Privacy and your health information
Sharing cycle or health details with an app is common, and there are rules about what happens to that information: in the US, health apps and connected devices that HIPAA does not cover fall under the FTC's Health Breach Notification Rule. In plain terms, the duties sit with the company that makes the app or device, not with you, so it's worth knowing which rule an app sits under before you decide how much to share.
Does HIPAA protect reproductive health information?
HIPAA still applies to reproductive health records in the same way it applies to other health records. What they do not have is the extra layer of protection that a 2024 rule would have added, because a federal court set that rule aside nationwide on June 18, 2025 (Holland & Knight, 2025). If you'd like to know how your own records are handled, it's worth asking your doctor's office for its privacy notice.
HIPAA is a US law. In the UK, health information is handled under UK GDPR and the Data Protection Act 2018, where it is treated as special category data.
Are period trackers covered by the FTC rule?
Some are, though the Federal Trade Commission's 2024 guidance does not name period trackers. Whether a cycle-tracking app is covered turns on whether it counts as a personal health record, which is why two apps that look alike can be treated differently. A practical way to tell is to look in the app's privacy policy for whether the company says it follows HIPAA or the FTC rule. Where the FTC rule does apply, a company can face civil penalties of up to $53,088 per violation.
Can an app fall under both HIPAA and the FTC rule?
The Federal Trade Commission's 2024 guidance treats the two as separate: apps that HIPAA already covers are excluded, and the FTC rule exists for the health apps and connected devices that HIPAA does not reach. So an app you download yourself is not automatically under HIPAA just because it holds health details, and its privacy policy is the place to check. For anyone who'd like to know who writes these pages, there is more about the site.
Next steps
A good place to start is the privacy policy (often called a privacy notice in the UK) of any app where you log cycle or health details. From there, many women find it helpful to look at the app's sharing settings and to delete entries or accounts they no longer want kept. Privacy is not one size fits all, so how much you share, and with which apps, is yours to decide.
Sources
The guidelines and studies this page draws on.
- Complying with FTC's Health Breach Notification Rule, Federal Trade Commission (2024)
- HIPAA's Reproductive Health Rule Is Vacated Nationally (summarising Purl v. HHS, No. 2:24-CV-228-Z), Holland & Knight (2025)