While trying to conceive in late 2019, Alexandra M., 34, an editor in New York City, was tracking her menstrual cycle using the femtec app Clue. After a positive test, she downloaded the pregnancy app, the Bump. Only the app and her husband knew she was pregnant, but later, scrolling through Instagram, she saw a bunch of Buy Buy Baby ads. She wondered: how could they know?

The platform Alexandra used is just a fraction of the more than 1,000 period and pregnancy trackers downloaded by millions of women worldwide. Because these apps handle sensitive medical information, many might assume that their information is protected. They are wrong. The only information protected by the Health Insurance Portability and Accountability Act (HIPAA) is information that is shared with health care providers and health plans. Anything I put into a period-tracking app can be sold," says Michelle Richardson, director of the Center for Democracy and Technology's Privacy and Data Project. And marketers and insurance companies are paying big bucks to take advantage of it."

Professor Lori Andrews of Chicago-Kent College of Law has the research to prove it: her team installed tracking devices that monitor 600 medical apps (some of which collect physiological data), the majority of which (like users' prescriptions) can identify individuals They found that most were sending personally identifiable information (like users' prescriptions) to both app developers and marketing firms. In addition, a Norwegian government report that evaluated 10 apps, including Clue, found that all of them shared user data with advertisers and marketing companies, and a Consumer Reports Digital Lab study found that four more femtech apps did the same did. (Four more femtec apps did the same, according to a Consumer Reports Digital Lab study (a spokesperson for Clue said the app shares "usage data" with marketers, but "personal information and sensitive health data is not shared."); Eva Blum-Dumonte, a senior researcher at NGO Privacy International (PI), said that some apps ask invasive questions just to get information they can monetize. 'They ask questions about your sex life,' she said. One app asked questions about masturbation. "Of the 36 menstruation apps tested by PI in 2018, 61 percent transferred data to Facebook, whether or not the user had an account. If the device is shared with others, the pop-up could reveal pregnancy secrets. Andrews explains that they may not want to be seen advertising abortion doctors.

It gets even more insidious when they realize that this information could reach the workplace. Some companies require or encourage employees to use health apps, offering cash rebates or reduced premiums. The apps may claim that the information shared is unnamed ("de-identified"), but it's easy for companies to reunite users with their de-identified data. And it happens: in 2019, the pregnancy app Ovia was found to have shared de-identified information with employers. Says Andrews, "There is a real possibility that a woman could be fired for revealing [to the app] that she wants to get pregnant."

Despite being horrified, Alexandra did not stop using the app. As she points out, the app is helpful. The trade-off may be worth it. But beware: it's impossible to know what intimate information is for sale.

This article has been updated to include a statement from a Clue spokesperson.

This article originally appeared in the Fall 2020 issue of Marie Claire.

Click here to subscribe (opens in new tab)