Executive Summary: Key Legal and Evidentiary Issues

• Class action certified for claims of privacy breach, contract breach, and lack of meaningful consent.

• Allegations centered on unauthorized sharing of users’ sensitive health data by Flo Health Inc.

• Plaintiff successfully pleaded breach of express and implied contractual terms.

• Claims include breach of good faith and honest performance, now allowed to proceed.

• The court found sufficient factual basis to permit claims for nominal damages and disgorgement.

• No damages or costs awarded at this stage; issues reserved for trial.

Facts and outcome of the case

Background and nature of the claim

This case arises from a proposed class action filed by Jaime Kah Cate Lam against Flo Health Inc., the developer of the Flo Health & Period Tracker application. The plaintiff alleges that Flo unlawfully shared sensitive reproductive and health data of Canadian users without proper consent, despite privacy assurances made in the app’s privacy policies. The proposed class includes all Canadian residents (excluding those in Québec) who used the app between June 1, 2016, and February 23, 2019.

Ms. Lam claimed that users trusted Flo’s privacy representations when inputting deeply personal information, including menstrual data, symptoms, and pregnancy details. However, Flo allegedly disclosed this information to third parties, including analytics providers, in ways that violated both express and implied privacy terms in its contracts with users.

Procedural history and scope of certification

The lawsuit was brought under British Columbia’s Class Proceedings Act. A prior decision in 2024 partially certified the class action but denied certification of some claims. In response, the plaintiff filed a further amended notice of civil claim, clarifying and expanding the breach of contract theory, including breaches of good faith and honest performance.

In the 2025 ruling, the Court determined that the amended pleadings disclosed viable causes of action for:

• Breach of express and implied contractual terms not to share personal information

• Failure to obtain meaningful consent, informed by the Personal Information Protection and Electronic Documents Act (PIPEDA)

• Breach of the common law duties of good faith and honest performance

Justice Blake rejected Flo’s arguments that these claims were bound to fail. The judge concluded that the amended pleadings were sufficiently detailed, that key issues were common across the proposed class, and that the interpretation of contractual and privacy policy language was best reserved for trial.

Remedies sought and evidentiary context

The plaintiff is not seeking traditional compensatory damages, as most users accessed the app for free. Instead, she seeks nominal damages and disgorgement of profits Flo allegedly earned by sharing user data with third parties to grow its user base and revenue through targeted advertising. The Court found this remedy plausible at this stage, allowing it to proceed to trial.

The Court emphasized that although some privacy policies changed over time, the core issue—whether Flo breached its commitments not to share sensitive personal data—was common enough to support class-wide adjudication. The Court also held that interpretation of the privacy policies and the scope of user consent should be assessed with a full evidentiary record at trial, not during certification.

Conclusion

The plaintiff succeeded in expanding the scope of the certified class action. The Court allowed the case to proceed on the strengthened claims of privacy and contract breaches, including claims for disgorgement and nominal damages. No determination of liability or award of damages was made at this stage. The matter will now proceed toward trial, where the substantive merits of the claims will be assessed.