privacy-in-practice
Sleep Cycle Data Privacy Checklist
A privacy checklist for sleep and cycle notes, including period timing, PMS, sleep diaries, screenshots, exports, backups, portals, shared devices, and company-held copies.
Sleep notes can look harmless.
They can still show period dates, PMS symptoms, mood, pain, sex notes, pregnancy worries, medicine names, work trouble, and safety concerns.
This checklist helps you keep the parts you need and think before you share. It is not legal advice. It does not promise privacy.
1. Name the reason for tracking
Write the care or personal question first.
Question Your note Why am I tracking sleep? Do I need cycle timing? Who may need to see this? What can stay private? What format would be enough?
If a detail does not help the question, you may not need to store it.
2. Choose what to keep
Mark where each detail belongs.
Detail Keep in app Keep on paper Keep in portal Skip for now Period start date Cycle day Bedtime and wake time Wake ups Sleep quality Daytime sleepiness Mood notes Pain or cramps PMS notes Pregnancy question Medicine names Alcohol or caffeine notes Screenshots Full app export
NHLBI's sleep diary includes sleep quality, sleep amount, medicine, alcohol, caffeine, and daytime sleepiness. You can still choose which fields fit your visit.
3. Check where copies may live
Sleep and cycle data can spread through ordinary actions.
Copy place What to check App account Does the app store data on company servers? Cloud sync Is sync required, optional, or off? Phone backup Are app data or screenshots backed up? Photo library Did screenshots save there? Downloads folder Did exports or PDFs save there? Email or texts Did you send the file to anyone? Clinic portal Did you upload notes or send a message? Shared device Can another person open the app or files? Watch or car Can alerts show sleep or period text?
Deleting an app may not delete exports, screenshots, emails, portal records, backups, or other copies.
4. Know what on device can and cannot do
On device storage can reduce some company held copies. That can matter.
It does not remove every risk.
Other copies can still come from:
Screenshots. App exports. Phone backups. Shared phones. Shared tablets. Shared Apple ID or Google account. Email attachments. Text messages. Downloads folders. Clinic portals. Printed pages.
If a company holds a copy, that copy may be handled under its policies. It may also be affected by legal process, breach rules, account deletion rules, and retention rules.
5. Check company promises with care
The FTC's 2021 Flo case involved allegations that a period and fertility app shared health information with outside analytics providers after privacy promises.
Use that as a reminder to check data flows, not only friendly wording.
Ask:
Does the app require an account? Does it sync to a server? Does it name analytics or ad partners? Does it explain health data sharing? Does it say how exports work? Does it say how deletion works? Does it collect device IDs? Does it collect location? Does it send crash or analytics events? Does it explain breach notices?
A privacy policy can help you decide. It is not a guarantee that no copy exists.
6. Check HIPAA and breach limits
HIPAA does not cover every health app.
HHS says mobile health app developers should look at app function, collected data, and services to see which federal laws may apply.
The FTC Health Breach Notification Rule can apply to some vendors of personal health records, PHR related entities, and service providers after certain breaches. It does not mean every app has the same rules in every case.
If you need legal advice, ask a qualified lawyer. This checklist is only a planning tool.
7. Share less when less is enough
Before you send sleep cycle data, ask:
Who needs it? What question are they trying to answer? Do they need the full export? Would a one page summary work? Can I remove names or private notes? Can I remove sex or pregnancy notes? Can I remove work or conflict details? Will this be saved in a portal? Do I want a copy of what I sent?
Use optional language when you share.
8. Make a small visit summary
A short summary may answer the care question without a full file.
text Sleep and cycle summary
Date range:
Period start dates:
Sleep got worse:
Sleep got better:
Main PMS or pain notes:
Daytime impact:
What I did not include:
Questions:
Use the period sleep visit prep worksheet if you want a fuller visit page.
9. Floriva note plan
Floriva can help you keep short cycle notes on your device.
Example:
That can reduce some company held copies. It cannot control screenshots, exports, backups, shared devices, portal records, or what you choose to send.
For broader privacy choices, read the period tracker data minimization guide. If your sleep notes are part of PMS body tracking, use the PMS body data privacy checklist. For clinical context, read the period sleep disruption guide.