Stardust report exposes the privacy gap in reproductive-health apps

A new privacy investigation alleges that period-tracking app Stardust shared sensitive reproductive-health information with an analytics provider, raising questions about how health apps describe and protect user data.

What happened

Researchers found that information sent to RudderStack allegedly included dates of birth, contraception choices, reproductive goals and reported symptoms. The data was connected to unique user identifiers rather than users’ names.

Privacy regulators and researchers have repeatedly warned that replacing a name with an identifier does not necessarily make sensitive information anonymous, particularly when multiple datasets can be combined. Stardust had also previously faced questions about whether its encryption claims matched the design of its service.

The findings concern data handling by a consumer application, not a hospital medical-record system.

Why it matters

Reproductive-health information can expose users to discrimination, targeted advertising, relationship harm or legal risk. Many people assume that a health-focused app receives protections similar to data held by a doctor, but consumer applications often sit outside the strictest medical-privacy frameworks.

Analytics tools can help developers understand product usage, yet collecting detailed health information for that purpose creates risks that may not be obvious to users.

The bigger picture

Healthtech companies cannot treat privacy as a marketing layer added after the product is built. Data minimisation, encryption, limited third-party sharing and clear consent need to be part of the core architecture.

The broader market consequence is a trust problem. Even responsible health apps may struggle to convince users to share useful information if prominent products appear to overstate their privacy protections.