Logging your period, ovulation or symptoms in an app means handing over health data, a special category under the EU’s General Data Protection Regulation. This guide examines what Clue, Flo and Apple’s Health app say in their own documentation about how they handle your data, what European law guarantees you, and which settings you can actually change, from Flo’s anonymous mode to keeping everything on the device.
- Health data, special rules: The GDPR treats cycle tracking as health data and bans processing it without explicit consent or another narrow exception.
- Flo’s FTC settlement: In 2021, the US Federal Trade Commission finalized an order over allegations that Flo shared sensitive health data with Facebook and Google despite privacy promises.
- Three privacy models: Flo relies on anonymous architecture, Clue on separate consent toggles and EU servers, and Apple on on-device encryption.
What you log is health data, and the law treats it that way
The GDPR defines health data in Article 4 as personal data revealing information about a person’s physical or mental health. Article 9 prohibits processing it, along with data on sex life, unless an exception applies; the first is explicit consent for specific purposes.
Clue’s privacy policy, updated on 29 September 2026, shows how far that category reaches. According to the company, the health data it may process includes period length, pain or spotting and, depending on what you log, weight, body temperature, hair quality or sexual activity. On top of that come device data and your IP address, which Clue uses to estimate your approximate location, though it says it does not collect precise location.
Clue bases that processing on consent under Article 9.2.a of the GDPR, and consent-based processing can be withdrawn. To find out what a company holds about you, you can use the GDPR right of access.
The Flo case: when a cycle app shared data
The reference case is Flo Health in the United States. In January 2021, the Federal Trade Commission (FTC) published an administrative complaint alleging that, despite promising to keep health data private, Flo had shared the data of millions of users with marketing and analytics companies, including Facebook and Google. On 22 June 2021, the FTC finalized its order against the company by four votes to none, with the agency chair abstaining.
The order requires Flo to obtain users’ affirmative consent before sharing their health data, to submit its privacy practices to an independent review, to notify affected users and to ask third parties that received the data to destroy it. These are allegations resolved by settlement, not a court conviction, and the case was handled under US law, not the GDPR.
The Flo case remains the sector’s benchmark: it showed the risk was not theoretical, and today these apps devote entire paragraphs to explaining what they do not share with advertisers.
Privacy options in Clue, Flo and Apple Health
Flo: a genuine anonymous mode, with fine print
The company offers a free Anonymous Mode to all users, with or without a subscription. According to Flo, in that mode your health data is not linked to your name, email or IP address. It achieves this with the Oblivious HTTP protocol (OHTTP, described in standard RFC 9458): your data travels encrypted through an intermediary, Cloudflare, which sees your IP but cannot read the content, while Flo receives the content without knowing whose it is. Flo adds post-quantum encryption and publishes the code on GitHub.
Flo also sets the terms in writing: enabling anonymous mode is permanent, cannot be undone and the old account cannot be recovered. Some features that need to identify you, such as partner mode, become unavailable. Flo accelerated the launch after the US Supreme Court ruling that overturned Roe v. Wade.
Clue: European data and toggles you can switch off
Clue says it uses only Amazon Web Services data centres in the European Union and encrypts what it stores. Its policy separates uses with dedicated switches: analysis of health data to improve predictions and features, personalized AI features and product recommendations all rest on consents you can disable in the privacy settings. The company says health data is never shared or sold to advertisers, although, if you accept it in the privacy settings, it shares technical events such as installs or subscriptions with networks like Meta and TikTok via Adjust. It also acknowledges that its messaging provider, Braze, processes some health data in pseudonymized form and that this service cannot be switched off.
Apple Health: encryption on the device, and you decide what leaves it
The iPhone’s Health app includes cycle tracking. According to Apple’s privacy page, when the device is locked with a passcode, Touch ID or Face ID, health and activity data, except the medical ID, is encrypted and inaccessible. If iCloud is enabled, Health backs up to the cloud by default, encrypted in transit and at rest; with iOS 12 or later and two-factor authentication, Apple says it cannot read that data, and you can turn off Health backups in iCloud settings. Third-party apps must ask your permission, and you can revoke it at any time. One nuance: some Health features that use Apple Intelligence may send analyses of your data to Apple’s private cloud compute, which the company says does not store them.
What to do in practice with your cycle app
- Review which consents you have given and disable the ones you do not need. In Clue, for example, improvement analysis, AI and recommendations are optional.
- Deny ad tracking when the system asks: on iOS, Clue only enables it if you accept.
- Consider anonymous mode if your priority is that no one can link the data to you, knowing it cannot be reversed.
- If you want nothing to leave the phone, the iPhone Health app without iCloud backup and without sharing with third-party apps is the most contained option of the three examined.
- Check which apps access your health data and, before installing another, verify whether an app is trustworthy on Google Play and the App Store.
- Have a plan for a breach. No privacy policy prevents an attack; if your data appears in one, follow the steps for what to do when your data is in a leak.
One note on Spain: we found no specific AEPD guidance on these apps, but the GDPR applies all the same, and the Agency is the authority to complain to.
The conclusion from comparing the three sets of documentation is that the useful question is not only whether an app sells your data, but who can link that data to your name. Flo answers with architecture, Apple with on-device encryption and Clue with separate consents and European servers. Yet the default setting is almost never the most private one, and in an app where you record sexual activity or a possible pregnancy, ten minutes reviewing checkboxes pays for itself.