## Facts

- The United States, on behalf of the Federal Trade Commission (FTC), sued Easy Healthcare Corporation, developer of the “Premom Ovulation Tracker” mobile application.
- Premom collected and processed sensitive reproductive- and fertility-related information, including cycle tracking data and uploaded ovulation test images.
- The government alleged that, from 2017 to 2020, Easy Healthcare’s privacy statements represented that it would not share users’ health information with third parties without users’ knowledge or consent, and that it shared only non-identifiable data for limited purposes.
- The government alleged that, beginning in 2018, Easy Healthcare disclosed users’ identifiable health information to third parties, including Google and AppsFlyer, and to analytics firms Jiguang and Umeng under terms allowing broad uses, including advertising.
- The complaint alleged that Easy Healthcare failed to reasonably assess and control the privacy and security risks associated with third-party analytics and marketing integrations involving sensitive health data.
- The government alleged that the undisclosed disclosures constituted a “breach of unsecured identifiable health information” under the FTC’s Health Breach Notification Rule (HBNR), triggering notice obligations.
- The government alleged Easy Healthcare did not provide timely notice to affected consumers, the FTC, or (where required) the media.
- The case was filed in the U.S. District Court for the Northern District of Illinois and resolved without discovery or a merits adjudication.
- The parties submitted a negotiated stipulated order; the court entered a stipulated permanent injunction and civil penalty judgment and terminated the case.

## Issues

1. Whether the app’s privacy representations about consent-based sharing and de-identification were deceptive under Section 5(a) of the FTC Act when identifiable health data was allegedly shared with third parties.
2. Whether the alleged failure to reasonably manage risks associated with third-party analytics and marketing tools involving sensitive health data constituted an unfair practice under Section 5(a).
3. Whether the alleged undisclosed disclosures constituted a breach under the HBNR requiring notice to consumers, the FTC, and, in certain circumstances, the media.
4. What injunctive and monetary relief was appropriate to resolve the alleged FTC Act and HBNR violations through a court-enforced stipulated order.

## Decision

- The court granted the government’s motion to enter the parties’ stipulated order and entered a permanent injunction, civil penalty judgment, and other relief.
- The stipulated order imposed forward-looking restrictions, including prohibiting certain sharing of users’ health data for advertising purposes.
- The order required specified remedial steps related to data handling (including deletion/remediation obligations) and implementation of privacy and security program requirements.
- The order imposed civil penalties and ongoing compliance, reporting, and enforcement obligations under the court’s authority.
- The case was terminated upon entry of the stipulated order; no contested merits ruling was issued.

## Legal Principles

- Under FTC Act § 5(a), privacy statements can be actionable as deception when material representations about data sharing, consent, or identifiability conflict with actual data practices.
- FTC Act § 5(a) can also reach unfair practices involving sensitive consumer information when a company’s conduct allegedly creates substantial, reasonably unavoidable consumer injury not outweighed by countervailing benefits.
- The HBNR applies to covered entities handling identifiable health information outside traditional HIPAA settings and can treat unauthorized or undisclosed disclosures as a breach that triggers notification duties.
- A court-entered stipulated order (consent decree) can impose enforceable injunctive restrictions, compliance programs, and civil penalties without a litigated finding of liability.

## Conclusion

The court resolved the government’s FTC Act and HBNR allegations through a stipulated permanent injunction and civil penalty judgment that restricted certain advertising-related health-data sharing, required remedial privacy and security measures, and established ongoing compliance obligations, without a merits decision.


United States v. Easy Healthcare Corp., No. 1:23-cv-03107 (N.D. Ill. 2023)