Using a menstrual tracker app? This is what happens to your health data

If you are one of the millions of women who uses period tracker apps to better your chances of having a baby, to prevent pregnancy or just to monitor menstruation, are the risks of sharing sensitive health information about your reproductive cycle worth the benefits?

That's the issue raised by a new review of five popular period tracker apps by Consumer Reports' Digital Lab, which tests apps to see how well they protect consumers' privacy and data. The organization's lab found that information gathered by period tracker apps is shared with marketers to target advertising and, in some cases, even more broadly.

And, though Consumer Reports did not uncover any major security vulnerabilities, it says some of these apps are not doing enough to keep your data secure.

All of the period tracker apps tested by Consumer Reports—BabyCenter, Clue, Flo, My Calendar and Ovia Health—share information they collect with marketers. Three of them share information with health researchers with your consent though it's unclear whether consumers always understand they are giving this consent.

One of them, Ovia Health, works with corporate wellness programs, allowing employers and health insurers to monitor the reproductive health of female workers in aggregated form, including if women are trying to get pregnant, Consumer Reports says.

Only two of the apps allow you to use them without handing over your name and email address. Four of the five do not authenticate your identity with each use. One of the five did not work with password managers until the Consumer Reports study was published.

Women check in daily with period tracker apps to help navigate pregnancy and childbirth, infertility and menopause, entrusting these apps with a massive amount of highly personal data which is not protected under the Health Insurance Portability and Accountability Act (HIPAA), a federal law that restricts with whom healthcare providers can share your data.

In exchange for finding out what day of the month they are fertile or when to expect their period, women volunteer sensitive information about their sex drive, medications and mood, revealing how often they have sex and how much of it is unprotected, if they've had a miscarriage or if they're headed for menopause.

And that information can be used in ways women don't intend or anticipate and may not even be aware of, such as determining interest rates on loans or how much they will be charged for life insurance or if they're eligible for it at all, Dena Mendelsohn, Consumer Reports' senior counsel on privacy and technology policy, told U.S. TODAY.

The more information health apps mine about our bodies, the more vigilant consumers must be, she says. "The more information you put out there in the world," she said, "the more it can be used in ways you don't realize."

Should you use a period tracker app?

How do you decide if you should use a period tracker app? That's a question each consumer must weigh for herself, Mendelsohn said.

Period tracker apps already had a spotty record when it comes to privacy. And none of the apps Consumer Reports tested was a "clear winner" in the privacy department, she said.

Consumer Reports' position: Period tracker apps should use their customers' data only to run the app, should not share or sell the information and should delete the information when it's no longer needed. Apps should also clearly outline for consumers why they collect data and what they do with it so consumers can make informed decisions about their privacy, Mendelsohn says.

If you decide to use a period tracker app, be a "savvy shopper" and only use apps that you trust to put your privacy first, Mendelsohn recommends. Review the privacy practices of each period tracker app before picking and downloading one.

"The privacy practices and data security practices across the board don't meet our expectations and we think consumers should be aware of that shortcoming," she said. "Consumers should definitely go into this with their eyes open."

How to protect your privacy on a period tracker app

• Opt out of giving permission to the app to sell or share your data, Mendelsohn says. Some period trackers make it easy to do this, others make you sift through the fine print.
• Don't give apps permission to access your location or your contacts. Change your location setting to "while using" or "ask" for iPhone apps and to "on" or "off" for Android apps, Consumer Reports says.
• Use a password manager such as 1Password, Dashlane, KeePass or LastPass and use a unique password for every app, Mendelsohn recommends.
• Limit ad targeting on your phone.
• Use an alternate email address. But remember, apps know who you are. Even if you use a fake name or an alternate email address, your phone can be used to identify and track you.