Article content

A class-action lawsuit alleging Flo Health, a menstrual-period tracking app alleged to have intentionally violated the privacy of its users despite promises it wouldn’t share their information, has been certified in the B.C. Supreme Court.

The proposed class is made up of more than one million Canadian users across the country, except those in Quebec, who used the app between June 1, 2016, and Feb. 23, 2019, according to a reasons for judgment released Friday.

Article content

Article content

Now that the proposed lawsuit has been certified, lawyers can now request company documents for the pre-trial examination of discovery phase, said co-counsel Richard Parsons on Friday.

Women who used the app entered “sensitive personal health information relating to their reproductive system,” Justice Lauren Blake wrote under the “undisputed background facts” heading of her ruling.

The interactive app tracks the start of a woman’s period, her cycle, preparation for conception, pregnancy, early motherhood and menopause, and prompts for personal data such as how often they have sex, their weight, mood and bodily functions, she said.

Users signed a standard consent form saying it collected their name, email address, gender, date of birth, password as well as weight, body temperature and activities and that Flo would respect their privacy.

The policy said also it would share certain personal information with third-party vendors, including Facebook and Google, in an anonymous format only and those vendors would supply Flo with software applications, it said.

Article content

Article content

But a Wall Street Journal article on Feb. 22, 2019, found sensitive information on apps such as Flo’s was sent with a “unique advertising identifier” that could be matched to a user’s device or profile.

These chunks of code, called software development kits, are imbedded in apps, and in exchange, the apps get analytical tools that help them to track their users to show investors or advertisers who they reach, said Parsons.

The apps also share their data with the makers of the kits, which the ruling called an “industry-wide practice,” so they can collect data to sell targeted advertising.

The day after the Post article, Flo amended its privacy policy to say it will “never share your personal data with any third parties” and it issued a statement denying the Post findings.

It said “Flo has never sold any data point to Facebook” or used sensitive data collected through Facebook Analytics for advertising. It said it used the analytics tool, “as many other apps do,” to offer the best experience for its users, the ruling said.

But it also said it had deleted the Facebook kit from the app and asked it to delete all user data from the analytics tool, the ruling said.

Article content

Two years later, the U.S. Federal Trade Commission announced after an investigation that it had settled with Flo for misleading consumers about the confidentiality of their personal data. It said a complaint alleged Flo disclosed health data from millions of users worldwide to third parties, including Facebook and Google analytics divisions.

Flo neither admitted nor denied the allegations, except those included in the FTC decision. It was ordered by the FTC to have any third party that received the health information to destroy it.

There have been two class-action lawsuits filed in the U.S. and Google had asked a California federal judge to dismiss one, claiming data it received from Flo was not used for advertising, marketing, ads modelling, machine learning or Google’s own purposes, according to the topclassactions.co website.

The California lawsuit noted “the gravity of these data privacy violations cannot be overstated.”

And Blake wrote: “The ever-increasing modern capacity to capture, store and retrieve information in our digital age has led to a corresponding need for the legal capacity to protect privacy.”

Article content

He said the violations of privacy “continue to evolve” and “must continue to be addressed by our courts.”

The representative plaintiff for the Canadian lawsuit, Jaime Cah Kate Lam, wasn’t available for comment but in her affidavit she said when she was trying to conceive, she was prompted by the Flo affidavit to input personal data, including her vaginal secretions and ovulation tests.

“I consider the information that it asked me for to be deeply personal,” she said. And she was “deeply offended” learning those details weren’t kept private because “I take my online privacy seriously.” She was “shocked” that Flo had share that information with Facebook and others.

Blake concluded his ruling with the conclusion that the proposed class “has met the requirements for certification, and I certify the claim as a class proceeding, and appoint Ms. Lam as the representative plaintiff.

Bookmark our website and support our journalism: Don’t miss the news you need to know — add VancouverSun.com and TheProvince.com to your bookmarks and sign up for our newsletters here.

You can also support our journalism by becoming a digital subscriber: For just $14 a month, you can get unlimited access to The Vancouver Sun, The Province, National Post and 13 other Canadian news sites. Support us by subscribing today: The Vancouver Sun | The Province.

Article content