Skip to content

Hero image: A woman reviewing clear privacy choices on her phone beside a trusted health professional

All insights

Data and trust

Reproductive Privacy and Safety by Design

11 min readEvidence synthesis
Read the evidence

The question in focus

A practical privacy and safeguarding model for menstrual, fertility, pregnancy and sexual health services across clinical and consumer settings.

Evidence at a glance

5

functions organize the NIST Privacy Framework

Identify, govern, control, communicate and protect turn privacy into an operating system for risk management rather than a one-time notice. [4]

NIST Privacy Framework

Reproductive privacy is a safety issue

Menstrual dates, pregnancy intention, contraception, fertility treatment, abortion care, sexual activity and location can expose people to stigma, discrimination, coercion or legal risk depending on context. Privacy design should therefore assess physical and social harms as well as confidentiality. A technically secure account can still be unsafe if notifications reveal an appointment on a shared device.

Coverage differs by entity and jurisdiction. HHS explains that HIPAA generally does not protect information voluntarily entered into a consumer app that is not offered by or on behalf of a regulated healthcare entity. [1] A privacy policy should never imply universal medical confidentiality when the service's actual legal role is different.

  • Map harm scenarios with patients, clinicians and safeguarding experts.
  • Identify shared devices, family plans and monitored accounts.
  • Do not use medical visual language to imply protections that do not apply.

Collect less before securing more

Data minimization asks whether each field is necessary for the stated service. Precise location, contacts, advertising identifiers and open-ended notes can make a dataset far more revealing without improving care. Derived predictions, such as inferred pregnancy or fertility status, should be inventoried and governed like directly entered health information.

The NIST Privacy Framework supports five functions: identify privacy risk, govern responsibilities, give people appropriate control, communicate transparently and protect data. [4] Applying these functions means documented purposes, access roles, retention schedules, deletion processes, processor oversight and review when features or business models change.

  • Set a deletion date before collecting the field.
  • Keep optional analytics separate from core care.
  • Prohibit sale or targeted advertising use of reproductive health data.
  • Treat model features and inferences as part of the data inventory.

A single accept button cannot meaningfully cover clinical care, research, personalization and marketing. Interfaces should explain the recipient, purpose, duration and consequence of each optional use. Withdrawal should stop future optional processing and propagate to relevant processors, with clear explanation of lawful or clinical records that must be retained.

WHO's abortion care guideline emphasizes human rights, confidentiality, privacy and informed decision-making within quality care. [5] The same principles support reproductive services more broadly: provide accurate information, avoid coercion, make alternatives visible and ensure that declining optional data use does not block clinically necessary care.

  • Use granular permission for research and model training.
  • Show active sharing relationships in a usable dashboard.
  • Allow correction and export without dark patterns.
  • Reconfirm consent when the purpose materially changes.

Commercial disclosure is a foreseeable risk

The FTC's settlement with Flo Health alleged that the app disclosed sensitive health data to analytics providers despite privacy promises. The company was required to obtain independent privacy reviews and instruct recipients to destroy relevant data. [3] Enforcement actions demonstrate why vendor contracts and software development controls must match public claims.

The FTC's 2024 Health Breach Notification Rule clarifies coverage for many health apps and similar technologies outside HIPAA. Covered vendors must notify people, the FTC and in some circumstances the media after specified breaches. [2] Notification is not prevention; services still need authentication, encryption, least privilege, audit logs, secure development and incident exercises.

  • Block advertising software development kits from sensitive flows.
  • Test actual network transmissions rather than relying on vendor descriptions.
  • Review subprocessors and revoke access when contracts end.
  • Prepare user-centered breach messages and support.

Safety features must survive real life

A discreet mode can hide notification content, rename the app, protect sensitive screens with a separate code and provide a quick exit. These features should be tested with survivors and advocates because a poorly designed stealth feature may itself draw attention. Emergency deletion can also create medical or legal consequences, so choices and limitations must be explicit.

Governance should include an accountable privacy lead, clinical safety input, safeguarding escalation and independent testing. ACOG has emphasized confidential care as important for access to sensitive services, particularly for adolescents. [6] The goal is not secrecy at any cost. It is proportionate control, honest communication and safe access within applicable consent and safeguarding law.

  • Can users choose a safe contact method and time?
  • Can they see and close other sessions?
  • Are exports protected against coercive bulk access?
  • Does support understand stalking and intimate partner violence risks?

What the evidence cannot yet answer

  • Privacy and consent law varies by jurisdiction and changes over time; this is not legal advice.
  • No technical control can eliminate coercion or all re-identification risk.
  • Deleting a user-facing record may not erase legally required clinical documentation.
  • Safeguarding duties can limit confidentiality in specific circumstances and should be explained accurately.

Questions worth taking into care

  1. What harm could occur if this data or notification were seen by someone else?
  2. Is every collected field necessary for the core service?
  3. Can users refuse research, analytics and marketing separately?
  4. Do actual data transmissions match the privacy promise?
  5. Are discreet access and incident response tested with affected communities?

Source record

Evidence used in this review

Sources were selected for clinical authority, methodological relevance and traceability. Links open the original guidance, public-health record or research publication.

  1. [1]
  2. [2]
    Health Breach Notification Rule

    US Federal Trade Commission · 2024

  3. [3]
    FTC Finalizes Order with Flo Health

    US Federal Trade Commission · 2021

  4. [4]
    NIST Privacy Framework

    National Institute of Standards and Technology · 2020

  5. [5]
    Abortion care guideline

    World Health Organization · 2022

  6. [6]
    Confidentiality in Adolescent Health Care

    American College of Obstetricians and Gynecologists · 2020

Editorial standard

This evidence synthesis is for general information. It does not diagnose a condition or replace care from a qualified health professional. Treatment choices depend on individual history, examination, local guidance and informed preference. Emergency or rapidly worsening symptoms need urgent local medical assessment.