Flo Health says ISO privacy and security audits found no issues
Flo Health said annual independent audits of its privacy and security management systems returned zero findings, citing the results as support for its GDPR-aligned practices.
Flo Health said annual independent audits of its ISO 27001 and ISO 27701 programs found no nonconformities or areas for improvement.
Flo Health said in a PR Newswire release dated Aug. 25, 2026, that annual independent audits of its privacy and security management systems found zero findings. The company said the reviews covered ISO 27001 and ISO 27701, standards for information security and privacy management.
Flo said the result supports its privacy and security practices and aligns with GDPR compliance. The company said the audits found no nonconformities or areas for improvement in the systems behind its app.
In the release, Flo described itself as the #1 female health app and said more than 300 million people worldwide have used it.
Flo also tied the audit results to its certification history. The company said it became the first period tracking app to achieve ISO 27001 in 2022 and, two years later, the first and only period tracking app to earn ISO 27701. It said keeping both certifications requires annual surveillance audits and full recertification every three years.
In the release, Flo said it does not and will not sell users’ personal data. It also said it has an independent Privacy and Security Advisory Board and has integrated post-quantum cryptography into its Anonymous Mode feature.
Sue Khan, identified as Flo Health’s vice president of privacy and data protection officer, said women should feel confident that sensitive health information is protected by independently validated privacy and security practices. She said the zero findings reflect the maturity of Flo’s privacy and security programs and its commitment to responsible data stewardship, transparency and accountability.
The release also said Flo has built privacy and security-by-design principles into product development and gives users controls to manage privacy settings inside the app. Flo directed readers to its privacy portal for more information about its certifications.
Flo said maintaining the certifications requires annual surveillance audits and full recertification every three years.
Sources
Editorial note: This article was prepared with AI assistance and includes source attribution for reader review.
Comments ()