Flo Health’s GDPR Compliance and Privacy, Security Protections Stand Up to Independent ISO Scrutiny

Annual independent ISO audits of the female health app's dual certification program returned zero findings across its information privacy and security management systems, reaffirming Flo's commitment to consumer data privacy standards.

LONDON, August 26, 2026--Flo Health, the #1 female health app used by more than 300 million people worldwide, has completed its annual ISO 27001 and ISO 27701 audits, which returned zero findings. This means independent auditors identified no areas for improvement in the company's privacy and security management systems.

ISO 27001 and ISO 27701 are the internationally recognized standards for information security and privacy management systems. These audits map to GDPR compliance, which is the most rigorous global privacy regulation. An independent third-party auditor returned with clean audits, which confirm Flo continues to exceed the highest level of privacy and security requirements.

As consumers increasingly rely on digital health services, and become more aware of how their personal and health information is collected and used, independent verification of privacy and security practices is essential to building trust and providing assurance that sensitive data is protected to the highest standards.

Privacy and security is the cornerstone of how Flo builds and operates its products. In 2022, the company became the first period tracking app to achieve ISO 27001 for its information security program. Two years later, Flo expanded its commitment and became the first and only period tracking app to earn the ISO 27701 certification, the global standard for privacy information management.

Unlike a one-time assessment, maintaining both certifications requires ongoing independent oversight, including annual surveillance audits and full recertification every three years. This means each year, Flo is required to demonstrate it is both maintaining and improving both its privacy and security management systems.

Flo's latest audits were completed with zero findings, meaning independent auditors identified no nonconformities or areas for improvement. The results reaffirm that the policies, processes, and technical safeguards governing how Flo collects, stores, processes, and protects users' personal and health information continue to meet rigorous international standards.

"Women deserve to feel confident that their most sensitive health information is protected by privacy and security practices that have been independently validated," said Sue Khan, VP of Privacy and Data Protection Officer at Flo Health. "Achieving zero findings across both of our annual ISO surveillance audits reflects the maturity of our privacy and security programs and our continued commitment to responsible data stewardship, transparency and accountability."