Gestational diabetes apps and your privacy: what a leak can expose

A gestational diabetes log shows that you are pregnant, that you have a medical condition, which medicines you take and what you eat each day. HIPAA does not protect most apps you download yourself, and leaked health data cannot be changed like a password. The safest log never leaves your phone: pick an app with no account and no server copy, lock your phone with a passcode, and encrypt your backups.

Last reviewed 2026-10-22. Written by the First Fork team from the published guidelines listed below; not reviewed by a clinician. This page is not medical advice.

Disclosure. This site is made by the team behind First Fork, an iPhone app that keeps your log on your phone. This page recommends it, and it also says where its limits are. Every incident below comes from a regulator, a court record, a company statement or a published study.

What your log says about you

A gestational diabetes log is more than a list of numbers. Together, the entries show:

• that you are pregnant, and about how far along you are;
• that you have a medical condition, and whether you take insulin or another medicine;
• what you eat and at what times, which also shows when you wake up and when you go to bed;
• if the app has an account, the email address or phone number you signed up with.

Health data is not like a card number. After the 23andMe breach, the UK Information Commissioner repeated a victim's point: once this kind of information is out, it cannot be changed or reissued like a password or a credit card. The regulator warned that such data can be used for financial gain, surveillance or discrimination.¹ The US Department of Health and Human Services (HHS) names discrimination, identity theft and harm to your reputation as the risks.² The US Federal Trade Commission (FTC) has said that criminals can use health data for phishing scams and identity theft, and that exposed reproductive health data can lead to discrimination, stigma and mental anguish.³

Three ways health data gets out

1. Someone breaks into the company's servers

In February 2024, a ransomware attack hit Change Healthcare, a US health care company. It later told HHS that about 192.7 million people were affected.⁴ On 10 October 2026, Dexcom, a maker of glucose sensors, said that someone had reached limited information in some of its internal documents after targeted voice-phishing ("vishing") calls. Dexcom says its products were not affected and that it will tell any affected people where appropriate.⁵

Any company that keeps your data on its servers can be a target. A copy that is not on a server cannot be stolen from that server.

2. Someone logs in with a reused password

From April to September 2023, an attacker used passwords stolen in other, unrelated breaches to log in to 23andMe accounts. This is called credential stuffing. In the UK alone, the access could reveal names, birth years, location, ethnicity, family trees and health reports.¹ Worldwide, 23andMe said almost 7 million customers were affected.⁶ The UK regulator fined the company and said it did not have steps such as mandatory two-step login (multi-factor authentication).¹

An app with an account is only as safe as the password on it. An app with no account has no login to break into.

3. The app shares your data on purpose

Not every leak is a hack. In 2021 the FTC said that the period and pregnancy app Flo shared users' health data, including the fact of a pregnancy, with analytics and marketing companies such as Facebook and Google, after it had promised to keep that data private. Flo settled the case.⁷ In August 2025, a federal jury in California found that Meta had recorded Flo users' communications without the consent of all parties, under the California Invasion of Privacy Act.⁸

In 2023, the FTC said that the fertility app Premom shared users' health data, including pregnancy status, with other companies, among them two firms based in China.⁹ The same year, in its first case under its Health Breach Notification Rule, the FTC said that GoodRx shared users' medicines and health conditions with advertising platforms such as Facebook and Google.¹⁰

Diabetes apps are not different. A 2016 study of 211 Android diabetes apps found that 81% had no privacy policy, and in a group of 65 of them, most shared user information with other companies, with or without a policy.¹¹ A 2021 study of more than 20,000 health apps found that 88% had code that could collect user data; 3.9% were seen sending user information.¹²

Why the law does not stop most of this

HHS says that HIPAA, the US health privacy law, generally does not protect health data that you put into an app on your own phone, unless your health care provider or health plan (or a partner of theirs) gave you the app. HHS also warns that such data can be sold to data brokers.²

For many health apps outside HIPAA, the FTC's Health Breach Notification Rule (updated in 2024) says the app must tell you no later than 60 days after it finds a breach, and sharing your data without permission also counts as a breach.¹³ The rule tells you after the data is out. It does not get the data back.

How First Fork keeps your log

First Fork is built so that your log has no server to leak from. Its privacy policy says:¹⁴

• No account, no sign-in and no email: there is no login for anyone to guess or reuse.
• Your readings, meals, targets and notes are stored on your iPhone, shared only with the app's Lock Screen countdown and its Apple Watch app. No First Fork server receives them.
• A photo of your meter is read on the phone with Apple's on-device text recognition, and it is not uploaded.
• No advertising, no ad identifiers and no third-party analytics or crash-reporting code.
• The clinic PDF is made on the phone and leaves it only when you send it.

Compared with an app that keeps your log in an online account, there is no server copy to breach and no password to steal. Its limits, in the same plain words: during first setup, the app counts which setup screen was reached, with only the screen name and the app version and no identifier, so its App Store privacy label lists "Usage Data" that is not linked to you.¹⁵ And if iCloud Backup is on, your log is in your phone backup, under Apple's terms.¹⁴ To compare features, see the six gestational diabetes apps compared.

Protect your log, whatever app you use

After the birth, keep the report your clinic still needs, and delete the rest.

Questions

Is my gestational diabetes app covered by HIPAA?

Usually not. HHS says HIPAA generally does not protect data you put into an app on your own phone, unless your health care provider or health plan gave you the app.

What happens if a health app leaks my data?

Under the FTC's Health Breach Notification Rule, many health apps outside HIPAA must tell you no later than 60 days after they find a breach. But leaked health data cannot be changed like a password.

Is data that stays on my phone completely safe?

No data is completely safe. A passcode encrypts the data on your iPhone, and your iCloud backup is end-to-end encrypted only if you turn on Advanced Data Protection.

Which gestational diabetes app keeps the log only on the phone?

First Fork stores readings, meals and notes on the iPhone, with no account and no server copy; we make it. Read any app's privacy policy and App Store privacy label before you trust it.

Sources

1. UK Information Commissioner's Office. 23andMe fined £2.31 million for failing to protect UK users' genetic data (news release, 17 June 2025). https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2025/06/23andme-fined-for-failing-to-protect-uk-users-genetic-data/
2. US Department of Health and Human Services, Office for Civil Rights. Protecting the privacy and security of your health information when using your personal cell phone or tablet (last reviewed 29 June 2022). https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/cell-phone-hipaa/index.html
3. US Federal Trade Commission, Business Blog. Location, health, and other sensitive information: FTC committed to fully enforcing the law against illegal use and sharing of highly sensitive data (11 July 2022; no longer on ftc.gov, archived copy). https://web.archive.org/web/20241230164546/https://www.ftc.gov/business-guidance/blog/2022/07/location-health-and-other-sensitive-information-ftc-committed-fully-enforcing-law-against-illegal
4. US Department of Health and Human Services, Office for Civil Rights. Change Healthcare cybersecurity incident: frequently asked questions (last reviewed 13 August 2025). https://www.hhs.gov/hipaa/for-professionals/special-topics/change-healthcare-cybersecurity-incident-frequently-asked-questions/index.html
5. Dexcom, Inc. Dexcom statement on cybersecurity incident (company statement, 10 October 2026). https://www.dexcom.com/en-us/cyberupdate
6. Office of the Privacy Commissioner of Canada. Summary of joint investigation into data breach at 23andMe (backgrounder, 17 June 2025). https://www.priv.gc.ca/en/opc-news/news-and-announcements/2025/bg_23andme_250617/
7. US Federal Trade Commission. Developer of popular women's fertility-tracking app settles FTC allegations that it misled consumers about the disclosure of their health data (press release, 13 January 2021). https://www.ftc.gov/news-events/news/press-releases/2021/01/developer-popular-womens-fertility-tracking-app-settles-ftc-allegations-it-misled-consumers-about
8. US District Court, Northern District of California. Frasco et al. v. Flo Health, Inc. et al., No. 3:21-cv-00757-JD, verdict form (ECF 756, filed 4 August 2025). https://storage.courtlistener.com/recap/gov.uscourts.cand.372884/gov.uscourts.cand.372884.756.0_2.pdf
9. US Federal Trade Commission. Ovulation tracking app Premom will be barred from sharing health data for advertising under proposed FTC order (press release, 17 May 2023). https://www.ftc.gov/news-events/news/press-releases/2023/05/ovulation-tracking-app-premom-will-be-barred-sharing-health-data-advertising-under-proposed-ftc
10. US Federal Trade Commission. FTC enforcement action to bar GoodRx from sharing consumers' sensitive health info for advertising (press release, 1 February 2023). https://www.ftc.gov/news-events/news/press-releases/2023/02/ftc-enforcement-action-bar-goodrx-sharing-consumers-sensitive-health-info-advertising
11. Blenner SR, et al. Privacy policies of Android diabetes apps and sharing of health information. JAMA 2016;315(10):1051-1052. https://jamanetwork.com/journals/jama/fullarticle/2499265
12. Tangari G, et al. Mobile health and privacy: cross sectional study. BMJ 2021;373:n1248. https://europepmc.org/article/MED/34135009
13. US Federal Trade Commission. FTC finalizes changes to the Health Breach Notification Rule (press release, 26 April 2024). https://www.ftc.gov/news-events/news/press-releases/2024/04/ftc-finalizes-changes-health-breach-notification-rule
14. First Fork. Privacy policy (effective 16 September 2026). https://firstfork.app/privacy
15. Apple App Store. First Fork — GDM Tracker (listing and release notes, read 2026-10-22). https://apps.apple.com/us/app/first-fork-gdm-tracker/id6810401121
16. Apple Support. Set a passcode on iPhone (iPhone User Guide). https://support.apple.com/guide/iphone/set-a-passcode-iph14a867ae/ios
17. Apple Support. What does iCloud back up? (1 May 2025). https://support.apple.com/en-us/108770
18. Apple Support. iCloud data security overview (5 January 2026). https://support.apple.com/en-us/102651

See a mistake, or something unclear? Report a problem