My period-tracking app collects cycle data from Washington users. Where does the My Health My Data Act apply?
Period-tracking apps were one of the first categories Washington's My Health My Data Act was designed to reach. Cycle entries are not a "wellness" log under MHMDA; they are reproductive health data. The combination of cycle data, predicted ovulation, pregnancy-likelihood inferences, and location signals creates a compliance surface that a generic SaaS privacy policy does not address. The risk is acute in the post-Dobbs litigation environment because the same data set can identify a user's pregnancy timing, miscarriage, or termination decision.
Cycle data is consumer health data, and inferences from it are too
RCW 19.373.010 defines consumer health data broadly: data linked or reasonably linkable to a consumer that identifies past, present, or future physical or mental health status, including reproductive or sexual health information and inferences drawn from non-medical signals. A logged period start date is reproductive health data. A predicted ovulation window is an inference. A missed period combined with a positive pregnancy entry is pregnancy-status data. A symptom log that includes mood, cramps, or sleep is health-status data. A location ping near an OB-GYN office at a date consistent with the predicted ovulation window is precise location near a healthcare facility plus an inference about reproductive intent.
Each category is independently in scope, and the combination is what creates the post-Dobbs risk profile. A plaintiff's theory can rely on the entire stack rather than a single field.
The separate Consumer Health Data Privacy Policy (RCW 19.373.020)
RCW 19.373.020 requires a standalone consumer-health-data privacy policy, prominently linked from the homepage. The policy must disclose the categories of data collected and the purposes, the sources, the categories of data shared, the list of categories of third parties and specific affiliates, and the rights mechanism under RCW 19.373.040. For a period-tracking app this means a dedicated document that names the cycle data, the symptom log, the partner data if any, the device and location signals, and the inferences. It identifies the analytics platforms, the ad SDKs, and the cloud processors by category and by specific affiliate. Bundling MHMDA into a generic privacy policy is the most common compliance gap I see.
Two-layer consent (RCW 19.373.030)
RCW 19.373.030 requires affirmative opt-in consent for collection and a separate, distinct consent for sharing. The two consents cannot be bundled. For a period-tracking app the practical impact is that the first reproductive-health entry should trigger a collection consent, and any sharing flow (analytics, ad partner, research partner) should trigger a second consent at the point of sharing. A single terms-of-service acceptance does not satisfy this rule, and a CCPA-style cookie banner does not either.
The 2,000-foot geofence prohibition (RCW 19.373.080)
RCW 19.373.080 bans implementing a geofence within 2,000 feet of an in-person healthcare facility when the geofence is used to identify or track consumers, collect consumer health data, or send notifications, messages, or advertisements related to health data or healthcare services. For a period-tracking app the rule sweeps in any push notification, ad, or marketing message triggered by proximity to a clinic, an abortion provider, an OB-GYN office, or a hospital running a reproductive line. The prohibition is categorical; consent does not save it.
Sale of consumer health data and written authorization (RCW 19.373.070)
RCW 19.373.070 makes it unlawful to sell consumer health data without a written authorization signed by the consumer with all nine elements: identification of the data, seller and buyer contact details, description of purpose, statement that provision of goods or services may not be conditioned on signing, revocation right and instructions, redisclosure notice, one-year expiration, and consumer signature and date. A period-tracking app's data-licensing arrangement or research-sale partnership that misses any element is invalid as authorization, and "sale" under RCW 19.373.010 is broad enough to include valuable-consideration exchanges that are not cash sales.
Sergei's practical note
Period-tracking apps are the cluster where the legal-risk gap matters most to actual users. Many users do not realize that the app's analytics or ad partners receive their cycle and predicted-pregnancy entries. The MHMDA compliance posture is the most concrete protection a Washington user has against that flow, and the failure modes show up cleanly on the separate-policy and consent-UX questions. If you are an operator, send the current policy, the consent screenshots, the SDK inventory, and a brief data-flow description, and I will tell you which tier of work fits.
Related Washington resources
For the full statutory walkthrough, see my Washington My Health My Data Act resource. To run the triage, see my Reproductive Health Data Risk Checker and my MHMDA Scope Analyzer. Related cluster pages: Fertility apps, Reproductive-health apps, Reproductive-health geofencing ban, Geofencing risk for adtech.
Educational resource. Sergei Tokmakov is a California attorney (CA Bar #279869) currently seeking admission to the Washington State Bar. Nothing on this page creates an attorney-client relationship or is Washington legal advice.