ADiJUST & 3 Others v Flo App Inc, Google LLC & Meta

A complaint challenging the alleged collection, transfer, and commercial use of sensitive reproductive health data belonging to Ugandan users of the Flo health application.

Case background

The complaint seeks to establish whether a foreign digital health platform and the technology companies receiving user data can process the intimate health information of Ugandan women and girls without registration, meaningful consent, adequate safeguards, and accountability under Uganda’s Data Protection and Privacy Act.

Brief facts

The African Centre for Digital Justice filed the complaint in the public interest alongside three Ugandan women who use Flo to monitor menstrual cycles and other sexual and reproductive health matters. The complainants allege that Flo collects sensitive health, demographic, and financial information and transfers data outside Uganda, including to Google and Meta, for analytics, advertising, or other commercial purposes.

The complaint relies on previous proceedings in the United States concerning Flo’s alleged sharing of users’ intimate health data with third parties without adequate disclosure or informed consent, arguing that Ugandan women and girls remain without equivalent protection or redress. Flo is also alleged not to be registered with Uganda’s PDPO.

Issues raised

• Whether Flo unlawfully collected, processed, and transferred the sensitive health data of Ugandan users.
• Whether personal data was shared with Google, Meta, or other third parties without informed consent and a lawful basis.
• Whether transferring Ugandan users’ data to the United States complied with cross-border transfer safeguards.
• Whether Flo was required to register in Uganda and appoint an accessible Data Protection Officer.

Orders sought

The complainants ask the PDPO to investigate the collection, transfer, and sharing of Ugandan users’ data; to order Flo to register and appoint accessible Data Protection Officers; to disclose the proceeds generated from the commercialisation of users’ data; and to impose proportionate administrative fines against the respondents.

Strategic significance

Protecting reproductive health data. The complaint places menstrual, fertility, and other reproductive health information at the centre of digital-rights protection, seeking recognition that such information requires heightened standards of consent, confidentiality, and security.

Equal protection for African users. It raises whether African users should receive protections and remedies comparable to those available in jurisdictions where technology companies have already faced investigation and financial consequences for similar conduct.

Strengthening regulatory sanctions. The determination could clarify whether the regulator may impose meaningful administrative fines and inform wider reforms to ensure sanctions are effective and capable of deterring violations by multinational companies.