Legal Rights & Agreement Rules · Restriction or exception
US telehealth uses partner privacy notices rather than this policy’s processing rules
Flo is not a medical provider and does not deliver medical care. For US users it facilitates access to telehealth partners. If you choose those services, Flo may act as the partner’s service provider, collecting and sharing information such as ZIP code and insurance provider to facilitate care. Some information may be protected health information under HIPAA. Flo says it processes on the partner’s behalf under applicable law and contracts, including a HIPAA business associate agreement where required. This policy’s described processing activities do not apply to personal information used with telehealth services; the relevant partner’s privacy notice governs that context.
Supporting quotations
Flo is not a medical provider and does not deliver medical care. If you are located in the United States, we provide options and facilitate access to services provided by our telehealth partners (“Telehealth Services”).
If you choose to use a Telehealth Services, Flo may act as a service provider to the applicable telehealth partner. In this role, we may collect certain personal information—such as your ZIP code and insurance provider—and share it with the partner to facilitate that service. In some cases, this information may be treated as Protected Health Information under the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”).
We will process this information on behalf of our telehealth partners in accordance with applicable law and our contractual obligations, including, where required, entering into a HIPAA business associate agreement.
The data processing activities described in this Privacy Policy do not apply to the use of your personal information in connection with Telehealth Services. For information about how your personal information is collected, used, and disclosed in that context, please refer to the privacy notice or notice of privacy practices of the relevant telehealth partner.
Not stated here
The relevant telehealth partner’s privacy notice is not supplied; this analysis cannot describe its collection, uses, disclosures or detailed HIPAA terms.
Cross-references
narrows (model-proposed): Policy scope, controller and effective date — narrows: Telehealth information is expressly outside this policy’s described processing activities and instead follows the relevant partner notice; this limits the general services scope.
Legal Rights & Agreement Rules · Company commitment
Flo U.S. states DPF commitments and conditional onward-transfer liability
Flo Health, Inc., the US subsidiary, says it self-certifies and complies with the EU–US DPF, UK Extension and Swiss–US DPF for personal data processed in reliance on those frameworks. For onward transfers to third parties acting for it, Flo U.S. remains liable for noncompliant processing unless it proves it was not responsible for the cause of the damage. DPF Principles govern if they conflict with this policy in that framework context.
Supporting quotations
Flo Health, Inc., Flo’s U.S. subsidiary, (“Flo U.S.”) is self-certified and complies with the EU–US DPF, the UK Extension to the EU–US DPF and Swiss–US DPF (collectively, the “DPFs”). Flo U.S. has certified to the U.S. Department of Commerce that, on reliance of the DPFs, it adheres to the DPF Principles when processing personal data of individuals within the EU, UK and/or Switzerland. For onward transfers, Flo U.S. is responsible for processing personal data it receives under the DPFs, and then transfers to a third party acting on its behalf. Flo U.S. remains liable under the DPFs if those third parties process personal data in a way that is not in compliance with the DPFs, unless it can prove that we are not responsible for the cause of any damage.
If there is any conflict between the terms in this Privacy Policy and the DPF Principles, the DPF Principles will govern
Not stated here
The linked DPF Principles are not supplied, and certification status is not independently checked here; only Flo’s stated commitment and precedence rule are analyzed.
Start DPF complaints with Flo; unresolved complaints can go to free JAMS services
EU, UK and Swiss individuals with DPF complaints should first contact dpo@flo.health or Flo Health UK Limited, Fourth Floor, International House, 1 St Katharine’s Way, London, E1W 1UN, United Kingdom. Flo U.S. commits to referring unresolved DPF complaints to JAMS. If acknowledgment is untimely or Flo’s answer is unsatisfactory, you may contact JAMS to complain; its services are free to you.
Supporting quotations
Complaints and dispute resolution: Flo U.S. is committed to resolving complaints about its collection and use of your personal data. EU, UK and Swiss individuals with inquiries or complaints regarding the DPFs should first contact us by emailing us at dpo@flo.health or by mail using the address: Flo Health UK Limited, Fourth Floor, International House, 1 St Katharine’s Way, London, E1W 1UN, United Kingdom.
Flo U.S. has further committed to refer unresolved DPF complaints to JAMS, an alternative dispute resolution provider located in the U.S. If you do not receive timely acknowledgment of your complaint from us, or if we have not addressed your complaint to your satisfaction, please contact JAMS or visit https://www.jamsadr.com/DPF-Dispute-Resolution for more information or to file a complaint. The services of JAMS are provided at no cost to you.
Not stated here
The linked JAMS information is not supplied; its additional procedures are not analyzed.
Legal Rights & Agreement Rules · User right or choice
DPF arbitration has prerequisites, limited remedies and exclusions
A resident of a participating European country, including the UK and Switzerland, may be able to invoke binding arbitration for unresolved DPF complaints. First contact Flo and allow it to resolve the issue, seek JAMS assistance, and contact the US Department of Commerce directly or through the identified authorities, allowing it time to resolve the issue. Each party bears its own attorney fees. Arbitrators may grant only individual-specific, non-monetary equitable relief needed to remedy the DPF violation. The same claimed violation cannot be arbitrated through this option if previously arbitrated, finally adjudicated in a court action involving the individual, or settled by the parties.
Supporting quotations
Arbitration: You may also be able to invoke binding arbitration for unresolved complaints, but prior to initiating such arbitration, a resident of a European country (including the UK and Switzerland) participating in the DPFs must first (1) contact us and afford us the opportunity to resolve the issue; (2) seek assistance from JAMS; and (3) contact the US Department of Commerce (either directly or through a European data protection authority, the UK’s Information Commissioner’s Office or the Swiss Federal Data Protection) and afford the Department of Commerce time to attempt to resolve the issue. If such a resident invokes binding arbitration, each party shall be responsible for its own attorney’s fees. Please be advised that pursuant to the DPFs, the arbitrator(s) may only impose individual-specific, non-monetary, equitable relief necessary to remedy any violation of the DPF with respect to the resident. The arbitration option may not be invoked if the individual’s same claimed violation of the principles (1) has previously been subject to binding arbitration; (2) was the subject of a final judgment entered in a court action to which the individual was a party; or (3) was previously settled by the parties.
The DPF section identifies oversight and dispute-resolution authorities
Flo’s DPF section identifies US Federal Trade Commission investigatory and enforcement powers over covered transferred data, along with the UK Information Commissioner’s Office, relevant EU data protection authority, and Swiss Federal Data Protection and Information Commissioner for Swiss disputes. This reports the policy’s named oversight bodies without expanding their legal powers.
Supporting quotations
Flo U.S. is subject to the investigatory and enforcement powers of the US Federal Trade Commission concerning personal data transferred under the DPFs, the UK’s Information Commissioner’s Office, the relevant EU Data Protection Authority, and the Swiss Federal Data Protection and Information Commissioner for resolving disputes with Swiss individuals.
Legal Rights & Agreement Rules · Context
US state and consumer-health notices are separate documents
US residents are directed to Flo’s U.S. State Privacy Law Notice. The policy also directs Washington and Nevada residents to its Consumer Health Data Privacy Notice. These referenced notices are separate from the supplied Privacy Policy, so their additional rights and obligations are not established here.
The U.S. State Privacy Law Notice and Consumer Health Data Privacy Notice are not supplied; this analysis does not claim complete coverage of their regional or health-data rules.
Legal Rights & Agreement Rules · User right or choice
You may contact a local data protection authority
Flo says you may contact your local data protection authority if needed. Its rights section specifies that any right to lodge a complaint depends on local law; the contact paragraph links a list of authorities without supplying its contents.
Supporting quotations
If needed, you may also contact your local data protection authority.
Depending on local laws, you may have the right to lodge a complaint with your local data protection authority about any of our activities. If you have any concerns about our privacy practices, please let us know by emailing our support team at support@flo.health or by emailing our data protection officer at dpo@flo.health.
Not stated here
The linked authority list is not supplied; no specific regulator’s jurisdiction or procedure is inferred.
Legal Rights & Agreement Rules · Context
Policy scope, controller and effective date
This policy is effective from 31 August 2026 and covers Flo’s apps, flo.health and its subdomains, products and services. Flo Health UK Limited is the registered data controller; other Flo companies also handle data. App names may vary by location. The described processing activities exclude personal information used with Telehealth Services, for which the relevant partner’s privacy notice applies. US residents are also directed to a separate state privacy notice, and Washington and Nevada residents to a consumer health data notice.
Supporting quotations
Effective as of 31 August 2026
This Privacy Policy explains how Flo Health UK Limited and our other companies (“Flo” or “we” or “us”) follow privacy laws such as the General Data Protection Regulation (“GDPR”), the UK GDPR, and any other laws that protect your personal data. It also describes how Flo collects, stores, uses, and shares personal data from you through the Flo mobile application, the Flo Period & Ovulation Tracker application (the “App”),* and the flo.health website (the “Website”), including all subdomains, products and services (together, the “Services”).
Flo Health UK Limited is a company registered in the U.K. and the registered data controller of the Services.
The App might have different names depending on your location.
The data processing activities described in this Privacy Policy do not apply to the use of your personal information in connection with Telehealth Services. For information about how your personal information is collected, used, and disclosed in that context, please refer to the privacy notice or notice of privacy practices of the relevant telehealth partner.
The linked app-name list, telehealth partner notices, U.S. State Privacy Law Notice and Consumer Health Data Privacy Notice are not supplied; their additional scope and rules are not established here.
Legal Rights & Agreement Rules · Procedure
Flo reviews the policy annually and notifies material changes
Flo may update this policy and addendums and reviews them at least yearly, updating them if needed. It says it will notify you by email or in the app about material changes it needs to tell you about. Latest updates are available on the website and in the app.
Supporting quotations
We may update this Privacy Policy and any addendums from time to time. We review them at least once a year and make updates if needed to ensure they remain accurate. If there are material changes to this policy that we need to tell you about, we will let you know by email or through the App.
The latest updates to this policy are available on our Website and in the App.
Legal Rights & Agreement Rules · Company practice
Processing bases depend on the feature and purpose
Depending on the features used, Flo relies on consent to process health data for services, contract for account and administrative commitments, legitimate interests for specified activities, and legal obligations where applicable law requires processing. The policy does not treat every operation as consent-based.
Supporting quotations
Depending on the features you use, we will process your personal data based on the following reasons:
Your consent: You can allow us to process your health data to provide the Services.
Contractual obligations: We process certain personal data to meet our contractual commitments to you, such as managing your Flo account and handling administrative tasks.
Legal obligation: We may be legally required to process your personal data to comply with applicable laws and regulations.
Legal Rights & Agreement Rules · User right or choice
Local law may permit a regulator complaint
Depending on local law, you may complain to your local data protection authority about Flo’s activities. Flo also invites privacy concerns at support@flo.health or dpo@flo.health.
Supporting quotations
Depending on local laws, you may have the right to lodge a complaint with your local data protection authority about any of our activities. If you have any concerns about our privacy practices, please let us know by emailing our support team at support@flo.health or by emailing our data protection officer at dpo@flo.health.