What happened to everyone else's data

I read thirteen privacy enforcement cases this year. Health apps, mostly. The details blur after a while, but the shape of every case is the same. A company promises, in plain friendly language, that your health data stays private. Then the data quietly goes somewhere else.

The record

GoodRx told users it would never share health information with advertisers. Then it piped medication and condition data to Facebook, Google, and Criteo through tracking pixels. The FTC fined it $1.5 million in 2023, the first enforcement of the Health Breach Notification Rule.

BetterHelp promised discretion and sent emails, IP addresses, and mental-health intake answers to Facebook, Snapchat, Criteo, and Pinterest. $7.8 million in refunds to around 800,000 customers.

Premom, a fertility app, shared sexual and reproductive health data, pregnancy status, and location with Google, AppsFlyer, and two China-based analytics firms, despite its privacy promises. $200,000 in combined federal and state penalties.

Flo, the period tracker, was accused of sharing sensitive reproductive-health information with Meta, Google, and Flurry through software kits, despite its privacy promises. Google, Flo, and Flurry agreed to settlements totalling $59.5 million. Meta didn't settle, and a jury found it liable in August 2025. Settlements aren't the same thing as admissions of liability.

The FTC alleged that Cerebral disclosed sensitive information from nearly 3.2 million consumers, including medical and prescription histories, to third parties such as LinkedIn, Snapchat, and TikTok. Its order required nearly $5.1 million in consumer refunds and $2 million of a $10 million civil penalty, with the remainder suspended.

Monument promised users their data was "100% confidential" and sent it to Meta, Google, and nine others. $2.5 million, suspended because the company couldn't pay.

The pattern

Every one of these is promise versus practice.

A company said one thing in the privacy policy and did another thing in the code, usually through the same off-the-shelf advertising tools everyone installs without thinking. I can't know what everyone in these stories intended. What the cases show is that a friendly promise didn't stop the data flowing. The default, in this industry, is that data flows toward whoever will pay for it.

What doing it differently looks like

Early on, I wrote down our never-do list. Never sell the data. Never use what people tell us to train public AI models. Never let an employer see an individual's anything. Ask for as little as possible, and only with explicit permission.

Then I did the part that actually matters, because a list is just a blog post until something enforces it. The product counts instead of scoring. It shows its working. The privacy notice says what the code does.

And this year, before writing any of this, I had every privacy promise on our site checked against what the product actually does. The audit found wording that needed softening and a health-data catalogue that promised more than the app offers. We narrowed it to the seven types the app actually supports. A claim about our app platform's internals also overreached, so we replaced it with an accurate description of the on-device bridge and the server-side privacy promise. One small leak, search words reaching analytics through prefilled links, got found and fixed.

It was uncomfortable and I'm glad we did it.

I also hardened the notice itself: we now commit, in writing, to obtain consent before expanding the use or sharing of health data beyond what someone agreed to. A genetic testing company was penalized for rewriting its policy to expand sharing after the fact. That sentence exists because of them.

The standard

Here's what I'd tell a friend. Read the privacy policy before you hand an app your cycle data. If it won't name exactly who sees your data, that's your answer. If it says "we may share with partners," ask which partners. "Partners" is doing a lot of work in that sentence.

And if a company tells you what it would never do, ask what stops it from doing it later. A promise is a paragraph. Enforcement is architecture.

You shouldn't need a law degree to know where your body ends up.

---

Sources: U.S. Federal Trade Commission press releases and orders: GoodRx, 2023, BetterHelp refunds, 2024, following the 2023 settlement, Premom / Easy Healthcare, 2023, 1Health.io / Vitagene, 2023, Cerebral, 2024, Monument, 2024; Reuters on Flo settlements, September 2025 and Meta's August 2025 verdict; Hello Nila privacy notice, section 12 and the October 2026 code-claims verification.

Piece 5 of 6 · Never sold, never used to train a model, never visible to an employer. · Framework: Human-centred evidence

Companion pieces: Your ring doesn't know how last night felt · The patient at the centre of the record doesn't exist