Consumer Health Data Privacy Notice

Flo · Official agreement

Read the agreement

34 of 34 cards

Legal Rights & Agreement Rules · Context

Who this notice covers

This notice supplements Flo’s main Privacy Policy for Washington and Nevada residents. It covers health data collected through websites, social media accounts, apps, email and other online communications. Personal information used in connection with Telehealth Services is excluded from these processing descriptions; the relevant telehealth partner’s privacy notice governs that context.

Supporting quotations

This Consumer Health Data Privacy Notice applies to residents of Washington and Nevada and supplements Flo’s Privacy Policy to describe how we process consumer health data collected through our websites, social media accounts, mobile applications, and other online interactions and communications such as email (collectively, our “Services”).
The data processing activities described elsewhere in this Consumer Health Data Privacy Notice and our main Privacy Policy do not apply to the use of your personal information in connection with Telehealth Services. For information about how your personal information is collected, used, and disclosed in that context, please refer to the privacy notice or notice of privacy practices of your relevant telehealth partner.

Qualifications & exceptions

  • This notice applies to Washington and Nevada residents.

Not stated here

  • The main Privacy Policy and telehealth partners’ notices are not supplied in this document.

Legal Rights & Agreement Rules · Procedure

Effective date, archives and changes

This version states an effective date of April 9, 2026 and links to older versions. Flo may update the notice, with updates effective when posted. It asks you to check periodically and says it will contact you directly about updates when the law requires.

Supporting quotations

Effective as of 9 April 2026
If you want to see older versions of this policy, click here.
Changes: We may update this Consumer Health Data Privacy Notice from time to time. Any updated Consumer Health Data Privacy Notice will be effective when posted. Please check this Consumer Health Privacy Notice periodically for updates. If required by law, we will contact you directly to provide you with updates.

Qualifications & exceptions

  • This notice applies to Washington and Nevada residents.

Not stated here

  • Linked archived versions are not supplied; this card does not describe their terms or compare changes.

Data Access & Collection · Context

Health data includes information that suggests your health

Health Data means personal information linked or capable of being linked to you that shows or suggests past, present or future physical or mental health. The definition covers suggested health information as well as explicit health records.

Supporting quotations

Consumer health data means personal information that is linked or could be linked to you and shows or suggests your past, present, or future physical or mental health (“Health Data”).

Qualifications & exceptions

  • This notice applies to Washington and Nevada residents.

Cross-references

Data Access & Collection · Company practice

Data comes from you and connections you allow

Flo collects health data you enter into the app or provide while interacting with its Services. You may also allow connections to third-party services such as Apple HealthKit and Google Health Connect, letting Flo import health and activity data without manual logging. This notice points to the main Privacy Policy for more detail.

Supporting quotations

As described in more detail in our main Privacy Policy, we collect Health Data from the following sources:
directly from you: We collect your Health Data from you directly, such as when you input it into the App to use our Services and interact with us through your use of the Services; and
from third parties: You may also allow us to connect to third-party services, such as Apple HealthKit and Google Health Connect. This enables us to import Health Data and information about your activities into the App without the need for you to log it yourself.

Qualifications & exceptions

  • This notice applies to Washington and Nevada residents.

Not stated here

  • The linked main Privacy Policy is not supplied; its additional collection details are not assessed here.

Inference & Profiling · Company practice

Non-health information may reveal health information

Flo says it may be able to infer health information from non-health data you provide while using the Services. Information need not be entered as health data to support a health inference.

Supporting quotations

As described in our main Privacy Policy, we collect Health Data outlined below. Additionally, we may be able to infer health information from non-Health Data you provide during your use of our Services.

Qualifications & exceptions

  • This notice applies to Washington and Nevada residents.

Data Access & Collection · Company practice

App inputs may include reproductive and sexual information

Flo may collect health data you enter into the app for your selected Services: the mode selected, menstrual and pregnancy dates, cycle symptoms, perimenopause and menopause symptoms, sex-life information, sexual history, and pregnancy and ovulation test results. These are examples of information collected for the Services you select.

Supporting quotations

You remain in control of your data. We may collect Health Data that you input into the App, which includes:
Information collected as part of the Services you have selected, including: mode you have selected, menstrual cycle dates, pregnancy dates, symptoms related to your menstrual cycle, perimenopause and menopause symptoms, information relating to your sex life, sexual history, pregnancy and ovulation test results;

Qualifications & exceptions

  • This notice applies to Washington and Nevada residents.

Data Access & Collection · Company practice

App inputs may include physical and mental well-being

Health data you enter may include mood, appetite, cycle pain, discharge and flow, water intake, disease or injury, sleep, energy, skin concerns, medication including birth control and painkillers, and lifestyle or activity data.

Supporting quotations

You remain in control of your data. We may collect Health Data that you input into the App, which includes:
Your physical and mental well-being: mood, appetite, cycle-related pain, discharge, menstrual flow, water intake, disease or injury, sleep, energy levels, skin concerns, medication (including hormonal birth control and painkillers), and lifestyle/activity data;

Qualifications & exceptions

  • This notice applies to Washington and Nevada residents.

Data Access & Collection · Company practice

Connected services can supply measurements and activity

If you allow a third-party connection, including a wearable service, Flo may collect measurements and activity data you choose to share: heart rate, weight, height, calories burned, BMI, temperature, steps, sleep and other activity data.

Supporting quotations

from third parties: You may also allow us to connect to third-party services, such as Apple HealthKit and Google Health Connect. This enables us to import Health Data and information about your activities into the App without the need for you to log it yourself.
Information collected from third-party services (including wearables), including: your heart rate, weight, height, calories burned, BMI, body temperature, step count, sleep data, and other activity data you choose to share with us; and

Qualifications & exceptions

  • This notice applies to Washington and Nevada residents.

Data Access & Collection · Company practice

Symptom Checker inputs include medical and family history

Information entered into Symptom Checker may include reproductive-health symptoms, menstrual history, previously diagnosed reproductive conditions, family medical history and lifestyle data. Symptom Checker does not replace professional medical advice, diagnosis or treatment of any kind.

Supporting quotations

Information entered into our Symptom Checker*, including: common symptoms associated with reproductive health conditions, menstrual history, previously diagnosed reproductive health conditions, family medical history, and lifestyle data.
*Symptom Checker is not a substitute for professional medical advice, diagnosis, or treatment of any kind.

Qualifications & exceptions

  • This notice applies to Washington and Nevada residents.

Use & Processing · Company practice

Health data supports accounts, requested services and tailored offers

Flo uses health data to run app functions and provide tailored content, insights and materials. Uses include registering, verifying and maintaining your account; delivering requested Services; customized product and service offers, including push notifications; customer support; and checking eligibility for benefits or offers.

Supporting quotations

As described in our main Privacy Policy, we will process your Health Data to provide you with the Services including to support existing functions of the App and provide you with tailored content, insights and materials you see when you use the App. This includes using your Health Data to:
register, verify and maintain your account with us;
provide and deliver you the Services you have requested;
provide customized product and service offerings - for example, via push notifications;
respond to your comments, questions, requests and provide customer service; and
verifying member eligibility for certain benefits or offers.

Qualifications & exceptions

  • This notice applies to Washington and Nevada residents.

Not stated here

  • The linked main Privacy Policy is not supplied; this card covers only the uses stated here.

Security & Safeguards · Company practice

Health data may support security and clinical safety

To provide its Services, Flo may use health data to prevent, detect and investigate incidents affecting service availability, integrity or confidentiality; combat malicious, fraudulent or illegal activity; and review app content, feedback and complaints for clinical safety and medical accuracy.

Supporting quotations

To provide you with our Services, we may also use your Health Data for the following purposes:
Legal, safety and security reasons, such as activities to:
prevent, detect and investigate security incidents that compromise the availability, integrity or confidentiality of your Services, which may include your Health Data;
review App content, feedback and complaints raised to ensure clinical safety and medical accuracy of the App; and
protect against malicious, fraudulent or other illegal activities.

Qualifications & exceptions

  • This notice applies to Washington and Nevada residents.

Use & Processing · Company practice

Health data may improve services and prediction tools

For internal business purposes in providing Services, Flo may use health data for analytics, website and app optimization, quality control and performance improvement. It may also develop or improve algorithms and machine-learning tools for Services such as cycle predictions.

Supporting quotations

To provide you with our Services, we may also use your Health Data for the following purposes:
Internal business purposes, such as:
monitoring and improving the performance of our Services through analytics, site and application optimization and quality control;
developing and improving our algorithms or machine learning tools for Services such as cycle predictions; and

Qualifications & exceptions

  • This notice applies to Washington and Nevada residents.

Use & Processing · Company practice

Health data may be used for corporate transactions

As an internal business purpose in providing Services, Flo may use health data in corporate transactions, including acquiring another business’s assets or selling or transferring all or part of Flo.

Supporting quotations

To provide you with our Services, we may also use your Health Data for the following purposes:
Internal business purposes, such as:
relating to corporate transactions, such as if we acquire assets of another business or sell or transfer all or part of Flo;

Qualifications & exceptions

  • This notice applies to Washington and Nevada residents.

Use & Processing · Company practice

Other uses are tied to the listed limited circumstances

Flo also allows health-data use as necessary for its listed limited circumstances: legally required requests, security or safety needs under applicable law, asserting or defending legal claims, user-directed or consented disclosure, and acquisitions, transfers or reorganizations. For legally required requests, it commits to exhausting available legal remedies to challenge the request and seeking to minimize disclosure.

Supporting quotations

as necessary to fulfill the limited circumstances detailed below.
We may also disclose your Health Data under the following limited circumstances:
In response to subpoenas, court orders, or legal processes, as required by law (including to meet national security or law enforcement requirements) - we will exhaust available legal remedies to challenge such a request and will seek to limit the disclosure to the minimum necessary for the purpose. Learn more about Flo’s award-winning Anonymous Mode here;
When necessary to maintain the security and integrity of our Services or to protect the safety of any user or others, in accordance with applicable laws. In such cases, we may also delete certain personal data (e.g., resetting your password to prevent unauthorized access);
To assert our legal rights or defend against legal claims;
When you, as the user, direct or consent to the disclosure of your personal data; and
During an acquisition, business transfer, or reorganization involving any part of our business.

Qualifications & exceptions

  • This notice applies to Washington and Nevada residents.

Not stated here

  • The linked Anonymous Mode page is not supplied; its features or protection limits are not assessed here.

Use & Processing · Company practice

De-identified health data may support promotion as well as improvements

Flo may aggregate, anonymize or de-identify health data so it can no longer reasonably identify you. It may use that de-identified information to analyze trends, improve Services, and develop testimonials or other promotional materials. This permission concerns de-identified information; identifiable research and promotion are separately conditioned on explicit consent.

Supporting quotations

Aggregated, Anonymized or De-Identified Health Data
We may aggregate, anonymize, or de-identify your Health Data so it can no longer reasonably be used to identify you, and use this de-identified information to analyze trends, improve our Services, and develop testimonials or other promotional materials.
With your explicit consent, we may use or disclose your identifiable Health Data for targeted research or to feature in Flo’s promotional materials. We will contact you to request this consent. You may withdraw your consent at any time by emailing dpo@flo.health.

Qualifications & exceptions

  • This notice applies to Washington and Nevada residents.

Cross-references

  • contrast (model-proposed): Identifiable research and promotion require explicit consent — contrast: De-identified information may be used for promotional materials, while identifiable research or promotional use requires explicit consent. The distinction is identifiability, not a blanket ban on promotion.

Sharing & Disclosure · User right or choice

Identifiable research and promotion require explicit consent

Flo may use or disclose identifiable health data for targeted research or to feature in promotional materials with your explicit consent. It will contact you to request that consent. You may withdraw that consent at any time by emailing dpo@flo.health.

Supporting quotations

With your explicit consent, we may use or disclose your identifiable Health Data for targeted research or to feature in Flo’s promotional materials. We will contact you to request this consent. You may withdraw your consent at any time by emailing dpo@flo.health.

Qualifications & exceptions

  • This notice applies to Washington and Nevada residents.

Sharing & Disclosure · Company commitment

Flo says it does not sell personal or health information

For residents covered by this notice, Flo says it does not sell personal information, including health data. Health data includes information linked or linkable to you that shows or suggests past, present or future physical or mental health. This is a no-sale commitment; the notice separately permits processing by service providers and other disclosures.

Supporting quotations

We do not sell your personal information, including your Health Data.
Consumer health data means personal information that is linked or could be linked to you and shows or suggests your past, present, or future physical or mental health (“Health Data”).
This Consumer Health Data Privacy Notice applies to residents of Washington and Nevada and supplements Flo’s Privacy Policy to describe how we process consumer health data collected through our websites, social media accounts, mobile applications, and other online interactions and communications such as email (collectively, our “Services”).
We engage service providers to process your data, including Health Data, to help operate our Services, facilitate communication with you, provide the products and Services you request, and perform other app-related tasks. These companies, referred to as “processors,” are only allowed to use your Health Data in accordance with our contracts and in compliance with applicable law. For the list of the main processors we rely on, please refer to our main Privacy Policy.
We may also share your Health Data with entities within Flo’s corporate group. These include:

Qualifications & exceptions

  • This notice applies to Washington and Nevada residents.

Not stated here

  • The linked main Privacy Policy is not supplied; this card does not assess its additional terms.

Cross-references

Sharing & Disclosure · Company practice

Service providers process health data under contracts and law

Flo engages processors to operate Services, communicate with you, provide requested products and Services, and perform other app-related tasks. These processors may use health data only in accordance with Flo’s contracts and applicable law. The main Privacy Policy contains the list of main processors.

Supporting quotations

We engage service providers to process your data, including Health Data, to help operate our Services, facilitate communication with you, provide the products and Services you request, and perform other app-related tasks. These companies, referred to as “processors,” are only allowed to use your Health Data in accordance with our contracts and in compliance with applicable law. For the list of the main processors we rely on, please refer to our main Privacy Policy.

Qualifications & exceptions

  • This notice applies to Washington and Nevada residents.

Not stated here

  • The linked main Privacy Policy is not supplied; the processor names and further terms cannot be identified from this notice.

Sharing & Disclosure · Company practice

Health data may be shared within Flo’s corporate group

Flo may share health data with group entities. The listed entities are Flo Health UK Limited in the United Kingdom, its registered data controller; Flo Health Cyprus Ltd in Cyprus; Flo Health LTU UAB in Lithuania; and Flo Health NL. B.V. in the Netherlands.

Supporting quotations

We may also share your Health Data with entities within Flo’s corporate group. These include:
Flo Health UK Limited (based in the United Kingdom, and our registered data controller);
Flo Health Cyprus Ltd (based in Cyprus);
Flo Health LTU UAB (based in Lithuania); and
Flo Health NL. B.V. (based in the Netherlands).

Qualifications & exceptions

  • This notice applies to Washington and Nevada residents.

Sharing & Disclosure · User right or choice

Your permission can enable third-party data exchanges

Flo may disclose health data when you consent, including to providers such as Apple HealthKit and Google Health Connect. The notice also permits disclosure at your direction or with your consent. Separately, allowing a connection to those services enables Flo to import health and activity data into the app.

Supporting quotations

We may also disclose your Health Data when you have provided your consent - for example, third party providers like Apple HealthKit and Google Health Connect.
When you, as the user, direct or consent to the disclosure of your personal data; and
from third parties: You may also allow us to connect to third-party services, such as Apple HealthKit and Google Health Connect. This enables us to import Health Data and information about your activities into the App without the need for you to log it yourself.

Qualifications & exceptions

  • This notice applies to Washington and Nevada residents.

Security & Safeguards · Company practice

Necessary safety and security disclosures may include data deletion

Flo may disclose health data when necessary to maintain service security and integrity or protect users or others, in accordance with applicable law. In those cases it may also delete certain personal data; it gives resetting a password to prevent unauthorized access as an example.

Supporting quotations

We may also disclose your Health Data under the following limited circumstances:
When necessary to maintain the security and integrity of our Services or to protect the safety of any user or others, in accordance with applicable laws. In such cases, we may also delete certain personal data (e.g., resetting your password to prevent unauthorized access);

Qualifications & exceptions

  • This notice applies to Washington and Nevada residents.

Sharing & Disclosure · Company practice

Health data may be disclosed for legal rights or claims

Flo may disclose health data to assert its legal rights or defend against legal claims. This is a separate listed disclosure circumstance from responding to a legally required request.

Supporting quotations

We may also disclose your Health Data under the following limited circumstances:
To assert our legal rights or defend against legal claims;

Qualifications & exceptions

  • This notice applies to Washington and Nevada residents.

Sharing & Disclosure · Company practice

Business changes may involve health-data disclosure

Flo may disclose health data during an acquisition, business transfer or reorganization involving any part of its business.

Supporting quotations

We may also disclose your Health Data under the following limited circumstances:
During an acquisition, business transfer, or reorganization involving any part of our business.

Qualifications & exceptions

  • This notice applies to Washington and Nevada residents.

Sharing & Disclosure · Company practice

Telehealth data follows the partner’s separate privacy framework

If you use a telehealth partner’s services, Flo may ask for health-related information to share with that partner and help deliver the services, acting as the partner’s service provider. Flo may share your name, email, ZIP code, Flo mode and insurance provider. In some cases the information may be HIPAA Protected Health Information. Flo processes it under applicable law and its contracts, including a HIPAA business associate agreement where required. The processing descriptions elsewhere in this notice and Flo’s main Privacy Policy do not apply to this telehealth use; consult the relevant partner’s privacy notice or notice of privacy practices.

Supporting quotations

Telehealth partners
If you use services from one of our telehealth partners (“Telehealth Services”), we may ask for certain health-related information so we can share it with them and help deliver those services. In this context, Flo acts as a service provider to the telehealth partner. We may share your name, email address, ZIP code, Flo mode, and insurance provider with the telehealth partner delivering your service. In some cases, this information may be treated as Protected Health Information under the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”).
We process this information on behalf of our telehealth partner in accordance with applicable law and our contractual obligations, including, where required, entering into a HIPAA business associate agreement.
The data processing activities described elsewhere in this Consumer Health Data Privacy Notice and our main Privacy Policy do not apply to the use of your personal information in connection with Telehealth Services. For information about how your personal information is collected, used, and disclosed in that context, please refer to the privacy notice or notice of privacy practices of your relevant telehealth partner.

Qualifications & exceptions

  • This notice applies to Washington and Nevada residents.

Not stated here

  • The partner privacy notices and HIPAA text are not supplied; this notice does not establish that every Flo interaction is covered by HIPAA.

Cross-references

  • narrows (model-proposed): Who this notice covers — narrows: The telehealth partner framework expressly excludes telehealth use from the processing descriptions elsewhere in this notice and the main Privacy Policy.

Legal Rights & Agreement Rules · Company commitment

Flo promises GDPR-equivalent privacy rights regardless of residence

Although this notice is addressed to Washington and Nevada residents, Flo states a broader commitment to provide the same privacy rights afforded under the GDPR regardless of country, state or region of residence. It points to its main Privacy Policy for those rights and adds specific health-data rights in this notice. This is Flo’s stated commitment, not a finding that the GDPR legally applies to every user.

Supporting quotations

Regardless of your country, state, or region of residence, we’re committed to providing you the same privacy rights afforded under the GDPR, which is generally regarded as the highest standard for data protection globally.
In addition to the GDPR rights outlined in our main Privacy Policy, you have specific rights related to your Health Data, including the right to:
This Consumer Health Data Privacy Notice applies to residents of Washington and Nevada and supplements Flo’s Privacy Policy to describe how we process consumer health data collected through our websites, social media accounts, mobile applications, and other online interactions and communications such as email (collectively, our “Services”).

Qualifications & exceptions

  • The notice has Washington/Nevada scope, but this particular promise expressly applies regardless of residence.

Not stated here

  • The main Privacy Policy and GDPR text are not supplied; their detailed rights and conditions are not enumerated here.

Data Access & Collection · User right or choice

You can ask about collection, access your data and identify recipients

You can request confirmation that Flo collects or shares your health data and access to health data it has collected or controls. Access includes a list of all third parties and affiliates with whom Flo shared your health data and their email addresses or other online contact methods. Exercise available rights by emailing support@flo.health.

Supporting quotations

In addition to the GDPR rights outlined in our main Privacy Policy, you have specific rights related to your Health Data, including the right to:
request confirmation that we collect or share your Health Data;
request access to your Health Data that we have collected or control, including:
a list of all third parties and affiliates that we have shared your Health Data to; and
the email addresses or other online methods to contact those third parties and affiliates;
You may exercise the rights available to you by emailing us at support@flo.health.

Qualifications & exceptions

  • This notice applies to Washington and Nevada residents.

Account & Service Control · User right or choice

Withdrawing health-data consent ends access to the Services

You can withdraw consent for collection and sharing of your health data. Flo says it cannot provide its Services if you withdraw consent to process health data, and withdrawing service consent requires account deletion. You can contact support@flo.health or delete the account through the app to withdraw.

Supporting quotations

withdraw your consent for our collection and sharing of your Health Data. If you withdraw your consent to process Health Data, we will be unable to provide our Services;
When we rely on your consent to process your Health Data, you will be asked to provide it when signing up for our Services. You can withdraw your consent at any time by contacting us at support@flo.health or by deleting your account through the App.
Please note that because our Services rely on your consent, withdrawing it will require you to delete your account.

Qualifications & exceptions

  • This notice applies to Washington and Nevada residents.

Retention & Deletion · User right or choice

You can request deletion of your health data

This notice gives you a right to request deletion of your health data. You may exercise available rights by emailing support@flo.health. This passage provides a request right; it does not set a deletion deadline.

Supporting quotations

request that we delete your Health Data;
You may exercise the rights available to you by emailing us at support@flo.health.

Qualifications & exceptions

  • This notice applies to Washington and Nevada residents.

Legal Rights & Agreement Rules · Company commitment

Exercising rights should not cause discriminatory prices or service

Flo promises freedom from discriminatory treatment for exercising privacy rights. It expressly identifies Washington residents’ right and says that, wherever you are, exercising rights will not cause discriminatory pricing or reduced service quality. Prices can nevertheless change over time or depend on signup timing, so leaving and later returning can mean a different price. Separately, withdrawing consent to health-data processing prevents Flo from providing the Services and requires account deletion; the nondiscrimination promise does not remove that consequence.

Supporting quotations

be free from discriminatory treatment for exercising any of your privacy rights;
If you are a resident of Washington, you have the right not to be subjected to discriminatory treatment for exercising any of your privacy rights. No matter where you are, exercising these rights will not result in discriminatory treatment, such as different prices or a reduction in the quality of our Service;
please note: while your privacy rights will not impact the Service you receive, our pricing may vary over time or based on when you originally signed up. If you choose to stop using our Service in connection with exercising your rights and decide to return later, the price at that time may differ from your original rate; and
withdraw your consent for our collection and sharing of your Health Data. If you withdraw your consent to process Health Data, we will be unable to provide our Services;
Please note that because our Services rely on your consent, withdrawing it will require you to delete your account.

Qualifications & exceptions

  • This nondiscrimination promise expressly says it applies no matter where you are; Washington residents are also specifically identified.

Cross-references

  • contrast (model-proposed): Withdrawing health-data consent ends access to the Services — contrast: The promise against discriminatory treatment coexists with loss of Services and required account deletion on withdrawing service consent. The cards preserve both statements without treating every withdrawal consequence as discrimination.

Legal Rights & Agreement Rules · Procedure

Denied rights requests can be appealed to the DPO

To exercise available privacy rights, email support@flo.health. If Flo denies a rights-related request, you can appeal that decision by contacting dpo@flo.health.

Supporting quotations

if we deny your rights-related request, you have the right to appeal the decision by contacting us at dpo@flo.health.
You may exercise the rights available to you by emailing us at support@flo.health.

Qualifications & exceptions

  • This notice applies to Washington and Nevada residents.

Legal Rights & Agreement Rules · Procedure

Privacy questions can go to Flo or its data protection officer

For privacy questions or concerns, contact Flo or its data protection officer at support@flo.health or dpo@flo.health, or write to Flo Health, Inc., 108 W. 13th Street, Suite 100, Wilmington, DE 19801.

Supporting quotations

If you have any questions or concerns about your privacy, you may contact us or our data protection officer by writing to us at:
Flo Health, Inc.,
108 W. 13th Street,
Suite 100 Wilmington, DE 19801
Or by emailing us at support@flo.health or dpo@flo.health.

Qualifications & exceptions

  • This notice applies to Washington and Nevada residents.