Is your health app sharing your personal data – and how can you protect it?
8 min read
October 30, 2026
Whether you’re counting your daily steps, buying medication, checking how well you’ve slept or tracking your menstrual cycle, health apps and online pharmacies have become a familiar part of everyday life. They promise to help you understand your body, spot changes, make better decisions about your wellbeing and buy medication and drugs.
But have you ever wondered what happens to all that information once you’ve allowed the app to take it?
From your daily routines to your drug prescriptions, fertility plans and mental health, the details you share can reveal some of the most personal parts of your life. And while you might trust an app to help you manage your health, you probably wouldn’t expect it to pass that information to advertising companies.
Yet that’s exactly what some health apps and websites and online pharmacies have been doing. High profile legal cases and regulatory investigations have exposed how sensitive health information has reached companies including Facebook and Google, often without users fully understanding what was being shared.
So, before you log another symptom, buy medication or drugs online or connect your next fitness tracker, here’s what you need to know about your health related data, and how to keep more control over it.
Your health app might know you better than you think
Think about everything you’ve shared with your health apps over the past year. Your fitness tracker might know how active you are, when you sleep and where you exercise. A period tracking app could hold details about your cycle, symptoms and pregnancy plans. Meanwhile, nutrition and mental health apps may have information about your eating habits, mood and emotional wellbeing and online pharmacies know your medication and drug prescriptions.
Individually, these details might seem harmless, but together, they can create a surprisingly intimate picture of your life. You don’t necessarily have to tell an app about a medical condition for it to learn something sensitive about you, your searches, symptoms and online purchase and other behaviour can reveal a pretty accurate picture. And that information has commercial value, particularly to businesses interested in understanding your habits, interests and behaviour to target their product and services.
Where does all the information go?
Most health apps need some personal information to work, there’s nothing unusual about a sleep tracker recording your sleep or a period app remembering your cycle. But the problem is what can happen beyond that.
Some apps, health related websites and online pharmacies use advertising trackers, including technology known as tracking pixels, which can send information about your activity to other companies.
That doesn’t necessarily mean they’re sharing your entire health record. But even knowing that you’ve searched for fertility advice, looked at particular medication or visited a mental health service could reveal something you’d rather keep private, and once that information reaches another company, it’s not always easy to understand how it might be used.
The Data Protection Foundation (DPF) is investigating how health related services use these technologies and potentially share sensitive information with advertisers. You can join the DPF to follow its research and learn more about your privacy rights.
When health data sharing goes wrong: Lessons from across the pond
This isn’t just a theoretical concern, several major US legal cases have revealed what can happen when sensitive health information reaches advertising companies.
Flo: The period tracking app privacy case
If you’ve ever used a period tracking app, you’ll know how personal the information can be. From cycle dates to fertility symptoms and pregnancy plans, it’s the kind of detail you might not share with anyone else.
The regulator said Flo had promised to keep this information private. Under the settlement, the company was required to obtain consent before sharing health information and undergo an independent privacy review.
The legal challenges continued. In 2025, a US federal jury found that Meta had violated California privacy law by obtaining sensitive menstrual and ovulation information from Flo users without their consent. Flo, Google and Flurry settled claims in the related class action for $60 million. Meta, typically, are still fighting.
For anyone who has trusted an app with intimate details about their reproductive health, it’s an unsettling example of how information shared for one purpose can end up being used for something else entirely.
BetterHelp: When mental health information reached advertisers
The information included email addresses, IP addresses and answers to health questionnaires, despite promises about privacy. The settlement banned BetterHelp from sharing consumers’ health data for advertising and required stronger safeguards.
GoodRx: Prescription information and advertising
US prescription discount service GoodRx also faced action in 2023, agreeing to pay a $1.5 million civil penalty after the FTC alleged that it had shared consumers’ health information with advertising platforms without appropriate authorisation.
The company was required to restrict how it shared health information for advertising. The trackers who were harvesting the sensitive data were, you guessed it, Google and Meta again, together with a French tracking company called Criteo. Criteo has now settled the claim against them for spying on drug purchases from Good Rx for $32m.
These cases happened in the US and don’t automatically give UK consumers a right to compensation. They also don’t mean every health app is misusing your information. But they do raise an important question of How much do you really know about what happens to the details you share?
What is the UK position? The Data Protection Foundation investigates…
The Data Protection Foundation is looking into how one online pharmacy and online health tracking apps collect and share personal information in the UK. Their initial findings are very alarming.The DPF’s ongoing research has identified potential sharing of sensitive health information from UK consumers with advertising companies.
Boots
The DPF has found that your trusted high street chemist Boots has put Google, Meta, Adobe and even TikTok tracking software all over its websites. The pages that are tracked include mental health and pregnancy related pages and the NHS prescription portal, recording even the drug name inputted. Boots state to advertisers that “through personalisation” they are able to achieve “precision targeting” of their loyalty card customer, basically admitting that they sell customer data to enable profiles of them to be made to predict their behaviour.
In addition, the Boots app terms are highly misleading and full of intentionally vague terms so users cannot understand what is happening to their data. For example, Boots says you cannot be “directly” identified, knowing full well that it shares your data with its commercial partners using “indirect” identification techniques. Boots go on to then scare you that failing to give consent to data sharing could impact use of the app, which is illegal. Finally it also has its settings set up so the app sends your purchase history to third parties by default..
Flo Health
Flo Health, an English company, has not made any attempt to compensate UK users whose menstrual data and even sexual history was shared with third party advertisers, despite $60m in compensation being paid out in the US. The DPF believes that it should seek compensation for UK Flo Health app users, in the same way it helped secure compensation for UK Avast users following the US settlement of the Avast claim.
Grindr
In 2024, a High Court claim was filed alleging that Grindr shared sensitive health data, such as HIV status, last tested dates, and PrEP usage, with third-party analytics and advertising companies without valid consent. Over 12,000 users joined this claim and it was settled in September 2026 for £24m. That’s over £2,000 per claimant. This proves that health data is valuable. Grindr now explicitly states it does not sell or share self-reported health metrics with advertising networks or commercial third parties.
These are findings reported by the DPF, not established court or local regulatory findings against named businesses, but they show alarming similarity to the tracking behaviour that led to the Good Rx and BetterHealth US settlements, and the FTC’s fine and settlements against Flo Health in the United States.
By joining the Data Protection Foundation for free, you can follow its investigations, learn more about your rights and hear about opportunities to contribute evidence to relevant research.
What if you’re worried an app has misused your data?
Start by contacting the company. Ask what information it holds about you, why it needs it and whether it has shared it with anyone else. For help with filling out a subject access request (SAR) go to: https://ico.org.uk/for-the-public/getting-copies-of-your-information-subject-access-request/
You can also ask it to stop using your data for direct marketing and request deletion where your rights apply. If you’re unhappy with the response, you can complain to the Information Commissioner’s Office.
You can also use Resolver to understand your rights and help organise your complaint.
Looking after your health shouldn’t mean giving up your privacy
Health apps can make a real difference to how you understand and manage your wellbeing. Whether you’re trying to sleep better, understand your cycle or manage a health condition, having more information about your body can help you make decisions that work for you.
But the benefits shouldn’t come at the expense of knowing who has access to your most personal information.
The Data Protection Foundation investigates potential misuse of personal data, including health information, and helps consumers understand their rights. Joining is free. You can follow its investigations, contribute evidence to relevant research and hear about opportunities to take part in collective legal action.
Join the Data Protection Foundation
If you have any thoughts on this topic, or any other consumer issues you would like us to cover, feel free to get in touch with us at support@resolver.co.uk
Share this:
Resolver
Need to resolve an issue? Let's get this sorted.
