Cycle length and regularity patterns

• Ovulation window predictions and any ovulation symptoms you logged

Symptom and health logs

• Physical symptoms: cramping, bloating, breast tenderness, acne, headaches, and others from Flo's symptom list

• Energy level and mood entries

• Sleep quality logs

• Weight entries (if you used the logging feature)

• Exercise entries

Reproductive status data

• Pregnancy mode (if you switched to it)

• Trying to conceive status

• Birth control method (if logged)

• Sexual activity logs

Account and device data

• Email address

• Device type and operating system

• IP address (which can approximate location)

• App usage patterns and feature interactions

What the FTC documented was shared The FTC's 2021 enforcement action found that Flo shared health data, specifically data about pregnancy, menstrual cycles, and related health conditions, with Facebook and Google through embedded SDKs, and with Flurry (an analytics company). This sharing occurred even after users had set their phones to opt out of ad tracking. The $59.5M class action settlement reached in September 2025 covered these claims. The FTC case is documented at ftc.gov/cases-proceedings/192-3133-flo-health-inc.

For a detailed breakdown of the enforcement action and settlement, see our Flo lawsuit and settlement guide.

Why period tracker data is not protected by HIPAA

A common misconception is that health data in apps is covered by HIPAA. It is not. HIPAA applies to covered entities, hospitals, insurance companies, healthcare providers, and their business associates. A consumer period tracking app that you downloaded from the App Store is not a HIPAA-covered entity.

This means Flo's privacy practices were governed by FTC regulations and their own privacy policy, not HIPAA. The FTC action addressed deceptive trade practices, not HIPAA violations. The data Flo collected was not protected by any healthcare-specific law.

See our period tracker HIPAA explainer for the full breakdown.

How to request a copy of your Flo data

Before you delete, get your data.

In-app data request: Open Flo, tap the profile icon (top-left), then Settings, then Privacy, then Request My Data. Flo emails a download link within a few days. The export arrives as a ZIP file containing your cycle log, symptom entries, and account information.

CCPA data access request (California): Email [email protected] with the subject "CCPA Data Access Request." State your Flo account email and invoke your right to know under CCPA Section 1798.100. Flo must provide a copy of all personal data they hold on you within 45 days.

GDPR data subject access request (EU/UK): Email [email protected] with the subject "GDPR Data Subject Access Request." Invoke your rights under GDPR Article 15. Flo has 30 days to respond.

How to request deletion of your Flo data

Deletion requires two separate actions. Both matter.

Step 1: Delete your account in-app

This handles your active data, the account record and its associated logs in Flo's primary database.

Open Flo, go to Settings, then Account, then Delete Account. Flo sends a confirmation email, click the link. The deletion typically processes within minutes to a few hours.

Important: uninstalling the app does not delete the account. The account persists on Flo's servers until you complete this in-app deletion.

Step 2: Submit a formal deletion request by email

This handles backup copies, which in-app deletion typically does not reach.

Email [email protected] with the subject "CCPA/GDPR Data Deletion Request."

In the body, include:

• Your Flo account email address

• Explicit invocation of CCPA Section 1798.105 (if you are a California resident) or GDPR Article 17 (if you are in the EU or UK)

• A request for complete deletion of all personal data including any copies held in backup systems, derived datasets, or analytics databases

• A request for written confirmation of the deletion

Flo has 45 days to respond under CCPA and 30 days under GDPR. Keep a copy of this email and any response you receive. This is the legal mechanism that compels purging of backup copies, without it, deleted account data may persist in Flo's backup systems.

How to verify the deletion worked

Wait 24 hours after completing the in-app deletion. Then try to log in at flo.health with your old credentials. A successfully deleted account should return an "invalid credentials" or "account not found" error.

If you can still log in, the deletion did not process. Return to Settings, Account, Delete Account, and go through the confirmation sequence again. If the problem persists after a second attempt, reply to your deletion request email or contact Flo support and reference the date you initiated the deletion.

What about data Flo already shared

The data Flo shared with Facebook, Google, and Flurry before the FTC enforcement action is outside Flo's control now. Deleting your Flo account does not recall data that third parties already received.

The FTC settlement order prohibits Flo from sharing certain data going forward and required changes to Flo's data practices. It does not require third parties who received historical data to delete it.

This is one of the reasons the switch to device-first tracking matters beyond just deleting Flo: the historical exposure cannot be undone, but future data from a tracker with no readable central cycle database cannot be shared by the same mechanism.

After the deletion: switching to an on-device tracker

Once you have your Flo data export and have completed the deletion steps, entering your history into a new on-device tracker takes about 10 minutes.

Open the Flo export ZIP and find the cycle log file. Identify your last 3-6 cycle start dates. Enter them during setup of your new tracker.

Floriva keeps core cycle data on your phone. No account is needed for core tracking, and Floriva has no readable central cycle database. That is the architectural difference from Flo.

For a full guide to making the switch, see our Flo switching guide and our privacy audit checklist for evaluating any tracker you consider going forward.