A state privacy supplement effective November 13, 2025
This notice supplements Flo’s main Privacy Policy for residents of certain U.S. states. It covers personal data collected through websites, social media accounts, mobile apps and other online interactions and communications, including email. Its stated effective date is November 13, 2025.
Supporting quotations
Effective as of 13 November 2025
This notice applies if you are a resident of certain U.S. states and supplements Flo’s Privacy Policy to describe how we personal data collected through our websites, social media accounts, mobile applications, and other online interactions and communications such as email (collectively, our “Services”).
Not stated here
The main Privacy Policy is linked but not supplied in this analysis; this notice does not give an exhaustive list of covered states.
Legal Rights & Agreement Rules · Company practice
Updates take effect when posted
Flo may update this notice from time to time. Changes take effect when posted; Flo will contact you directly with updates if the law requires it.
Supporting quotations
Changes: We may update this notice from time to time, and any update will be effective when posted. If required by law, we will contact you directly to provide you with updates.
Legal Rights & Agreement Rules · Company commitment
Privacy rights depend partly on where you live
Flo commits to offering the same privacy rights afforded under the GDPR regardless of country, state or region of residence. This supplement says additional, more specific rights may depend on your state, giving California, Colorado, Oregon and Delaware as examples. The details of GDPR rights in the linked main Privacy Policy are outside this supplied document.
Supporting quotations
Regardless of your country, state, or region of residence, we’re committed to providing you the same privacy rights afforded under the GDPR, which is generally regarded as the highest standard for data protection globally.
In addition to GDPR rights offered in our main Privacy Policy, you may have more specific rights – depending on which state you live in (such as California, Colorado, Oregon, or Delaware). You can exercise your rights using our interactive chatbot, available on our Website or by emailing us at support@flo.health. We will not discriminate against you for exercising your privacy rights.
Legal Rights & Agreement Rules · Procedure
How to exercise your privacy rights
You can use the website’s interactive chatbot or email support@flo.health to exercise applicable privacy rights. Flo says it will not discriminate against you for doing so. To process a request, it collects information needed to verify your identity, such as your email address, User ID or information about the request.
Supporting quotations
In addition to GDPR rights offered in our main Privacy Policy, you may have more specific rights – depending on which state you live in (such as California, Colorado, Oregon, or Delaware). You can exercise your rights using our interactive chatbot, available on our Website or by emailing us at support@flo.health. We will not discriminate against you for exercising your privacy rights.
To process your rights requests, we will collect information necessary to verify your identity (such as your email address, User ID, or information about your request).
Legal Rights & Agreement Rules · User right or choice
Ask what data Flo holds and how it is used or shared
Subject to the state-dependent rights described in this notice, you can request categories and specific sets of personal data collected about you, its sources, collection purposes, information about sharing, and who received your data and why. Oregon residents can also request a specific list of third parties to whom Flo discloses their personal data.
Supporting quotations
In addition to GDPR rights offered in our main Privacy Policy, you may have more specific rights – depending on which state you live in (such as California, Colorado, Oregon, or Delaware). You can exercise your rights using our interactive chatbot, available on our Website or by emailing us at support@flo.health. We will not discriminate against you for exercising your privacy rights.
Right to Know. You can request information about:
the categories of personal data we have collected about you (you can also ask for the specific sets of personal data we have collected about you);
the sources from which we collected the personal data;
the purposes for collecting;
sharing personal data;
to whom we have disclosed your personal data and why; and
if you are an Oregon resident, you can also request a specific list of third parties to whom we disclose your personal data.
Legal Rights & Agreement Rules · User right or choice
Ask Flo to delete your personal data
The notice lists a right to ask Flo to delete your personal data among the additional rights that may depend on your state. This is a request right; the supplied notice does not set out the full deletion procedure or exceptions in the linked main Privacy Policy.
Supporting quotations
In addition to GDPR rights offered in our main Privacy Policy, you may have more specific rights – depending on which state you live in (such as California, Colorado, Oregon, or Delaware). You can exercise your rights using our interactive chatbot, available on our Website or by emailing us at support@flo.health. We will not discriminate against you for exercising your privacy rights.
Right to Delete. You can ask us to delete your personal data.
Legal Rights & Agreement Rules · User right or choice
Ask Flo to correct inaccurate data
Among the rights that may depend on your state, the notice says you can ask Flo to correct inaccurate personal data it has about you.
Supporting quotations
In addition to GDPR rights offered in our main Privacy Policy, you may have more specific rights – depending on which state you live in (such as California, Colorado, Oregon, or Delaware). You can exercise your rights using our interactive chatbot, available on our Website or by emailing us at support@flo.health. We will not discriminate against you for exercising your privacy rights.
Right to Correct. You can ask us to correct inaccurate personal data that we have about you.
Sharing & Disclosure · User right or choice
Opt out through Your Privacy Choices
Depending on your applicable rights, you may opt out of sale, sharing and targeted advertising by selecting “opt out” in “Your Privacy Choices” on Flo’s website. Nevada residents may email support@flo.health to inquire about their right to opt out of a sale. Flo’s statement that it does not sell or rent data for monetary gain does not exclude disclosures treated as sales or sharing under state laws.
Supporting quotations
Right to Opt Out of Sale, Sharing, and Targeted Advertising. You may have the right to opt out of these activities, which you can do by accessing “Your Privacy Choices” on our Website and selecting “opt out.” Nevada residents: Individuals may contact us at support@flo.health to inquire about your right to opt out of the “sale” of your personal data.
Please be aware we do not sell or rent your data for monetary gain.
Under certain state laws (for example, California), disclosure of personal information to third parties may be deemed a “sale”. This is because those laws broadly define “sale” and “sharing” to include disclosure of personal data for any benefit – such as analytics, marketing activities, or other business purposes – even if money is not exchanged and the third party does not use the personal information for any other purpose.
No monetary sale still allows legally defined sharing
Flo says it does not sell or rent your data for monetary gain. It explains that certain state laws, including California’s, may treat disclosures for benefits such as analytics, marketing or other business purposes as a sale or sharing, even without payment and even if the recipient uses the information for no other purpose.
Supporting quotations
Please be aware we do not sell or rent your data for monetary gain.
Under certain state laws (for example, California), disclosure of personal information to third parties may be deemed a “sale”. This is because those laws broadly define “sale” and “sharing” to include disclosure of personal data for any benefit – such as analytics, marketing activities, or other business purposes – even if money is not exchanged and the third party does not use the personal information for any other purpose.
Sharing & Disclosure · Company commitment
Flo says it does not knowingly sell minors’ data
Flo states that it does not knowingly “sell” data about minors. The commitment is qualified by knowledge; this sentence does not specify an age cutoff.
Supporting quotations
We do not knowingly “sell” data about minors.
Sharing & Disclosure · Company commitment
Recognized opt-out signals work at browser level
Flo says it will honor opt-out preference signals in commonly used and recognized formats. It processes those signals at the browser level; this statement does not promise an account-wide opt-out across other browsers or devices.
Supporting quotations
We will honor opt-out preference signals sent in a format commonly used and recognized, and will process opt-out preference signals at the browser level.
Cross-references
qualifies (model-proposed): Opt out through Your Privacy Choices — qualifies: Recognized preference signals provide an opt-out mechanism processed at browser level, alongside the website control.
Legal Rights & Agreement Rules · Procedure
An agent can request access, deletion or correction
You can appoint an authorized agent to submit a Right to Know, Delete or Correct request by emailing support@flo.health. Flo will ask the agent to verify their authority and may contact you directly to verify your identity or obtain your permission for the request.
Supporting quotations
Authorized Agents: You can appoint an authorized agent to submit a Right to Know, Delete, or Correct request on your behalf by emailing support@flo.health. If you do this, we will ask the agent to verify that they are authorized to act on your behalf. We may reach out to you directly to verify your identity or to permit the request from the agent.
Cross-references
qualifies (model-proposed): How to exercise your privacy rights — qualifies: Agent requests for access, deletion or correction require verification of authority and may require direct verification or permission from the user.
Legal Rights & Agreement Rules · User right or choice
A denied rights request may be appealed
If Flo denies your rights request, you may have a right to appeal by emailing support@flo.health. Flo says it will respond in writing; the notice does not specify an appeal deadline or response period.
Supporting quotations
Appeal: If we deny your rights request, you may have the right to appeal by contacting us at support@flo.health. We will respond in writing.
Use & Processing · Company commitment
Processing remains subject to the main Privacy Policy
For the services covered by this state supplement, Flo says your data is processed in accordance with its Privacy Policy at all times. The linked policy is not supplied here, so its additional processing rules and vendor list are outside this analysis.
Supporting quotations
Your data is processed in accordance with our Privacy Policy at all times. This section provides information about how we process your personal data.
This notice applies if you are a resident of certain U.S. states and supplements Flo’s Privacy Policy to describe how we personal data collected through our websites, social media accounts, mobile applications, and other online interactions and communications such as email (collectively, our “Services”).
Not stated here
The linked main Privacy Policy is not supplied here, so its additional processing rules and named vendor list cannot be described from this source.
Sharing & Disclosure · Company practice
Non-health data may be shared for advertising and other purposes
Flo says it does not sell or rent personal data for monetary gain, but may disclose personal data other than health information in ways state laws treat as a sale, sharing or targeted advertising. Such laws can cover benefits other than money. The listed recipients include website cookie and tracking providers, advertisers, advertising platforms and networks, and social media platforms. Applicable opt-outs are available through “Your Privacy Choices” on the website; Nevada residents can email support@flo.health to inquire.
Supporting quotations
We do not sell or rent your personal data for monetary gain. We may disclose your personal data (note: this does not include your health information) to third parties which may constitute a “sale,” “sharing,” or “targeted advertising as those terms are broadly defined under U.S. state laws, as discussed above.
Categories of third parties with whom we share:
third parties whose cookies and other website tracking technologies we use;
advertisers, ad platforms and networks, and social media platforms;
Under certain state laws (for example, California), disclosure of personal information to third parties may be deemed a “sale”. This is because those laws broadly define “sale” and “sharing” to include disclosure of personal data for any benefit – such as analytics, marketing activities, or other business purposes – even if money is not exchanged and the third party does not use the personal information for any other purpose.
Right to Opt Out of Sale, Sharing, and Targeted Advertising. You may have the right to opt out of these activities, which you can do by accessing “Your Privacy Choices” on our Website and selecting “opt out.” Nevada residents: Individuals may contact us at support@flo.health to inquire about your right to opt out of the “sale” of your personal data.
Sharing & Disclosure · Company practice
Corporate transactions and consent can involve disclosures
Within the notice’s sharing discussion, Flo lists disclosures connected with an acquisition, transfer, business reorganization or other corporate transaction, and disclosures to other third parties based on your explicit consent. The preceding description excludes health information from the disclosures it says may count as sale, sharing or targeted advertising.
Supporting quotations
We do not sell or rent your personal data for monetary gain. We may disclose your personal data (note: this does not include your health information) to third parties which may constitute a “sale,” “sharing,” or “targeted advertising as those terms are broadly defined under U.S. state laws, as discussed above.
in connection with an acquisition, transfer, business reorganization, or other corporate transaction;
other third parties, based on your explicit consent; and/or
Sharing & Disclosure · Company commitment
Flo promises to challenge legally required disclosure requests
Flo lists disclosures to parties where required by law. It says it will exhaust available legal remedies to challenge such a request and seek to limit disclosure to the minimum needed for the purpose. This is not a promise that no legally required disclosure will occur.
Supporting quotations
parties where required by law – we will exhaust available legal remedies to challenge such a request and will seek to limit the disclosure to the minimum necessary for the purpose.
Sharing & Disclosure · Company commitment
Vendors receive data to help provide the service
Flo shares personal data with vendors to help provide its services. It says it remains fully accountable for their actions and omissions and requires strict contractual and regulatory obligations before engaging them. A vendor and business-purpose recipient list is linked in the main Privacy Policy, which is not supplied here.
Supporting quotations
We also share your personal data with our vendors to help us provide our Services. We remain fully accountable for their actions and omissions, and we require them to comply with strict contractual and regulatory obligations before we engage them. You can find a list of the vendors and third parties we share personal data with for business purposes in our main Privacy Policy.
Not stated here
The linked main Privacy Policy is not supplied here, so its additional processing rules and named vendor list cannot be described from this source.
Sharing & Disclosure · Company commitment
Health data is excluded from third-party marketing sharing
Flo says it does not share health information with third parties for marketing. This purpose limit does not mean health data never leaves Flo: the notice separately lists health and well-being information you choose to enter among the data disclosed to service providers to provide the service.
Supporting quotations
Please note, we do not share your health information with third parties for marketing purposes.
We disclose personal data to service providers to provide our Service, this includes:
sensitive information, including health and well-being data that you choose to input into the App, such as menstrual cycle dates and symptoms, pregnancy and details relating to your pregnancy, perimenopause and menopause symptoms, wellness and mental well-being information, and information concerning your sex life.
Cross-references
contrast (model-proposed): Health and physical records may go to service providers — contrast: The ban on third-party marketing use of health information coexists with disclosure of voluntarily supplied health information to service providers for service provision.
Sharing & Disclosure · Company practice
Service providers receive identifiers and service-use data
To provide the service, Flo discloses to service providers identifiers and general details such as a supplied name or nickname, birth year, age, language and email address; commercial data such as subscription information; and network or device data such as device information, device ID and IP address.
Supporting quotations
We disclose personal data to service providers to provide our Service, this includes:
identifiers and other general information, such as the name or nickname you may provide to us, year of birth, age, language and email address;
commercial information, such as subscription information;
internet or other electronic network activity, such as device information, device ID and IP address;
Sharing & Disclosure · Company practice
Health and physical records may go to service providers
For service provision, Flo discloses records you choose to provide, such as weight, height, water intake, sleep duration, temperature, heart rate, fitness activity and physical characteristics. It also discloses sensitive health and well-being data you choose to enter, including menstrual dates and symptoms, pregnancy details, perimenopause and menopause symptoms, wellness, mental well-being and sex-life information. Flo separately says it does not share health information with third parties for marketing.
Supporting quotations
We disclose personal data to service providers to provide our Service, this includes:
records about you, such as, weight, height, water intake, sleep duration, body temperature, heart rate, fitness activities and physical characteristics if you choose to provide it;
sensitive information, including health and well-being data that you choose to input into the App, such as menstrual cycle dates and symptoms, pregnancy and details relating to your pregnancy, perimenopause and menopause symptoms, wellness and mental well-being information, and information concerning your sex life.
Please note, we do not share your health information with third parties for marketing purposes.
Sharing & Disclosure · Company practice
Approximate location is used; precise location is excluded
The data Flo discloses to service providers to provide the service includes non-precise location, such as an IP address used to approximate location and set the app’s time zone and language. Flo says it does not collect or share precise geolocation.
Supporting quotations
We disclose personal data to service providers to provide our Service, this includes:
non-precise geolocation information, such as IP address for an approximate location to set time zone and language so that users receive the correct version of the App. We do not collect or share precise geolocation;
Inference & Profiling · Company practice
Service providers may receive inferred gender
Among data disclosed to service providers to provide the service, Flo lists inferences about you, including gender inferred from your use of the services.
Supporting quotations
We disclose personal data to service providers to provide our Service, this includes:
inferences about you, including gender as inferred by your use of the Services; and
Sharing & Disclosure · User right or choice
California residents can opt out of certain direct-marketing sharing
California residents may opt out of sharing personal data covered by California Civil Code §1798.83, the “Shine the Light law,” with third parties for those parties’ direct marketing. The notice offers its website chatbot or support@flo.health for exercising rights. The cited law itself is not supplied here.
Supporting quotations
California Shine the Light: If you are a California resident, you may opt out of sharing your personal data subject to California Civil Code §1798.83 (the “Shine the Light law”) with third parties for those third parties’ direct marketing purposes.
In addition to GDPR rights offered in our main Privacy Policy, you may have more specific rights – depending on which state you live in (such as California, Colorado, Oregon, or Delaware). You can exercise your rights using our interactive chatbot, available on our Website or by emailing us at support@flo.health. We will not discriminate against you for exercising your privacy rights.
Legal Rights & Agreement Rules · User right or choice
California minors can seek removal of their posts
California residents under 18 who posted content or information on Flo’s website or app can delete their posts and comments on others’ posts or email support@flo.health to request removal. Identify where the material appears and confirm you posted it. Flo promises reasonable efforts to remove it from public view or anonymize it as legally required, but cannot promise complete removal, including copies republished or archived by third parties outside its control.
Supporting quotations
California Eraser Law: If you are a California resident under the age of 18 who has posted content or information on our Website or App, you can delete your posts and comments on other posts, or request removal of the information by contacting us at support@flo.health. Let us know where the content or information is posted, and confirm that you posted it. We will make reasonable efforts to remove the post from public view or anonymize it so you cannot be identified, as required by law. We can’t promise complete or comprehensive removal. For example, third parties may have republished or archived content that we do not control.
Charges & Financial Obligations · User right or choice
Survey and promotion incentives require consent
Flo sometimes offers benefits or incentives for surveys or promotions. Personal data may be collected and retained as part of participation, which may qualify as a financial incentive or price or service difference under the California Consumer Privacy Act. Flo will seek consent before participation, and you may withdraw it at any time.
Supporting quotations
Sometimes we offer benefits, and other incentives to you when you engage in surveys or promotions. Your personal data may be collected and retained, and that may be a “financial incentive” or “price or service difference” under the California Consumer Privacy Act. We will request your consent before participation, and you may withdraw it at any time if you change your mind.
Charges & Financial Obligations · Company practice
Flo values incentive data at the value of the benefit offered
For survey and promotion incentives, Flo may collect identifiers, protected-class and demographic information, survey responses, commercial information and preferences, and internet activity and device information. Flo’s good-faith estimate values the data at the benefit offered; the notice says you agree the benefits are reasonably related. Participation requires consent that can be withdrawn at any time.
Supporting quotations
Sometimes we offer benefits, and other incentives to you when you engage in surveys or promotions. Your personal data may be collected and retained, and that may be a “financial incentive” or “price or service difference” under the California Consumer Privacy Act. We will request your consent before participation, and you may withdraw it at any time if you change your mind.
We may collect: identifiers; protected class and demographic information; responses to survey questions, commercial information and preferences; and internet or other electronic network activity information and device information. Our good-faith estimate of the value of your personal data is the value of the benefit we offer to you. You agree that the benefits are reasonably related.
Cross-references
qualifies (model-proposed): Survey and promotion incentives require consent — qualifies: The incentive program specifies possible data categories and its valuation while retaining prior consent and withdrawal.
Legal Rights & Agreement Rules · Procedure
Contact Flo or its Data Protection Officer
For privacy questions or concerns, write to Flo Health, Inc., 108 W. 13th Street, Suite 100 Wilmington, DE 19801. You can also email support@flo.health or contact the Data Protection Officer at dpo@flo.health.
Supporting quotations
If you have any questions or concerns about your privacy, you may contact us or our Data Protection Officer by writing to us at:
Flo Health, Inc.,
108 W. 13th Street,
Suite 100 Wilmington, DE 19801
Or by emailing us at support@flo.health or by contacting our Data Protection Officer at dpo@flo.health.