Flo uses both session and persistent cookies. Session cookies identify a single visit and expire after a short time or when the browser closes; Flo says they are automatically deleted on closing it. Persistent cookies remain for a specified period after the browser closes, for example to keep you signed in when requested.
Supporting quotations
We use both session cookies and persistent cookies.
A session cookie is used to identify a particular visit to our Website or Web Application. These cookies expire after a short period of time or when you close your web browser after using our Website. We use these cookies to identify you during a single browsing session, and they are deleted automatically once you close your browser.
A persistent cookie will remain on your devices for a set period of time, and the duration will be specified in this Policy. These cookies survive after your browser is closed. For example, we would use a persistent cookie if you asked that we keep you signed in to the Flo service.
Data Access & Collection · Context
Flo and third parties set cookies
First-party cookies are set and used directly by Flo. Third-party cookies are set by partners, such as analytics providers, through the Website or server cookies. The policy’s term “cookies” also covers similar technologies that store or access device information.
Supporting quotations
Cookies can either be “first-party” or “third-party.” First-party cookies refer to cookies that Flo sets and uses directly. Third-party cookies refer to cookies set by third parties (such as our analytics providers) through our Website or via server cookies.
However, it’s not only cookies that can be used in this way. Functions performed by a cookie can be achieved by other means, too. This Policy on cookies, therefore, also applies to any similar technology that stores or accesses information on your device. This could include, for example, HTML5 local storage, local shared objects, beacons, pixels, and plug-ins. The single term “cookies” refers to cookies and any similar technologies.
Use & Processing · Context
Three cookie categories serve different purposes
Flo classifies the cookies it and its partners use for the Website as Necessary, Statistics or Marketing. These are the policy’s purpose categories.
Supporting quotations
The types of cookies used by us and our partners in connection with the Website can be classified into one of three categories:
(i) Necessary
(ii) Statistics
(iii) Marketing
Data Access & Collection · Restriction or exception
Necessary cookies cannot be rejected
Flo says necessary cookies are essential to the Website and requested features, such as access to secure areas, and you cannot reject them. This includes necessary cookies from Flo and its partners; the policy says some third-party necessary cookies have a maximum duration of 24 months.
Supporting quotations
i) Necessary cookies
These cookies are strictly necessary to provide you with the Website and the features you have requested, such as to allow you to log into secure areas of the Website. Because these cookies are essential for the Website and the features you have requested to work, you cannot reject them.
First-party necessary cookies set by Flo
We use first-party cookies for the following essential purposes:
Third-party necessary cookies are set by our partners: See the table below.
As explained above, these cookies are strictly necessary to operate our Websites and cannot be declined. Some of these cookies have a maximum duration of 24 months.
Cross-references
qualifies (model-proposed): Banner consent changes have limits for third-party cookies — qualifies: Necessary cookies cannot be rejected; the controls card therefore limits consent changes to optional cookies and distinguishes Flo’s future first-party use from deletion of previously consented third-party cookies.
Use & Processing · Company practice
Necessary cookies support access, security and billing
Flo’s first-party necessary cookies support access and visitor identification across subdomains; fraud and bot detection, authentication and secure logins; remembering and sharing cookie-consent choices across subdomains; traffic scheduling and network distribution; and payments.
Supporting quotations
Functionality: Optimizing and improving access to the Website whilst enabling the identification of a visitor across various subdomains.
Security: Preventing fraud and detecting nonhuman (bot) traffic, including authentication and secure logins
Cookie consent: Remembering your cookie consent preferences and sharing such cookie consents across subdomains to improve user experience
Analysis: Traffic scheduling and network distribution
Billing: The ability to make payments
Use & Processing · Company practice
Statistics cookies measure how the Website is used
Analytics and performance cookies help Flo report and evaluate website activity and patterns: pages viewed most often, visitors’ region, interaction with content, errors and tests of design ideas. Flo says its cookies do not process personal health data.
Supporting quotations
(ii) Statistics
We use analytics and performance cookies to analyze how you use the Website. This helps us to:
See which pages you view most often
Analyze which region you are visiting the Website from
Observe how you interact with the content
Measure any errors that occur
Test different design ideas
The above information is used to report and evaluate your activities and patterns as a user of the Website.
You can also change your consent to each category of cookies at any time via the cookie banner using the toggles. We also may use certain cookies on only a limited number of pages that you visit on our Website and Web Application to avoid unnecessary collection of your personal data. Please note that our cookies do not process any personal health data.
Retention & Deletion · Company practice
First-party statistics cookies can last up to 13 months
Flo uses first-party statistics cookies for analytics and web optimization; some have a maximum duration of 13 months. The policy also lists third-party statistics cookies in its cookie inventory.
Supporting quotations
First-party statistics cookies set by Flo:
We use first-party cookies for analytics and web optimization purposes. Some of these cookies have a maximum duration of 13 months.
Third-party statistics cookies (set by our partners): See the cookies table below.
Use & Processing · Company practice
Marketing cookies promote the app without using health information
Flo uses marketing cookies to reach you and similar audiences and measure promotion effectiveness. It says it does not use cookies to collect or analyze health information for marketing. Some marketing tools run on servers without setting a browser cookie, and those tools activate only after you consent.
Supporting quotations
(iii) Marketing
These cookies help us reach you and more people like you to spread the word about the App, as well as analyze whether we do that effectively. Flo does not use cookies to collect or analyze your health information for marketing purposes.
Some marketing tools may operate server-side and do not set a cookie directly in your browser. These are only activated after you provide consent.
Use & Processing · Company practice
Marketing cookies measure campaigns and traffic sources
Flo’s first-party marketing cookies support campaign improvement, conversion tracking, paid-search keyword identification, identifying traffic sources such as search engines or social media, visitors’ region and interaction with content. Third-party marketing cookies are listed separately in the inventory. The policy excludes collecting or analyzing health information through cookies for marketing.
Supporting quotations
First-party marketing cookies set by Flo
We use marketing cookies to analyze and improve our marketing campaigns. This helps us to:
Improve our marketing campaigns, including tracking ad conversions
Identify paid search keywords
Identify the source of traffic to the Website, such as search engine, social media, or specific website
Analyze which region you are visiting the Website from
See how you interact with the content
Third-party marketing cookies (set by our partners): See the cookies table below.
These cookies help us reach you and more people like you to spread the word about the App, as well as analyze whether we do that effectively. Flo does not use cookies to collect or analyze your health information for marketing purposes.
Linking & Identification · Company practice
Reddit cookies track visitors across websites
In the marketing table, Reddit’s _rdt_uuid assigns a unique user ID for tracking activity across websites and lasts three months. _rdt_cid also tracks visitors across websites and lasts one month.
Supporting quotations
Marketing
Reddit _rdt_uuid This cookie is set by Reddit to assign a unique ID to a user, which helps Reddit track user activity across websites. Persistent 3 months
Reddit _rdt_cid This cookie is set by Reddit to track visitors across websites Persistent 1 month
Use & Processing · Company practice
Flo tracks affiliate activity and TikTok ad clicks
Flo’s _is_fba tracks partner activity for affiliate-marketing attribution and lasts one day. Its ttclid entry links a TikTok ad-click identifier appended to a landing-page URL with a campaign for attribution and performance, and lasts 30 days.
Supporting quotations
Flo _is_fba Affiliate Marketing - Cookie used to track partner activity and ensure accurate attribution. Persistent 1 day
Flo ttclid TikTok Click ID is a tracking parameter appended to a landing page URL when you click on an ad on TikTok, helping TikTok to improve ad attribution and performance by associating your Click ID with a campaign Persistent 30 days
Use & Processing · Company practice
TikTok cookies measure interaction and advertising
TikTok’s _tt_enable_cookie tracks embedded-service use and lasts 13 months. tt_pixel_session_index counts TikTok-content interactions, and tt_sessionId tracks sessions for ad attribution and analytics; both last a session. _ttp measures and improves advertising performance and personalizes TikTok experiences, including ads, and lasts 13 months. tt_appInfo remembers content settings and preferences for one year.
Supporting quotations
Tik Tok _tt_enable_cookie Used by the social networking service, TikTok, for tracking the use of embedded services. Persistent 13 months
Tik Tok tt_pixel_session_index Cookie is used by TikTok to check how many times you've interacted with TikTok content Session
Tik Tok tt_sessionId Tracks user sessions for TikTok ad attribution and analytics. Session
Tik Tok _ttp To measure and improve the performance of your advertising campaigns and to personalize the user's experience (including ads) on TikTok Persistent 13 months
Tik Tok tt_appInfo This cookie helps TikTok remember settings and preferences for TikTok content Persistent 1 year
Use & Processing · Company practice
X cookies support ad relevance and service personalization
X (Twitter) uses muc_ads for website optimization and ad relevance, guest_id_marketing and _guest_id_ads for ad relevance, and guest_id for visit counts, average visit time and pages loaded to personalize and improve Twitter. Each lasts 13 months. The 1/i/adsct [x2] entry supports website optimization and ad relevance but lasts a session.
Supporting quotations
X (Twitter) muc_ads It’s used in order to optimize the website and make advertisements on the website more relevant. Persistent 13 months
X (Twitter) guest_id Collects data related to the user's visits to the website, such as the number of visits, average time spent on the website and which pages have been loaded, with the purpose of personalising and improving the Twitter service. Persistent 13 months
X (Twitter) guest_id_marketing It’s used in order to optimize the relevance of advertisement on the website. Persistent 13 months
X (Twitter) _guest_id_ads It’s used in order to optimize the relevance of advertisements on the website. Persistent 13 months
X (Twitter) 1/i/adsct [x2] It’s used to optimize the website and make advertisements on the website more relevant. Session
Retention & Deletion · Company practice
Two X advertising cookies have different durations
The table describes X’s personalization_id and _twclid simply as advertising cookies, without giving more specific purposes. personalization_id lasts 13 months and _twclid lasts 30 days.
Supporting quotations
X (Twitter) personalization_id Advertising cookie Persistent 13 months
X (Twitter) _twclid Advertising cookie Persistent 30 days
Use & Processing · Company practice
Impact click IDs and tracking tags measure interaction
Impact.com Affiliate’s irclickid is a click ID for its platform and lasts 30 days. The following UTT entries, IR_22205 and IR_GBD, let Flo understand interaction with its pages and last a session. IR_PI is set on clicks on Flo banners, uses UUID keys in UTT functions and lasts two years.
Supporting quotations
Impact.com Affiliate irclickid Click id for Impact platform Persistent 30 days
IR_22205 Cookie set as a part of the Universal Tracking Tag (UTT) API implementation, which is a minified script placed within Flo’s website. It allows Flo to understand how users interact with our web pages Session
IR_GBD The Universal Tracking Tag (UTT) is a minified script placed within Flo’s website. Cookies set on the base domain of Flo website as part of the Universal Tracking Tag (UTT) system to understand how users interact with our web pages. Session
IR_PI These cookies are set when the user clicks on Flo’s banners. This is part of UTT javascript functions and works based on unique identifier UUID keys. Persistent 2 years
Use & Processing · Company practice
Additional tracking entries identify customers and last clicks
IRLD identifies the last click to remove duplicates during checkout and final conversion, with a six-month duration. brwsr stores a UUID key to recognize a customer later and lasts 24 days. EPERSIST distributes network traffic during a session; its row says it stores no personally identifiable information and expires when the session ends.
Supporting quotations
IRLD This cookie identifies the "last click" and is used to eliminate duplicate clicks during checkout and the final conversion. Persistent 6 months
brwsr This cookie stores a unique UUID key to help identify a customer later. Persistent 24 days
EPERSIST It helps distribute network traffic efficiently, ensuring optimal performance and reliability during a user's session. This cookie does not store personally identifiable information and expires when the session ends. Session
Data Access & Collection · Company practice
Meta browser and ad-click cookies last 90 days
Meta’s _fbp identifies browsers for advertising and site analytics. _fbc stores the last visit and is set only when someone arrives from an ad and the destination URL contains fbclid. Both entries last 90 days.
Supporting quotations
Meta (Facebook) _fbp It identifies browsers for the purposes of providing advertising and site analytics services Persistent 90 days
Meta (Facebook) _fbc It stores the last visit. This cookie is only set when a user arrives at the Website from an ad, and the destination URL includes the click identifier “fbclid.” Persistent 90 days
Sharing & Disclosure · Company practice
EEA and UK: consented hashed-email matching with Meta
The Meta Advanced Matching row applies only to the EEA and UK. When you enter an email address into a web-app form, Flo hashes it with SHA256 and shares the hash with Meta if you consent. Meta may match it to your account to measure advertising effectiveness and deliver more relevant Meta ads, including measurement across devices and browsers. Flo says no health information or actual email address is shared in this process. The entry is persistent for 90 days.
Supporting quotations
Meta (Facebook)
(EEA & UK only)
Meta Advanced Matching We use a privacy-enchancing process to help measure the effectiveness of our advertising. Specifically, when you input your email address into a form in our web app, we convert your email address into a secure, hashed format using industry-standard SHA256 hashing. We then share this hashed email address with Meta if you give your consent, and Meta matches this, if possible, to your Meta account in order to help measure the effectiveness of our advertising and deliver more relevant ads to you on the Meta platforms. No health information is shared as part of this process. Using Meta Advanced Matching helps us improve how we measure ad performance across devices and browsers, without sharing your actual email address. Persistent 90 days
Linking & Identification · Company practice
Snapchat IDs support visit statistics and targeted ads
Snapchat’s _schn1 assigns an ID for session tracking and statistics across multiple visits, which may also create marketing leads; it lasts one day. _scid and _scid_r assign IDs enabling third-party advertisers to target relevant ads and each lasts 13 months.
Supporting quotations
Snapchat _schn1 It sets a unique ID for the visitor to track individual sessions on the Website, allowing the Website to compile statistical data from multiple visits. This data can also be used to create leads for marketing purposes. Persistent 1 day
Snapchat _scid It sets a unique ID for the visitor that allows third-party advertisers to target the visitor with relevant advertisements Persistent 13 months
Snapchat _scid_r Sets a unique ID for the visitor that allows third-party advertisers to target the visitor with relevant advertisements. Persistent 13 months
Use & Processing · Company practice
YouTube entries estimate bandwidth and store player preferences
YouTube’s VISITOR_INFO1_LIVE tries to estimate bandwidth on pages with embedded YouTube videos and lasts 179 days. ytidb::LAST_RESULT_ENTRY_KEY stores player preferences for embedded videos; the table calls it persistent without specifying how long.
Supporting quotations
YouTube VISITOR_INFO1_LIVE Tries to estimate the users’ bandwidth on pages with integrated YouTube videos Persistent 179 days
YouTube ytidb::LAST_RESULT_ENTRY_KEY Stores the user’s video player preferences using embedded YouTube video Persistent
Use & Processing · Company practice
Some YouTube preference entries last only a session
The YouTube row lists Yt-remote-cast-available, Yt-remote-cast-installed, Yt-remote-fast-check-period, Yt-remote-session-app and yt-remote-session-name as storing preferences for embedded video players, with a session duration.
Supporting quotations
YouTube
Yt-remote-cast-available
Yt-remote-cast-installed
Yt-remote-fast-check-period
Yt-remote-session-app
yt-remote-session-name
Stores the user’s video player preferences using embedded YouTube video Session
Use & Processing · Company practice
Other YouTube preference entries persist beyond a session
YouTube’s yt-remote-connected-devices and yt-remote-device-id store embedded-video player preferences. Their row says persistent without specifying a period. Separately, YSC records interaction with embedded YouTube videos and lasts a session.
Supporting quotations
YouTube
yt-remote-connected-devices
yt-remote-device-id
YouTube cookies that store the user’s video player preferences using embedded YouTube video Persistent
YouTube YSC YouTube cookies to understand how a user interacts with embedded YouTube videos on a website. Session
Use & Processing · Company practice
Google tracks sessions and measures ad effectiveness
The marketing table lists Google’s _ga to identify and track an individual session with a device, lasting two years. _gcl_au lets Google AdSense experiment with ad effectiveness across websites using its services and lasts three months.
Supporting quotations
Google _ga Used to identify and track an individual session with a user device Persistent 2 years
Google _gcl_au Used by Google AdSense for experimenting with advertisement efficiency across websites using their services Persistent 3 months
Use & Processing · Company practice
Google retargeting and referral-measurement entries last a session
Google’s ads/ga-audiences reengages visitors considered likely to become customers based on behavior across websites. pagead/1p-user-list/# measures advertising efforts and facilitates referral-fee payments between websites. Both have session durations.
Supporting quotations
Google ads/ga-audiences Used to reengage visitors that are likely to convert to customers based on the visitor’s online behavior across websites Session
Google pagead/1p-user-list/# Set by Google for measurement of advertisement efforts and facilitates payment of referral fees between websites Session
Sharing & Disclosure · Company practice
EEA and UK: hashed-email matching with Google
Google Enhanced Conversion is labeled EEA and UK only. Flo hashes your email address with SHA256 before sharing it with Google. Google may match the hash to signed-in accounts to identify ads leading to actions such as purchases or sign-ups and measure performance across devices and browsers. Flo says it shares no health information or actual email address in this process. The entry lasts up to 90 days.
Supporting quotations
Google Google Enhanced Conversion (EEA & UK only) We use a privacy-enchancing process to help measure the effectiveness of our advertising. Specifically, we convert your email address into a secure, hashed format using industry-standard SHA256 hashing before sharing it with Google. This hashed information allows Google to match it, if possible, to signed-in Google accounts in order to understand which ads may have led to a specific action, like a purchase or sign-up. No health information is shared as part of this process. This helps us improve how we measure ad performance across devices and browsers, without sharing your actual email address. Persistent up to 90 days
Data Access & Collection · Company practice
LinkedIn cookies track embedded-service use
LinkedIn’s bcookie and bscookie track use of embedded services and last one year. Its lidc entry has the same stated purpose but lasts one day.
Supporting quotations
LinkedIn
bcookie
bscookie
Used by LinkedIn for tracking the use of embedded services Persistent 1 year
LinkedIn lidc Used by LinkedIn for tracking the use of embedded services Persistent 1 day
Use & Processing · Company practice
Snapchat measures ads and distinguishes visitors
Snapchat’s sc_at delivers ad content, measures its effectiveness and collects visitor data for further segmentation; it lasts one year. blizzard_client_id distinguishes unauthenticated visitors and lasts 30 days.
Supporting quotations
Snapchat sc_at Used by Snapchat to implement advertisement content. The cookie detects the efficiency of the ads and collects visitor data for further visitor segmentation. Persistent 1 year
Snapchat blizzard_client_id Used to distinguish unauthenticated visitors Persistent 30 days
Use & Processing · Company practice
Snapchat stores consent and language preferences
Snapchat’s EssentialSession saves Essential Session cookie preferences; sc-cookies-accepted records whether cookies were accepted; sc-language remembers the selected language. Each lasts one year. _sctr determines whether a third-party tag will be called in a Snap Ads Pixel and also lasts one year.
Supporting quotations
Snapchat EssentialSession Used to save Essential Session cookie preferences Persistent 1 year
Snapchat sc-cookies-accepted Used to determine whether a visitor has accepted cookies Persistent 1 year
Snapchat _sctr Used to determine whether a third-party tag will be called in a Snap Ads Pixel Persistent 1 year
Snapchat sc-language Used to remember a visitor’s chosen language preference. Persistent 1 year
Retention & Deletion · Company practice
Snapchat’s metrics identifier expires sooner in the EU and UK
The table describes sc-wcid as an anonymous client-side identifier for operational and performance metrics. It lasts one year except in the EU and UK, where it expires after 24 hours.
Supporting quotations
Snapchat sc-wcid Anonymous client-side identifier used for operational and performance metrics Persistent 1 year (excluding EU/UK where expiration is 24 hours)
Security & Safeguards · Company practice
Snapchat’s session encryption entry has alternative durations
Snapchat’s sc-a-nonce performs a nonce check and encrypts session data. Its expiration is stated as “Session or 1 year”; this row does not explain which duration applies in which case.
Supporting quotations
Snapchat sc-a-nonce Nonce check. It’s used to encrypt session data. Session or 1 year
Use & Processing · Company practice
Flo campaign-tracking entries generally list one year
Flo’s utm_campaign typically records campaign names, slogans or promo codes to measure online advertising. utm_term identifies paid-search keywords and ad-set names. utm_medium usually travels in tracked-link URLs to identify an advertiser, site or publication; utm_content differentiates similar content or links within an ad. Each lists one year.
Supporting quotations
Flo utm_campaign A first-party cookie that typically tracks individual campaign name, slogan, promo code, etc., to track the effectiveness of online advertising campaigns 1 year
Flo utm_term Identifies paid search keywords and name of ad sets 1 year
Flo utm_medium Tracking technology typically passed as part of the URL when a user clicks on a tracked link, such as an ad or email campaign, to identify the advertiser, site, or publication 1 year
Flo utm_content Tracking technology typically passed as part of the URL to differentiate similar content or links within the same ad 1 year
Use & Processing · Company practice
Flo records ad, experiment, traffic and campaign identifiers
The table gives a one-year duration for utm_ad, which identifies a specific ad; utm_exp, which identifies an experiment; utm_source, which identifies the traffic source such as a search engine or social platform; and utm_campaign_id, which identifies an ad campaign.
Supporting quotations
Flo utm_ad Used to identify the ID of the specific add 1 year
Flo utm_exp Used to identify the ID of the specific experiment 1 year
Flo utm_source Tracking technology used to identify the specific source of traffic to a Website, such as a search engine, social media platform, or specific website 1 year
Flo utm_campaign_id Tracking technology used to identify the specific ID of an ad campaign 1 year
Retention & Deletion · Company practice
Flo ad-set entries lack a stated expiration
utm_adset and utm_adset_id are both described as identifying the name of the ad set where an ad appeared, with no expiration supplied in either row. The separate utm_ad_id identifies a specific ad and lasts a session. The names alone do not supply missing purposes or durations.
Supporting quotations
Flo utm_adset Tracking technology used to identify the name of the specific ad set in which the ad was displayed.
Flo utm_adset_id Tracking technology to identify the name of the specific ad set in which the ad was displayed.
Flo utm_ad_id Tracking technology to identify the ID of the specific ad Session
Use & Processing · Company practice
Quora lists a pixel entry and click identifier
Quora’s m-b is described in terms of pixel necessity, performance, functionality and targeting and lasts two years. The separate qclid is a click ID and lasts 30 days.
Supporting quotations
Quora m-b Pixel necessity, performance, functionality, targeting Persistent 2 years
Quora qclid It’s used for click ID. Persistent 30 days
Sharing & Disclosure · Company practice
HubSpot’s marketing-table analytics entry lasts 90 days
The marketing table’s __ptq.gif entry sends website analytics data to HubSpot and is persistent for 90 days. This is the description and duration for this specific entry.
Supporting quotations
HubSpot __ptq.gif Sends analytics data to HubSpot about the website Persistent 90 days
Use & Processing · Company practice
Pinterest analytics and usage entries have different durations
The Pinterest row lists _pinterest_ct, _pinterest_ct_ua, _pin_unauth, _derived_epik, _epik and ar_debug for marketing analytics, with a one-year duration. The separate _nccapi_ur and v3/ pixel entries track use of services and last a session.
Supporting quotations
Pinterest
_pinterest_ct
_pinterest_ct_ua
_pin_unauth, _derived_epik _epik
ar_debug
Cookies for marketing analytics Persistent 1 year
Pinterest _nccapi_ur Used by Pinterest to track the usage of services. Session
Pinterest v3/ pixel Used by Pinterest to track the usage of services. Session
Linking & Identification · Company practice
Microsoft synchronizes IDs and records sessions
Microsoft’s MUID provides a unique user ID and synchronizes it across Microsoft domains for tracking. _uetsid contains the ID for a unique site session. Both entries have a persistent 13-month duration, including the session-ID entry.
Supporting quotations
Microsoft (Bing) MUID Used widely by Microsoft as a unique user ID. The cookie enables user tracking by synchronizing the ID across many Microsoft domains. Persistent 13 months
Microsoft (Bing) _uetsid Contains the session ID for a unique session on the site Persistent 13 months
Use & Processing · Company practice
Microsoft records cookie-expiry dates and ad clicks
Microsoft’s _uetsid_exp and _uetvid_exp contain expiration dates for the correspondingly named cookies and each lasts 13 months. _uetmsclkid captures the Microsoft Click ID when someone clicks an ad and lands on the website; it lasts 90 days.
Supporting quotations
Microsoft (Bing) _uetsid_exp Contains the expiry-date for the cookie with corresponding name Persistent 13 months
Microsoft (Bing) _uetvid_exp Contains the expiry-date for the cookie with corresponding name Persistent 13 months
Microsoft (Bing) _uetmsclkid Captures the Microsoft Click ID (MSCLKID) when a user clicks on an ad and lands on your website Persistent 90 days
Linking & Identification · Company practice
Microsoft tracks visitors across sites for relevant ads
Microsoft’s _uetvid tracks visitors on multiple websites to present ads based on their preferences. Its stated duration is 13 months.
Supporting quotations
Microsoft (Bing) _uetvid It’s used to track visitors on multiple websites, in order to present relevant advertisements based on the visitor's preferences. Persistent 13 months
Data Access & Collection · User right or choice
Mobile SDK access requires consent, while Flo remains usable if refused
Third-party SDKs may be installed in the mobile application to understand app interactions and collect certain device and network information. In this mobile-SDK section, Flo says access is requested to provide and improve services, requires prior consent and allows withdrawal. Flo services remain usable if you refuse or withdraw that consent.
Supporting quotations
SDKs are third-party software development kits that may be installed in your mobile application. SDKs help us understand how you interact with our App and collect certain information about the device and network you use to access the application.
Our App is never used to present you with third-party advertising. You can browse with full confidence in the protection of your privacy. Access is requested with the purpose of enabling the use of our services and improving their functioning. It is subject to a prior consent request and the possibility of withdrawing this consent. Flo services may still be used even in the event of refusal or withdrawal of consent.
Cross-references
contrast (model-proposed): Deleting or refusing cookies may affect Website features — contrast: Flo services remain usable after refusing or withdrawing consent in the mobile-SDK section, while deleting or refusing cookies may limit Website features or display. These are different technologies and contexts; neither statement cancels the other.
Use & Processing · Company commitment
Flo says its app does not display third-party ads
The mobile-SDK section says the Flo app is never used to present third-party advertising. That statement concerns ads shown in the app; the section also describes acquisition-campaign measurement and choices about targeted-advertising data.
Supporting quotations
Our App is never used to present you with third-party advertising. You can browse with full confidence in the protection of your privacy. Access is requested with the purpose of enabling the use of our services and improving their functioning. It is subject to a prior consent request and the possibility of withdrawing this consent. Flo services may still be used even in the event of refusal or withdrawal of consent.
AppsFlyer SDK: Facilitates measurement of performance and analysis of customer acquisition campaigns. Further information about AppsFlyer SDK is available at https://www.appsflyer.com/product/security-and-privacy/. You can deactivate this data processing at any time via https://www.appsflyer.com/optout. In order to do so, you must have the Identifier for Advertisers (IDFA) of your mobile device.
You can also withdraw your consent for the collection of data for targeted advertising or sharing their data with third-party advertisers through Flo privacy settings or your device’s settings.
Not stated here
The linked AppsFlyer security and privacy document is not supplied here; this card cannot describe its additional data practices, safeguards or opt-out terms.
Cross-references
contrast (model-proposed): You can withdraw consent for advertising data through settings — contrast: The app is said never to display third-party ads, yet the same mobile section gives choices about collection for targeted advertising and sharing with advertisers. These describe different activities: ad placement versus data processing. The no-display commitment does not establish no advertising-related processing.
Use & Processing · User right or choice
AppsFlyer measures acquisition campaigns and offers an opt-out
AppsFlyer’s SDK measures performance and analyzes customer-acquisition campaigns. Flo points to AppsFlyer’s security/privacy page for more information and its appsflyer.com/optout page to deactivate this processing at any time. That opt-out requires your mobile device’s Identifier for Advertisers (IDFA). The linked pages’ additional terms are not supplied here.
Supporting quotations
AppsFlyer SDK: Facilitates measurement of performance and analysis of customer acquisition campaigns. Further information about AppsFlyer SDK is available at https://www.appsflyer.com/product/security-and-privacy/. You can deactivate this data processing at any time via https://www.appsflyer.com/optout. In order to do so, you must have the Identifier for Advertisers (IDFA) of your mobile device.
Not stated here
The linked AppsFlyer security and privacy document is not supplied here; this card cannot describe its additional data practices, safeguards or opt-out terms.
Sharing & Disclosure · User right or choice
You can withdraw consent for advertising data through settings
Flo says you can withdraw consent to collection for targeted advertising or sharing data with third-party advertisers through Flo privacy settings or device settings. This does not itself say the app displays third-party ads.
Supporting quotations
You can also withdraw your consent for the collection of data for targeted advertising or sharing their data with third-party advertisers through Flo privacy settings or your device’s settings.
Our App is never used to present you with third-party advertising. You can browse with full confidence in the protection of your privacy. Access is requested with the purpose of enabling the use of our services and improving their functioning. It is subject to a prior consent request and the possibility of withdrawing this consent. Flo services may still be used even in the event of refusal or withdrawal of consent.
Data Access & Collection · Procedure
The policy points to device advertising-ID controls
For advertising-ID control, the policy names “Limit Ad Tracking” on Apple devices and “Opt out of Ads Personalization” on Android devices. These are the setting names given in this saved policy.
Supporting quotations
Advertising ID. You can tailor your device settings to control your advertising ID:
On Apple devices, you can enable the “Limit Ad Tracking” setting in your device settings.
On Android devices, you can enable the “Opt out of Ads Personalization” in your device settings.
Data Access & Collection · User right or choice
The widget changes future Flo cookie use; third-party cookies require browser controls
The cookie-settings widget, generally at the bottom left, lets you change preferences and withdraw nonessential-cookie consent for future first-party Flo cookie use; a page refresh may be necessary. Previously consented third-party cookies cannot be disabled through Flo’s system. Flo directs you to delete cookies in browser settings to withdraw optional-cookie consent. Deleting or refusing cookies may limit features, preference storage or proper page display.
Supporting quotations
You can change your cookie preference at any time — including withdrawing consent to nonessential cookies that you have previously given— by clicking the cookie settings widget, which is generally in the bottom left-hand corner of the screen. Your consent will then be updated for further use for any cookies operated by Flo, as these are first-party cookies. You may need to refresh your page for your settings to take effect.
It is important to understand that if you have previously given your consent for the use of third-party cookies, you will not be able to disable them through our cookie management system. If you wish to withdraw your consent to optional cookies (including third-party cookies) or do not want certain types of cookies, you will need to delete your cookies using your internet browser settings. Most browsers allow you to manage how cookies are set and used as you are browsing and to clear cookies and browsing data.
Please note, however, that if you delete cookies or do not accept them, you might not be able to use all of the features we offer, you may not be able to store your preferences, and some of our pages might not display properly.
Data Access & Collection · Procedure
Cookie deletion help is available from browser providers
The policy links to aboutcookies.org for deletion and blocking help and to cookie-management instructions for Chrome, Internet Explorer, Firefox, Safari desktop and mobile, Opera and Opera Mobile. For other browsers it directs you to the manufacturer’s documentation. The linked instructions are not reproduced in this policy.
For other browsers, please consult the documentation that your browser manufacturer provides.
Data Access & Collection · User right or choice
Third-party advertising and analytics have separate opt-out routes
Flo points to the Network Advertising Initiative’s multi-cookie opt-out mechanism for third-party vendor cookies, and device settings for device identifiers. It also links to Google’s Analytics opt-out page to opt out of Google Analytics tracking across websites. The policy does not supply the linked mechanisms’ detailed operation.
Supporting quotations
You can opt out of a third-party vendor’s use of cookies by visiting the multi-cookie opt-out mechanism, the Network Advertising Initiative opt-out page, or control the use of device identifiers by using their device’s settings.
Deleting or refusing cookies may affect Website features
If cookies are deleted or not accepted, Flo warns that some offered features may become unavailable, preferences may not be saved and pages may not display properly. This warning is about cookie-dependent features; the mobile-SDK section separately says Flo services remain usable after refusing or withdrawing SDK-access consent.
Supporting quotations
Please note, however, that if you delete cookies or do not accept them, you might not be able to use all of the features we offer, you may not be able to store your preferences, and some of our pages might not display properly.
Our App is never used to present you with third-party advertising. You can browse with full confidence in the protection of your privacy. Access is requested with the purpose of enabling the use of our services and improving their functioning. It is subject to a prior consent request and the possibility of withdrawing this consent. Flo services may still be used even in the event of refusal or withdrawal of consent.
Data Access & Collection · Restriction or exception
The Website does not recognize Do Not Track signals
The policy describes Do Not Track as a browser-based way to signal choices about cross-website tracking, but says the Website is not programmed to recognize those signals. It will not treat you differently when it receives one and may not follow your browser’s DNT setting. This is distinct from Flo’s cookie-settings controls.
Supporting quotations
DNT is a concept that has been promoted by regulatory agencies, such as the US Federal Trade Commission (FTC), for the internet industry to develop and implement a mechanism for allowing internet users to control the tracking of their online activities across websites by using browser settings. You can visit your browser settings to adjust these settings. At the current time, this Website is not programmed to recognize Do Not Track signals, so the Site will not treat You differently if We receive such signals from Your browser. We may not comply with Do Not Track settings on Your browser.
Legal Rights & Agreement Rules · Company commitment
Material technology-policy changes receive a posted notice
Flo may change this policy and says it will revise the “Last Updated” date when changes are posted. If changes materially affect how these technologies collect, use or share information, Flo will prominently post notice where you use the Website. It also recommends checking this page periodically. The clause does not promise individual email notice.
Supporting quotations
Changes to this Policy
We may change this Policy from time to time. When we post changes to this Policy, we will revise the “Last Updated” date at the top of this Policy. If we make any material changes in the way we collect, use, and/or share information using these technologies, we will notify you by prominently posting notice of the changes in places where you use the Website. We recommend that you check this page from time to time to inform yourself of any changes in this Policy.
Legal Rights & Agreement Rules · Procedure
Questions about the policy go to Flo support
For questions or comments about this policy, Flo provides support@flo.health.
Supporting quotations
Contact us
If you have any questions or comments about this Policy, please email support@flo.health.
Legal Rights & Agreement Rules · Context
Policy scope and effective date
The policy is effective November 24, 2025. Flo UK Limited operates the named websites and web application. This cookie policy applies to Flo products or services that link to it or incorporate it by reference.
Supporting quotations
Effective as of November 24, 2025
The websites flo.health, app.flo.health, and other related pages (the “Website”) are operated by Flo UK Limited. Web application and other related pages (the “Web Application”) are also operated by Flo UK Limited (hereinafter “Flo”).
At Flo, your digital safety matters a lot to us, as well as your health and well-being. Transparency is fundamental in building trustworthy relationships with you. In the spirit of transparency, this Policy provides detailed information about how and when we use cookies. This Policy applies to any product or service by Flo that links to this Policy or incorporates it by reference.
Data Access & Collection · User right or choice
Cookie consent covers related domains
Your cookie consent applies across all domains and subdomains associated with Flo’s Website and Services, including flo.health, app.flo.health, landing.flo.health, promo.flo.health and help.flo.health.
Supporting quotations
Please note that the consent you provide for the use of cookies applies to all domains and subdomains associated with our Website and Flo Services, including but not limited to flo.health, app.flo.health, landing.flo.health, promo.flo.health, and help.flo.health.
Data Access & Collection · Context
Cookies can identify you and record browsing activity
Cookies store identifiers and other information on devices and let Flo or a third party recognize you. They can collect, store and share information such as IP addresses about activity across websites, including Flo’s Website and Web Application. Flo says its cookies do not process personal health data.
Supporting quotations
Cookies are small text files that are stored in your web browser that allow us or a third party to recognize you. Cookies are used to store and receive identifiers and other information on computers, phones, and other devices. Cookies can be used to collect, store, and share bits of information, such as IP addresses, about your activities across websites, including on Flo’s Website and Web Application.
You can also change your consent to each category of cookies at any time via the cookie banner using the toggles. We also may use certain cookies on only a limited number of pages that you visit on our Website and Web Application to avoid unnecessary collection of your personal data. Please note that our cookies do not process any personal health data.
Data Access & Collection · Context
Similar device technologies count as cookies
The policy uses “cookies” to cover similar technologies that store or access information on your device, including HTML5 local storage, local shared objects, beacons, pixels and plug-ins.
Supporting quotations
However, it’s not only cookies that can be used in this way. Functions performed by a cookie can be achieved by other means, too. This Policy on cookies, therefore, also applies to any similar technology that stores or accesses information on your device. This could include, for example, HTML5 local storage, local shared objects, beacons, pixels, and plug-ins. The single term “cookies” refers to cookies and any similar technologies.
Use & Processing · Company practice
Cookies remember actions and preferences
Cookies let the Website remember settings such as login, language, font size and display preferences over time, reducing the need to enter them again when returning or moving between pages.
Supporting quotations
Cookies enable the Website to remember your actions and preferences (such as login, language, font size, and other display preferences) over a period of time, so you don’t have to keep reentering them whenever you come back to the site or browse from one page to another.
Data Access & Collection · Procedure
The cookie banner carries the latest cookie inventory
The table lists Website and Web Application cookies, but names may change. Flo says the cookie banner has the most up-to-date information. Open it through the widget, usually at the bottom left of the Website.
Supporting quotations
You can check the cookies we use on our Website and Web Application by visiting the cookie banner on the Website. Our cookie table below also sets out the cookies we use, although the names of the cookies may change over time and the cookie banner contains the most up to date information. You can access the cookie banner at any time by clicking the cookie banner widget which is usually in the bottom left corner of the Website.
Data Access & Collection · User right or choice
Banner consent changes have limits for third-party cookies
You can change optional-cookie consent using the banner toggles. The widget updates future use of Flo’s first-party cookies, and refreshing the page may be needed. Necessary cookies cannot be rejected. Previously consented third-party cookies cannot be disabled through Flo’s system: Flo directs you to delete cookies in browser settings to withdraw optional-cookie consent. Deleting or refusing cookies may limit features, preference storage or proper page display.
Supporting quotations
You can also change your consent to each category of cookies at any time via the cookie banner using the toggles. We also may use certain cookies on only a limited number of pages that you visit on our Website and Web Application to avoid unnecessary collection of your personal data. Please note that our cookies do not process any personal health data.
You can change your cookie preference at any time — including withdrawing consent to nonessential cookies that you have previously given— by clicking the cookie settings widget, which is generally in the bottom left-hand corner of the screen. Your consent will then be updated for further use for any cookies operated by Flo, as these are first-party cookies. You may need to refresh your page for your settings to take effect.
It is important to understand that if you have previously given your consent for the use of third-party cookies, you will not be able to disable them through our cookie management system. If you wish to withdraw your consent to optional cookies (including third-party cookies) or do not want certain types of cookies, you will need to delete your cookies using your internet browser settings. Most browsers allow you to manage how cookies are set and used as you are browsing and to clear cookies and browsing data.
These cookies are strictly necessary to provide you with the Website and the features you have requested, such as to allow you to log into secure areas of the Website. Because these cookies are essential for the Website and the features you have requested to work, you cannot reject them.
Please note, however, that if you delete cookies or do not accept them, you might not be able to use all of the features we offer, you may not be able to store your preferences, and some of our pages might not display properly.
Data Access & Collection · Company commitment
Flo limits some cookie use to particular pages
Flo may use certain cookies on only a limited number of pages to avoid unnecessary personal-data collection. It says its cookies do not process personal health data.
Supporting quotations
You can also change your consent to each category of cookies at any time via the cookie banner using the toggles. We also may use certain cookies on only a limited number of pages that you visit on our Website and Web Application to avoid unnecessary collection of your personal data. Please note that our cookies do not process any personal health data.
Cross-references
qualifies (model-proposed): Cookies can identify you and record browsing activity — qualifies: The general description of cookie collection and sharing is bounded by Flo’s statement that its cookies do not process personal health data. This limitation belongs in the general collection explanation.
Use & Processing · Company practice
Necessary Flo cookies maintain browsing state
The necessary-cookie table lists user_id, session_id and SESS# for state or selections across page requests, each lasting a session. visitor_id preserves visitor state and is persistent for one year. Flo also lists the session cookie 1.gif to count visits, _set_cookie to detect browser cookie acceptance, and progressScreenViewed to prevent the landing-page animation from repeating.
Supporting quotations
Necessary
Flo user_id Flo.health cookie that preserves users’ session state across page requests Session
Flo session_id Flo.health cookie that preserves users’ selections across page requests Session
Flo visitor_id Preserves the visitor’s session state across page requests Persistent 1 year
Flo 1.gif Used to count the number of sessions to the website. Session
Flo _set_cookie This cookie determines whether the browser accepts cookies Session
Flo SESS# Preserves users’ states across page requests Session
Flo progressScreenViewed It prevents repetitive display of the animation every time a user navigates to the landing page Session
Retention & Deletion · Company practice
Flo stores consent for one year and uses local storage for tests
CookieConsent stores consent for the current domain and lasts one year. Flo separately lists __ncbc local storage for A/B testing in its necessary table, without specifying an expiration for that entry. The policy includes similar device-storage technologies within “cookies.”
Supporting quotations
Flo CookieConsent Stores the user’s cookie consent state for the current domain Persistent 1 year
Flo __ncbc Local storage used for A/B test
However, it’s not only cookies that can be used in this way. Functions performed by a cookie can be achieved by other means, too. This Policy on cookies, therefore, also applies to any similar technology that stores or accesses information on your device. This could include, for example, HTML5 local storage, local shared objects, beacons, pixels, and plug-ins. The single term “cookies” refers to cookies and any similar technologies.
Security & Safeguards · Company practice
Cloudflare cookies support security and delivery
In the necessary table, Cloudflare’s __cf_bm distinguishes humans from bots and lasts one day. _cfuvid and __cfruid support services including load balancing, website-content delivery and DNS connections, and each lasts a session.
Supporting quotations
Cloudflare __cf_bm Distinguishes between humans and bots Persistent 1 day
Cloudflare _cfuvid This cookie is a part of the services provided by Cloudflare, including load-balancing, deliverance of website content and serving DNS connection for website operators. Session
Cloudflare __cfruid This cookie is a part of the services provided by Cloudflare, including load-balancing, deliverance of website content and serving DNS connection for website operators. Session
Retention & Deletion · Company practice
UserCentrics retains consent records for one year
UserCentrics is listed as the consent-management platform. Its ucString holds ControllerID, SettingsID, language, settings version and services with consent history. ucData holds consent information and ucData_{id} holds cross-domain consent information. Each entry has a one-year expiration.
Supporting quotations
UserCentrics
(consent
Management
platform)
ucString This holds the ControllerID and SettingsID, the language, settings version and services with their consent history. One year
UserCentrics
(consent
Management
platform)
ucData This holds information about user consent. One year
UserCentrics
(consent
Management
platform)
ucData_{id} (e.g ucData_a2Kvswgy3DrVCL) This holds information about user consent for cross-domain consent One year
Security & Safeguards · Company practice
Cookiebot security entries have different lifetimes
The table attributes _abck to Cookiebot for detecting and defending against replay-cookie attacks, with a 365-day duration. bm_sz helps BotManager detect, categorize and report potential bots and lasts one day. visitor_id#-hash encrypts and contains visitor data for security and lasts 365 days.
Supporting quotations
Cookiebot _abck Used to detect and defend against replay-cookie-attacks – The cookie is necessary for the security and integrity of the website. 365 days
Cookiebot bm_sz Used in context with the website's BotManager. The BotManager detects, categorizes and compiles reports on potential bots trying to access the website. 1 day
Cookiebot visitor_id#-hash Used to encrypt and contain visitor data. This is necessary for the security of the user data. 365 days
Account & Service Control · Company practice
Cookiebot session entries manage access and authentication
The table attributes these session-duration entries to Cookiebot: _zendesk_authenticated records login status to control access; _zendesk_session, _zendesk_shared_session and ASP.NET_SessionId preserve state across requests; ASPXAUTH identifies users and enables server authentication.
Supporting quotations
Cookiebot _zendesk_authenticated Registers whether the user is logged in. This allows the website owner to make parts of the website inaccessible, based on the user's log-in status. Session
Cookiebot _zendesk_session Preserves users states across page requests. Session
Cookiebot _zendesk_shared_session Preserves users states across page requests. Session
Cookiebot ASP.NET_SessionId Preserves the visitor's session state across page requests. Session
Cookiebot ASPXAUTH Identifies the user and allows authentication to the server Session
Retention & Deletion · Company practice
Cookiebot onboarding and consent entries last 365 days
Cookiebot’s cb_admin identifies system onboarding, while CrossConsent stores consent for the current domain. The table gives both a 365-day expiration.
Supporting quotations
Cookiebot cb_admin Identifies the Cookiebot system onboarding 365 days
Cookiebot CrossConsent Stores the user's cookie consent state for the current domain 365 days
Use & Processing · Company practice
Google Tag Manager supports analytics and remarketing
Listed under Statistics, Google Tag Manager’s gtmBrowserID centrally integrates tags or tracking pixels used for conversion tracking, site analytics and remarketing. Flo can assess the organized data for website improvements and remarketing campaigns. The table calls it persistent but gives no specific expiration period.
Supporting quotations
Statistics
Google Tag Manager gtmBrowserID Tag management system set by Google. Tags are small sections of codes or tracking pixels from third-party tools that can track activities for conversion tracking, site analytics, and remarketing. Via Google Tag Manager, tags can be integrated centrally via a user interface, which means all the data is perfectly organized and ready for us to assess and review for potential site improvements and remarketing campaigns. Persistent
Sharing & Disclosure · Company practice
Google Consent Mode sends limited data before consent
Google’s GCS pings adjust tags based on consent choices. The table says limited data is transmitted before consent is provided; it does not say no data is sent or define that limited data. The entry has a session duration.
Supporting quotations
Google GCS pings (Google Consent Mode) Google Consent Mode allows our tags to adjust based on your consent choices. Until consent is provided, only limited data is transmitted. Session
Data Access & Collection · Company practice
HubSpot tracking is scoped to the health-professionals page
The listed HubSpot cookies—__hssc, __hssrc, __hstc, Hubspotutk and ptq.gif—track sessions and visitors on Flo’s dedicated page for health professionals. Their row gives a persistent six-month duration; this is not stated as tracking on every Flo page.
Supporting quotations
Hubspot
__hssc
__hssrc
__hstc
Hubspotutk
ptq.gif
These cookies are set by HubSpot to track user sessions and visitors to our dedicated page for health professionals. Persistent 6 months
Use & Processing · Company practice
Flo stores a region for localization; Google distinguishes visitors
Flo’s user_region stores location or region to provide localized content or services, with a one-year duration. Google’s _gid distinguishes visitors and generates statistics about Website use, with a two-day duration.
Supporting quotations
Flo user_region Used to store information about a user’s geographic location or region. Flo uses this information to provide localized content or services to the user based on their location. Persistent 1 year
Google _gid Used to distinguish visitors and generate statistical data on how visitors use our Website Persistent 2 days