SURVEILLANCEData Privacy After Dobbs: Is Period Tracking Safe?
Many people think all health care information is protected under the federal privacy law, known as HIPAA. But menstrual cycle tracking apps, along with other health care technologies, like texting platforms that patients can use with doctors, are not. There haven’t been any cases where a menstrual tracking app’s data has been subpoenaed yet, but that’s probably due to the slow speed of which cases proceed through the court system.
After the Supreme Court overturned the constitutional right to abortion in 2022 and abortion was banned in the state of Tennessee, Dr. Danielle Kelvas quit using an app that tracked her menstrual cycle.
“It frightened me. … I actually got frightened because it tracked me for, like, a week,” Kelvas said of the Oura Ring feature Cycle Insights. “And I thought, where’s this information going?”
Immediately following the Dobbs V. Jackson Supreme Court decision which struck down the constitutional right to abortion, data privacy experts cautioned to take a closer look at menstrual cycle tracking apps. Information logged into these apps, or tracked via wearable devices like a Fitbit or an Oura Ring, have the potential to be used in prosecuting those who seek abortions in states which criminalize it.
Kelvas, a former emergency room physician, is a big fan of her Oura Ring. She researched the device — which gives insight to users about their biometric data like heart rate and sleep quality — thoroughly before buying it.
When the company rolled out its menstrual tracking feature, called Cycle Insights, she was excited to try it. But when she started reading more into the terms of agreement, she couldn’t find clear cut information about how the data was stored, how secure it was, or if it was encrypted.
States Newsroom reached out to Oura for clarification on its privacy policy for Cycle Insights, but the request for comment was not returned.
Kelvas, 34, lives in Chattanooga, Tennessee, where abortion is banned, with only the exception of preventing death for the expectant person. The law, a trigger ban that went into effect in August 2022, also makes obtaining or performing an abortion a criminal offense.
“So I deleted it,” Kelvas said of the app.
Opal Pandya is in the same boat. The 25-year old Philadelphian deleted the app Flo, after reading case studies about data releases to external third parties. She also took note when she started suddenly getting targeted ads on Instagram for products that would help soothe period symptoms she’d just logged in Flo.
“I realized my data was flowing across multiple platforms,” she said.
She didn’t feel comfortable with that, and didn’t have the time to figure out who had access to that data. The final straw was learning that third-party data could be available to states in prosecuting abortions banned under their laws.
