Health App Data Sharing Lawsuits: Flo, Natural Cycles, and MyChart Pixel Claims

These cases share one theme: health information people typed into an app or patient portal allegedly flowed to advertising and analytics companies through embedded code, such as a software development kit (SDK) or a tracking pixel, without the users' consent.

Flo period tracker

Frasco v. Flo Health, Inc., No. 3:21-cv-00757-JD, is pending before Judge James Donato in the Northern District of California. Users alleged that when they logged menstrual cycles and pregnancy information in the Flo Period and Ovulation Tracker, the app shared that data with Google, Meta (then Facebook), and the analytics company Flurry through their SDKs, despite Flo's promises to keep it private. The class covers U.S. users from November 1, 2016 to February 28, 2019.

Natural Cycles

S.A. v. NaturalCycles USA Corporation, No. 3:25-cv-10421-WHO, was filed December 4, 2025 in the Northern District of California by four anonymous plaintiffs. Natural Cycles is a fertility tracking and digital birth control app cleared by the FDA. The complaint alleges it told users it protects their privacy while using tracking tools that shared personal and reproductive health data with third parties for advertising, in violation of state privacy laws.

MyChart and hospital tracking pixels

MyChart is a patient portal made by Epic that many hospitals run on their own websites. Starting in 2022, patients sued dozens of health systems for placing the Meta Pixel or similar tracking code on their websites and portal login pages, which allegedly sent details like appointment requests, doctors searched, and conditions to Meta or Google. Patients also filed a consolidated case against Meta itself, In re Meta Pixel Healthcare Litigation, in the Northern District of California. These are separate cases for each hospital, and most are brought as a proposed class action on behalf of that system's patients. See our pages on the Atrium Health and Henry Ford Health privacy settlements for examples.

Except where a jury has ruled, these are allegations, and the companies deny wrongdoing.

Flo, Google, and Flurry settled. The settlement fund is $59.5 million: $48 million from Google, $8 million from Flo, and $3.5 million from Flurry. Flo settled on the eve of trial, and Meta chose to go to trial.

On August 1, 2025, a San Francisco federal jury found Meta violated the California Invasion of Privacy Act by recording Flo users' communications about their periods and ovulation. On September 17, 2025, Judge Donato denied Meta's post-trial motions to set aside the verdict and decertify the class. Plaintiffs have argued for statutory damages under CIPA, which is $5,000 per violation, for the California class. The court had not announced a final damages award as of the latest reports we found. Any money from Meta would come through a separate process, not the current claim form.

The Flo settlement is our main open claim on this topic. Our Flo settlement page has filing details.

Flo nationwide class: you used the Flo app in the United States between November 1, 2016 and February 28, 2019, and entered menstruation or pregnancy information during that time.

Flo California subclass: you also lived in California during the class period and used the app while there. These members receive two shares.

You are not eligible for the Flo settlement if you opted out during the 2025 class notice, whose opt-out deadline was July 20, 2025, or if you used Flo only after February 2019.

Natural Cycles: no class has been certified. The proposed class centers on users whose reproductive health data was shared through trackers. There is nothing to file.

MyChart and hospital pixels: each case covers patients of one health system during specific years. For example, the Cone Health settlement in Singh v. The Moses H. Cone Memorial Hospital Operating Corp., No. 1:24-cv-00558 (M.D.N.C.), covers people who accessed Cone Health's MyChart portal or submitted a form on its website between September 1, 2016 and November 3, 2022. The Cone Health claim and opt-out deadline is October 5, 2026.

If your hospital is not listed anywhere, it may not have been sued, or its case may still be pending. Our guide on how to know if you qualify explains how to check.

Flo payments are pro rata. After court-approved attorney fees, expenses, administration costs, and service awards come out of the $59.5 million fund, the rest is divided among valid claims, with California subclass members counted twice. Payments under $1 are not issued. The per-person amount will not be known until claims close and the court rules on fees.

The laws involved explain why these cases draw attention:

• California Invasion of Privacy Act: $5,000 per violation under Penal Code § 637.2 in statutory damages, without proof of actual damages. This is the law the jury found Meta violated.
• California Confidentiality of Medical Information Act: nominal damages of $1,000 per person for certain negligent releases of medical information, plus actual damages.
• Federal wiretap law: the Electronic Communications Privacy Act allows statutory damages in some interception cases.

Hospital pixel settlements have generally been smaller per person than those statutory figures, because classes run into the hundreds of thousands or millions of patients. For how funds get split, see how class action money is divided. Nothing here guarantees a payment.

Most people assume HIPAA protects this data. It often does not give you a way to sue. HIPAA applies to health care providers, health plans, and their business associates, and it has no private right of action. Period and fertility apps like Flo and Natural Cycles are usually not covered by HIPAA at all.

So these cases rely on other laws:

1. State wiretap laws such as the California Invasion of Privacy Act, which bar recording or intercepting communications without consent.
2. State medical privacy laws such as California's Confidentiality of Medical Information Act.
3. The federal Electronic Communications Privacy Act, which has an exception that can be lost when data is intercepted for a criminal or tortious purpose, a theory used in hospital pixel cases.
4. Consumer protection and contract claims based on privacy promises.

The FTC also polices health apps. It settled with Flo in 2021 over the same data sharing and has used its Health Breach Notification Rule against other apps. FTC actions do not usually pay individuals directly. Our VPPA explainer covers a related tracking law used when videos are involved.

Hospitals rarely announce pixel use on their own, but there are ways to find out whether your health system was involved:

• Look for a notice. Many hospitals that found tracking code on their sites sent patients breach-style notices by mail or email, often in 2022 and 2023.
• Search for a settlement site using your hospital's name plus "pixel settlement." Court-approved sites name the case, the court, and the class period, like the Cone Health site does.
• Check the dates. Pixel settlements usually cover a window of years ending when the hospital removed the code. Cone Health's covers September 1, 2016 to November 3, 2022.
• Remember the portal and the public site differ. Some settlements cover only the MyChart login and portal pages, while others also cover appointment forms and searches on the public website.

In December 2022, the federal health privacy office at HHS issued guidance warning hospitals that tracking technologies on patient-facing pages can disclose protected health information. That guidance helped fuel many of these suits, though a federal court later struck down part of it. Either way, HIPAA does not let patients sue directly, so the lawsuits rely on state privacy and wiretap laws.

If you are not sure whether you used a hospital's MyChart portal, check your email for MyChart activation messages or appointment reminders, which often show the health system's name and the year you signed up. If your hospital settled and the deadline passed, you generally cannot file late. If your hospital has never been sued, an attorney can tell you whether a claim is still possible.

• Flo claims: file online by 11:59 p.m. Pacific time on October 15, 2026, or mail a claim postmarked by that date.
• Flo final approval hearing: October 29, 2026.
• Cone Health pixel settlement: claims and opt-outs due October 5, 2026.
• Natural Cycles: no deadline yet; staying in the proposed class is automatic.
• Your own lawsuit: statutes of limitations for privacy claims can be short, as little as one year for some state wiretap claims, so talk to an attorney promptly if you are considering an individual case.

1. File your Flo claim if you used the app from November 2016 through February 2019. Use only the official Period Tracker Data Privacy Litigation settlement website named in the court notice. You can file even without the Unique ID and PIN.
2. Confirm California residency if you lived there, since that doubles your share.
3. Check your hospital. Search the name of your health system with "pixel settlement" and make sure any site you use is the court-approved administrator.
4. Review app permissions on any health app you still use, and turn off ad tracking on your phone. Read an app's privacy policy for words like "advertising partners" or "analytics providers" before logging sensitive health details, and prefer apps that store data only on your device.
5. Never pay to file. See our guide to settlement scams.

Our guide on how to file a settlement claim covers the steps. If you used Natural Cycles or a hospital portal and want to know whether you have a claim, independent attorneys who handle health privacy cases can review it. A free case review takes about two minutes.