Case 3:21-cv-00757-SK Document 1 Filed 01/29/21 Page 1 of 36
`
`
`
`James M. Wagstaffe (95535)
`Frank Busch (258288)
`WAGSTAFFE, VON LOEWENFELDT,
`BUSCH & RADWICK LLP
`100 Pine Street, Suite 725
`San Francisco, CA 94111
`Tel: (415) 357-8900
`Fax: (415) 357-8910
`wagstaffe@wvbrlaw.com
`busch@wvbrlaw.com
`
`
`Jonathan Gardner (pro hac vice forthcoming)
`Carol C. Villegas (pro hac vice forthcoming)
`Michael P. Canty (pro hac vice forthcoming)
`Melissa H. Nafash (pro hac vice forthcoming)
`Ross M. Kamhi (pro hac vice forthcoming)
`LABATON SUCHAROW LLP
`140 Broadway
`New York, NY 10005
`Tel: (212) 907-0700
`Fax: (212) 818-0477
`jgardner@labaton.com
`cvillegas@labaton.com
`mcanty@labaton.com
`mnafash@labaton.com
`rkamhi@labaton.com
`
`Attorneys for Plaintiff and the Proposed Class
`
`
`
`
`Christian Levis (pro hac vice forthcoming)
`Amanda Fiorilla (pro hac vice forthcoming)
`LOWEY DANNENBERG, P.C.
`44 South Broadway, Suite 1100
`White Plains, NY 10601
`Telephone: (914) 997-0500
`Facsimile: (914) 997-0035
`clevis@lowey.com
`afiorilla@lowey.com
`
`
`
`
`
`
`UNITED STATES DISTRICT COURT
`NORTHERN DISTRICT OF CALIFORNIA
`
`
`
`
`Case No.: ______________
`ERICA FRASCO, individually and on behalf of
`
`
`all others similarly situated,
`
`
`
` CLASS ACTION COMPLAINT
`
`
`
`JURY TRIAL DEMANDED
`v.
`
`
`Flo Health, Inc., a Delaware corporation.
`
`
`
`
`
`
`
`Plaintiff,
`
`Defendants.
`
`
`
`
`
`
`
`CLASS ACTION COMPLAINT AND DEMAND FOR JURY TRIAL
`CASE NO. ____________
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`

`

`Case 3:21-cv-00757-SK Document 1 Filed 01/29/21 Page 2 of 36
`
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`
`Plaintiff Erica Frasco (“Plaintiff”), on behalf of herself and all others similarly situated,
`asserts the following against Defendant Flo Health, Inc. (“Flo Health”), based upon personal
`knowledge, where applicable, information and belief, and the investigation of counsel.
`SUMMARY OF ALLEGATIONS
`Flo Health owns and develops the Flo Period & Ovulation Tracker (“Flo App” or
`1.
`“App”), one of the most popular health and fitness mobile applications.
`The Flo App purports to use artificial intelligence to provide advice and assistance
`2.
`related to women’s health, such as by serving as an ovulation calendar, period tracker, pregnancy
`guide, and wellness and lifestyle tracker.
`Flo Health touts that its app is the “#1 mobile product for women’s health.” The
`3.
`Flo App has been installed more than 165 million times and has over 38 million monthly active
`users. The App has also been rated the #1 period tracker in the United States based on active
`audience and as the #1 most downloaded health app in the Apple App Store.1
`In order to use the Flo App, millions of users—including Plaintiff—provide Flo
`4.
`Health with personally identifying information (e.g., their names, email addresses, dates of birth,
`and places of residence), along with intimate details about their sexual health, menstruation cycles,
`gynecological health, and physical well-being through a series of “survey questions.” These
`questions cover extremely personal topics and include, for example: (1) “do you experience any
`pain during sex?” (2) “how often do you have sex?” (3) “how often do you masturbate?” (4) “have
`you noticed a decrease in sexual desire?” (5) “are you sexually active during your period?” and (6)
`“What type of relationship do you have at present?”
`Users also provided intimate, personal health details in response to probing survey
`5.
`questions about health and wellness, such as: (1) “do you smoke” (2) “how often do you
`experience stress? (3) “do you want to change your weight?” (4) “do you follow a particular diet?”
`(5) “how often do you exercise?” (6) “do you get yeast infections?” (6) “do you have any chronic
`
`1 The Flo App was also feature as the “App of the Day” in the Apple App Store in over 30 countries.
`
`2
`CLASS ACTION COMPLAINT AND DEMAND FOR JURY TRIAL
`CASE NO. ____________
`
`

`

`Case 3:21-cv-00757-SK Document 1 Filed 01/29/21 Page 3 of 36
`
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`diseases?” and (7) “do you have any reproductive system diseases?”
`Within the first few minutes of using the Flo App, users answer over thirty survey
`6.
`questions like these. As users continue to use the app, they are encouraged by Flo Health to
`provide more and more intimate health data, including daily information about whether they have
`their period, their weight, how long they slept, whether they had sex (as well as their sex drive, if
`sex was unprotected, or if they masturbated), their mood (ranging from “calm” to “very self-
`critical,”) and if they have any health symptoms (like headaches, breast tenderness, acne, or
`fatigue).
`By providing this information, Flo Health claims to predict ovulation, aid in
`7.
`pregnancy and childbirth, and provide lifestyle and wellness suggestions, allowing users to “take
`full control of [their] health.”
`Plaintiff and Class members provided this information to Flo Health based on the
`8.
`company’s repeated assurances that their intimate health data would remain protected and
`confidential and would not be disclosed to third parties.
`Flo Health’s privacy policies and public assurances have claimed—time and time
`9.
`again—that Flo Health would not share users’ intimate health data with anyone. Flo Health’s
`website touts that “[p]rivacy in the digital age is of utmost importance. Flo provides a secure
`platform for millions of women globally.”2
`Similarly, Flo Health’s privacy policy states, in all capital letters, that it “WILL
`10.
`NOT TRANSMIT ANY OF YOUR PERSONAL DATA TO THIRD PARTIES, EXCEPT IF IT
`IS REQUIRED TO PROVIDE THE SERVICE TO YOU (E.G. TECHNICAL SERVICE
`PROVIDERS), UNLESS WE HAVE ASKED FOR YOUR EXPLICIT CONSENT.” Flo Health
`assured users that these third parties would not receive “survey results,” “information regarding
`your marked cycles, pregnancy, symptoms, notes” or information about “which articles [users]
`view” i.e., users’ intimate health data. Flo Health further assured users that these third parties
`“will never use such information for any other purpose except to provide services in connection
`
`2 About Us, FLO HEALTH, INC., https://flo.health/our-mission (last visited Jan. 27, 2021).
`
`3
`CLASS ACTION COMPLAINT AND DEMAND FOR JURY TRIAL
`CASE NO. ____________
`
`

`

`Case 3:21-cv-00757-SK Document 1 Filed 01/29/21 Page 4 of 36
`
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`with the App.”3
`These assurances were patently false. In February 2019, a report published by the
`11.
`Wall Street Journal revealed that, despite Flo Health’s promises that it would not share intimate
`health data, Flo Health had spent years disclosing the intimate health data that users entered into
`the Flo App to dozens of third parties, including major advertising companies such as Facebook,
`Inc. (“Facebook”) and Google, LLC (“Google”), who were free to use this data for their own
`purposes.
`In response to this revelation, the Federal Trade Commission (“FTC”) launched its
`12.
`own investigation into Flo Health’s data privacy and disclosure practices and ultimately filed a
`complaint, charging Flo Health with making a variety of fraudulent misrepresentations to Flo App
`users in violation of their privacy rights.
`On January 13, 2021, Flo Health entered into a settlement with the FTC that
`13.
`prohibited Flo Health from further misrepresenting the purposes for which or entities to whom it
`discloses users’ intimate health data, as well as obtain an independent review of its privacy policy,
`obtain user consent before sharing their data, and notify third parties that previously received
`users’ intimate health data to destroy that information.4
`If Plaintiff and Class members had known that Flo Health would share their
`14.
`intimate health data, they would not have used the Flo App.
`Flo Health’s data disclosure practices constitute an extreme invasion of Plaintiff
`15.
`and Class members’ right to privacy and violates federal and state common law.
`JURISDICTION AND VENUE
`This Court has jurisdiction over the subject matter of this action pursuant to 28
`16.
`U.S.C § 1332(d), because the amount in controversy for the Class exceeds $5,000,000 exclusive of
`
`
`3 Privacy Policy, FLO HEALTH, INC., https://flo.health/privacy-policy-archived/may-25-2018 (effective
`May 25, 2018).
`4 Developer of Popular Women’s Fertility-Tracking App Settles FTC Allegations that it Mislead Consumers
`About the Disclosure of their Health Data, FTC, (Jan. 13, 2021), https://www.ftc.gov/news-events/press-
`releases/2021/01/developer-popular-womens-fertility-tracking-app-settles-ftc.
`
`4
`CLASS ACTION COMPLAINT AND DEMAND FOR JURY TRIAL
`CASE NO. ____________
`
`

`

`Case 3:21-cv-00757-SK Document 1 Filed 01/29/21 Page 5 of 36
`
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`interest and costs, there are more than 100 putative class members defined below, and minimal
`diversity exists because a significant portion of putative class members are citizens of a state
`different from the citizenship of Defendants.
`This Court also has jurisdiction over the subject matter of this action pursuant to 28
`17.
`U.S.C. § 1331 since this suit is brought under the laws of the United States, i.e., the Stored
`Communications Act, 18 U.S.C. § 2702, et seq., and supplemental jurisdiction pursuant to 28
`U.S.C. § 1367 over the remaining state common law and statutory claims as these state law claims
`are part of the same case or controversy as the federal statutory claim over which the Court has
`original jurisdiction.
`This Court has specific personal jurisdiction over Flo Health because it consented
`18.
`to jurisdiction in this District in its Terms of Use, which states:
`
`Any dispute arising from this Agreement shall be governed by the laws of the State
`of California without regard to its conflict of law provisions. SOLE AND
`EXCLUSIVE JURISDICTION FOR ANY ACTION OR PROCEEDING
`ARISING OUT OF OR RELATED TO THIS AGREEMENT SHALL BE IN
`AN APPROPRIATE STATE OR FEDERAL COURT LOCATED IN SAN
`FRANCISCO COUNTY, STATE OF CALIFORNIA . . . .5
`Venue is proper in this District pursuant to 28 U.S.C. §1391(b), (c), and (d) because
`19.
`Flo Health transacts business in this District and a substantial portion of the events giving rise to
`the claims occurred in this District.
`Intra-district Assignment: A substantial part of the events and omissions giving rise
`20.
`to the violations of law alleged herein occurred in the County of San Francisco, and as such, this
`action may properly be assigned to the San Francisco or Oakland divisions of this Court pursuant
`to Civil Local Rule 3-2(c).
`
`PARTIES
`
`A.
`21.
`
`Plaintiff
`Plaintiff Erica Frasco (“Plaintiff”) is a natural person and citizen of the State of
`
`
`5 Terms of Use, FLO HEALTH, INC., https://flo.health/terms-of-service (effective Feb. 5, 2020).
`5
`CLASS ACTION COMPLAINT AND DEMAND FOR JURY TRIAL
`CASE NO. ____________
`
`

`

`Case 3:21-cv-00757-SK Document 1 Filed 01/29/21 Page 6 of 36
`
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`New Jersey and a resident of Passaic County.
`Plaintiff Frasco downloaded the Flo App from the Apple app store in 2017 and has
`22.
`been an active user ever since.
`Plaintiff Frasco has provided Flo Health with her intimate health data, including
`23.
`questions about her health and wellness, menstruation cycle, and sexual activity in response to Flo
`Health’s survey questions.
`Plaintiff Frasco has continued to provide Flo Health with her intimate health data
`24.
`while using the Flo App, including personal details about her menstruation cycle and symptoms.
`Plaintiff Frasco believed that her intimate health data would stay private and that
`25.
`Flo Health would not disclose this information to third parties, like Facebook or Google. Plaintiff
`Frasco did not consent or provide permission for Flo Health to do so.
`In direct contravention to its privacy policy and public assurances, Flo Health
`26.
`disclosed Ms. Frasco’s intimate health data without her knowledge or consent to third parties.
`Plaintiff Frasco would not have used the Flo App if she had known that they would
`27.
`share her intimate health data with third parties.
`B.
`Defendant
`28.
`Defendant Flo Health, Inc. is a Delaware corporation with principal executive
`offices located at 1013 Centre Road, Suite 403-B, Wilmington, Delaware 19805.
`FACTUAL BACKGROUND
`Founding of Flo Health, Inc.
`Flo Health began as a startup in 2015 owned by a group of mobile app developers
`29.
`based in Minsk, Belarus. That same year, the company released the Flo App, the first mobile
`application to make use of artificial intelligence to accurately predict reproductive cycles.
`30. When first launched, the Flo App operated essentially as a calendar that allowed
`users to track their period and ovulation. Over time, the App’s developers expanded the Flo App’s
`functionality to assist with all phases of the reproductive cycle, including the start of menstruation,
`cycle tracking, preparation for conception, pregnancy, early motherhood, and menopause. The Flo
`
`I.
`
`6
`CLASS ACTION COMPLAINT AND DEMAND FOR JURY TRIAL
`CASE NO. ____________
`
`

`

`Case 3:21-cv-00757-SK Document 1 Filed 01/29/21 Page 7 of 36
`
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`App also expanded to provide users overall health and wellness suggestions.
`As Flo App’s features expanded, the App requested a wider and wider range of
`31.
`personal information from its users, including intimate personal details like a user’s history of
`contraceptive methods, vaginal discharge, diseases, water intake, weight, pains and other physical
`or mental symptoms, mood swings, and sexual activity (including the users’ sexual desire levels,
`whether they experience pain during sex, or did not use protection). Users can also write “personal
`notes” to log additional information in the App.
`In 2017, Flo Health further expanded Flo App’s functionality to include social
`32.
`media features alongside its services as a health product. The App’s developers included a new
`community section on the App, allowing users to anonymously ask and answer questions related
`to women’s health.
`That same year, Flo Health gained international attention by working with the
`33.
`United Nations Population Fund as part of its “Let’s Talk About it. Period.” campaign, which
`aimed to increase public awareness of social and health issues related to menstruation.
`Throughout this period, Flo App steadily grew more popular. By December 2020,
`34.
`150 million users had downloaded the App. The App has been rated #1 period tracker in the
`United States based on active audience and as the #1 most downloaded health app in the Apple
`App Store.
`Through its success, Flo Health has gathered and collected intimate health details
`35.
`from over 100 million users, including Plaintiff. Users provided this information based on Flo
`Health’s repeated assurances that this information would remain private and that they would not
`share users’ intimate health data.
`Flo Health promised that it would, under no circumstances, share users’ intimate
`36.
`health data without user consent. While Flo Health disclosed it might share “certain” information
`with third-parties who it uses to “supply software applications, web hosting an other technologies
`for the App,” Flo Health promised this would not include “information regarding your marked
`cycles, pregnancy, symptoms, notes and other information entered by [users]” or “survey results”
`
`7
`CLASS ACTION COMPLAINT AND DEMAND FOR JURY TRIAL
`CASE NO. ____________
`
`

`

`Case 3:21-cv-00757-SK Document 1 Filed 01/29/21 Page 8 of 36
`
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`and “articles [users] view.”
`However, in February 2019, the Wall Street Journal released a bombshell report
`37.
`revealing for the first time that Flo Health shares its users’ intimate health data with third-parties,
`like Facebook and Google, including when a user was on their period or intended to get pregnant.6
`Further investigations have revealed that Facebook was not the only third-party to
`38.
`which Flo Health disclosed consumers’ intimate health data. Between at least 2016 and 2019, Flo
`Health contracted with dozens of third-party firms to provide, among other things, various
`marketing and analytics services in connection with the Flo App. These firms included Facebook,
`Google, and mobile analytics firms AppsFlyer Ltd. (“AppsFlyer”) and Flurry, Inc. (“Flurry”).
`Despite Flo Health’s representations that third parties would not receive users’
`39.
`survey results and “information regarding your marked cycles, pregnancy, symptoms, notes and
`other information entered by [users],” Flo Health disclosed users’ intimate health data to third
`parties, including some of the largest advertising companies in the country.
`Further, despite Flo Health’s promise that third parties would only receive data “as
`40.
`necessary to perform their work” and “will never use such information for any other purpose
`except to provide services in connection with the App,” Flo Health did not contractually limit how
`these third parties could use this data.
`In fact, the terms of service governing Flo Health’s agreement with these third
`41.
`parties allowed them to use the data for their own purposes, completely unrelated to services
`provided in connection with the App.
`Flo Health entered into these contracts to disclose users’ sensitive health data
`42.
`without Plaintiff’s and Class members’ knowledge or consent, in violation of their privacy rights
`and federal law.
`
`
`
`6 Sam Schechner and Mark Secada, You Give Apps Sensitive Personal Information. Then They Tell
`Facebook, WALL STREET JOURNAL, (Feb. 22, 2019 11:07 AM), https://www.wsj.com/articles/you-give-
`apps-sensitive-personal-information-then-they-tell-facebook-11550851636.
`
`8
`CLASS ACTION COMPLAINT AND DEMAND FOR JURY TRIAL
`CASE NO. ____________
`
`

`

`Case 3:21-cv-00757-SK Document 1 Filed 01/29/21 Page 9 of 36
`
`
`
`II.
`
`Flo Health Designed its App to Facilitate the Collection of Users’ Private Data
`Flo Health designed the Flo App to request users to input intimate health and
`43.
`lifestyle-related information under the guise that they would receive better services. When a user
`creates a new account on the Flo App, the app will ask the user several question related to the
`timing of their menstrual cycle, the discomfort of their menstrual cycle, mood swings, preferred
`birth control methods, reproductive health disorders, and their level of satisfaction with their sex
`life and romantic relationships. Some of these questions are reflected in the example screenshots
`below:
`
`
`
`
`
`9
`CLASS ACTION COMPLAINT AND DEMAND FOR JURY TRIAL
`CASE NO. ____________
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`

`

`Case 3:21-cv-00757-SK Document 1 Filed 01/29/21 Page 10 of 36
`
`
`
`
`
`The Flo App asks users to input over 30 responses to intimate, personal questions
`44.
`like these all while setting up the App for the first time, including the following:
`How long have you been trying to conceive?
`a.
`b.
`Do you have any reproductive diseases?
`c.
`What medication are you currently taking? How often?
`d.
`How often do you have sex?
`e.
`Do you experience any pain during sex?
`f.
`How often do you masturbate?
`g.
`Is it easy for you to orgasm?
`
`10
`CLASS ACTION COMPLAINT AND DEMAND FOR JURY TRIAL
`CASE NO. ____________
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`

`

`Case 3:21-cv-00757-SK Document 1 Filed 01/29/21 Page 11 of 36
`
`
`
`The Flo App also regularly encourages users to update the App with vast quantities
`45.
`of additional intimate health-related information as they continue to use the App. For example, the
`interface of the Flo App suggests that users “[l]og your menstruation days in a handy period
`calendar, ovulation and fertility tracker, schedule menstrual cycle reminders, record moods and
`PMS symptoms, use a due date calculator, follow a pregnancy calendar . . . .” As the screenshots
`below demonstrate, the information collected is extremely sensitive and includes information
`about a user’s sexual activity, sex drive, mood, premenstrual systems, and vaginal discharge,
`among other things:
`
`
`
`
`Flo Health entices users to input this information to “stay on top of [their] health,”
`46.
`explaining that “[l]ogging symptoms helps Flo detect possible imbalances in your body and
`
`11
`CLASS ACTION COMPLAINT AND DEMAND FOR JURY TRIAL
`CASE NO. ____________
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`

`

`Case 3:21-cv-00757-SK Document 1 Filed 01/29/21 Page 12 of 36
`
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`advi[s]e you to see a doctor.”
`By encouraging millions of users to provide extensive information about their
`47.
`emotional and physical health, as well as their personal lifestyles and sexual activity, to the Flo
`App, Flo Health has collected massive volumes of deeply intimate health data about millions of
`consumers, including Plaintiff.
`Despite Flo Health’s repeated representations from 2017 to 2019 that it would
`48.
`protect users’ intimate private information, Flo Health contracted with numerous third parties
`granting them full access to any information obtained from Flo App users, which they could use
`for their own purposes, including advertising and product improvement unrelated to the Flo App.
`Specifically, Flo Health provided third parties with “Standard App Events” and
`49.
`“Custom App Events” created each time users interact with the Flo App. “Standard App Events”
`are records of routine app functions, such as launching or closing the app, while “Custom Apps
`Events,” are records of user-app interactions unique to the app itself. For example, when a user
`enters menstruation dates, their weight, sleep cycle, mood, physical or mental symptoms, or any
`other information in the Flo App, the Flo App registers the user’s interaction with that feature as a
`Custom App Event. Through these Custom App Events, every single interaction within the Flo
`App is recorded and stored.
`Flo Health receives and stores a record of all the Custom App Events that occur in
`50.
`the Flo App across its users’ devices. Flo Health claims to make use of these records to improve
`the Flo App’s functionality and identify which features are likely to interest new users.
`Flo Health purposefully designed the Custom App Events of the Flo App to have a
`51.
`descriptive title. For example, when a user enters the week of their pregnancy into the app’s
`calendar, the Flo App records the Custom App Event “R_PREGNANCY_WEEK_CHOSEN.”
`When a user selects a feature to receive menstruation reminders in the “wanting to get pregnant
`branch”
`of
`the
`app,
`the
`Flo App
`records
`the Custom App
`Event
`“P_ACCEPT_PUSHES_PERIOD.”
`As early as 2016, Flo Health integrated software development tools, known as
`52.
`
`12
`CLASS ACTION COMPLAINT AND DEMAND FOR JURY TRIAL
`CASE NO. ____________
`
`

`

`Case 3:21-cv-00757-SK Document 1 Filed 01/29/21 Page 13 of 36
`
`
`
`“software development kits” (“SDKs”) into the Flo App. These SDKs were provided by third-
`party marketing and analytics firms, such as Facebook, Google, Flurry and AppsFlyer, and
`allowed these firms to review information that users put into the Flo App through Custom App
`Events.
`As a consequence of the way that Flo Health titles the Custom App Events of the
`53.
`Flo App, the Custom App Events convey intimate details about a users’ health, including their
`menstruations, fertility, or pregnancies. Thus, a Flo Health developer or third party reviewing a
`record of a user’s Custom App Events learns intimate health information about that user, including
`their reproductive cycle and family planning decisions.
`By including intimate health information in the title of the Custom App Events, Flo
`54.
`Health disclosed user’s intimate health information to third parties. This directly contradicts Flo
`Health’s statements in its privacy policies that it would not disclose this information.
`Despite assurances made to consumers, the company spent years disclosing the
`55.
`intimate health information of millions of users in the form of Custom App Events. For example,
`Flo Health disclosed Custom App Event information to:
`Facebook from at least June 2016 to February 2019;
`a.
`
`b.
`
`c.
`
`d.
`
`Google from at least September 2018 to February 2019.
`e.
`Flo Health’s Failure to Obtain User Consent
`Between 2017 and 2019, Flo Health made repeated representations to Flo App
`56.
`users, promising that it would keep intimate health data they entered into the App private, and that
`Flo Health would only use Flo App users’ data in order to provide and improve Flo App’s
`services.
`57.
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`III.
`
`Flurry from at least June 2016 to February 2019;
`
`Google’s subsidiary Fabric from at least November 2016 to February 2019;
`
`AppsFlyer from at least May 2018 to February 2019; and
`
`Based on Flo Health’s representations and the guarantees made in the company’s
`
`13
`CLASS ACTION COMPLAINT AND DEMAND FOR JURY TRIAL
`CASE NO. ____________
`
`

`

`Case 3:21-cv-00757-SK Document 1 Filed 01/29/21 Page 14 of 36
`
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`Privacy Policy, millions of users entrusted Flo Health with intimate information regarding their
`physical and mental health, romantic relationships, sex life, and lifestyle preferences.
`Flo Health’s privacy policy assures customers that “[w]hen you use Flo, you are
`58.
`trusting us with intimate personal information. We are committed to keeping that trust, which is
`why our policy as a company is to take every step to ensure that individual user’s data and privacy
`rights are protected . . . .”7
`59. More specifically, the Flo Health privacy policy, effective between August 28,
`2017 and February 19, 2019, stated that Flo Health “may share certain” personal data with third
`parties, but only “information that is reasonably necessary to perform their work” which involves
`“supply[ing] software applications, web hosting, and other technologies for the App.”8
`The same Flo Health privacy policy stated that any information shared with third
`60.
`parties “exclud[ed] information regarding your marked cycles, pregnancy, symptoms, notes
`and other information that is entered by you and that you do not elect to share.” (emphasis
`added).9
`The same Flo Health privacy policy stated that third parties could not use Flo App
`61.
`users’ personal information “for any other purpose except to provide services in connection with
`the App.”10
`Furthermore, later versions of the Flo Health privacy policy, effective between May
`62.
`25, 2018 and February 19, 2019, specifically stated that Flo Health would not disclose “any data
`related to health” to either of the mobile analytics firms AppsFlyer or Flurry:11
`
`a.
`
`“AppsFlyer is a mobile marketing platform. We may share certain non-
`identifiable information about you and some Personal Data (but never any
`
`7 Privacy Policy, FLO HEALTH, INC., https://flo.health/privacy-policy (effective Oct. 24, 2020).
`8 Privacy Policy, FLO HEALTH, INC., https://flo.health/privacy-policy-archived/aug-28-2017 (effective Aug.
`28, 2017).
`9 Id.
`10 Id.
`11 Privacy Policy, FLO HEALTH, INC., https://flo.health/privacy-policy-archived/may-25-2018 (effective
`May 25, 2018).
`
`14
`CLASS ACTION COMPLAINT AND DEMAND FOR JURY TRIAL
`CASE NO. ____________
`
`

`

`Case 3:21-cv-00757-SK Document 1 Filed 01/29/21 Page 15 of 36
`
`
`
`data related to health) in order to carry out marketing activities and
`provide you better and more targeted, tailor-made service.” (emphasis
`added)
`
`
`b.
`
`“We may share certain non-identifiable information about you and some
`Personal Data (but never any data related to health) with Flurry.”
`Consistent with the assurances made in the Flo Health privacy policy, new users of
`63.
`the Flo App receive a notification, informing them that personal data disclosed to AppsFlyer is
`“strictly limited” to technical identifiers, age groups, subscription status, and data indicating that
`the App has been opened by the user.
`
`
`
`64.
`
`Flo Health’s privacy policy made similar assurances regarding Facebook, Google,
`
`15
`CLASS ACTION COMPLAINT AND DEMAND FOR JURY TRIAL
`CASE NO. ____________
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`

`

`Case 3:21-cv-00757-SK Document 1 Filed 01/29/21 Page 16 of 36
`
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`and Google’s subsidiary Fabric. The privacy policy stated that these third parties would only
`receive “non-personally identifiable information,” “[p]ersonal Data like device identifiers,” or
`“device identifiers.” The Privacy Policy did not indicate that these third parties would receive
`access to any record of the Custom App Events (containing intimate health data) registered by the
`Flo App.12
`65.
`
`Specifically, the Flo Privacy Policy stated as follows:
`
`a.
`
`
`b.
`
`“We use Facebook Analytics and Google Analytics tools to track installs of
`our App. Normally, Facebook and Google collect only non-personally
`identifiable information, though some Personal Data like device
`identifiers may be transferred to Facebook ....” (emphasis added).
`
`“Fabric may use device identifiers that are stored on your mobile device
`and allow us to analyze your use of the App in order to improve our app
`feature [sic].” (emphasis added).
`
`By disclosing Custom App Events that users generated through interacting with the
`66.
`Flo App, Flo Health consistently violated these terms of its Privacy Policy. As explained above,
`Custom App Events include explicit, intimate health data related to a user’s reproductive cycles,
`fertility, and other health-related information. When Flo Health shared access to Custom App
`Events with third parties, Flo Health disclosed intimate “data related to health.”
`Flo Health further violated the guarantees made in its Privacy Policy by agreeing to
`67.
`contractual terms that directly contradicted its Privacy Policy. When entering into contracts with
`numerous third parties, Flo Health agreed to boilerplate terms of service which permitted the third
`party to use any information obtained from Flo App users for the third party’s own purposes,
`including purposes explicitly excluded by the Flo Privacy Policy, such as advertising and
`marketing:
`
`a.
`
`Facebook’s Business Tools Terms stated: “We use [aggregated] Event Data
`to personalize
`the
`features
`and
`content
`(including
`ads
`and
`recommendations) we show people on and off our Facebook Company
`Products .... We may also use Event Data ... for research and development
`purposes, and to ... improve the Facebook Company Products.” That “Event
`
`
`12 Id.
`
`16
`CLASS ACTION COMPLAINT AND DEMAND FOR JURY TRIAL
`CASE NO. ____________
`
`

`

`Case 3:21-cv-00757-SK Document 1 Filed 01/29/21 Page 17 of 36
`
`
`
`
`b.
`
`
`c.
`
`
`d.
`
`Data” includes Custom App Events.
`
`Google Analytics’s Terms of Service stated: “Google and its wholly owned
`subsidiaries may retain and use ... information collected in [Flo Health’s]
`use of the service.”
`
`AppsFlyer’s Terms of Use stated: “You hereby allow AppsFlyer to collect,
`store, use and process Customer Data,” where “Customer Data” was
`defined to include “data concerning the characteristics and activities” of app
`users.
`
`The Fabric Software and Services Agreement stated: “[Flo Health]
`acknowledges and agrees that Google [Fabric] may use Usage Data for its
`own business purposes,” where “Usage Data” was defined to mean “all
`in