What ISO certification means for your health data

By Mary Rendle, Lead Privacy Counsel

You may have seen companies mention ISO certifications on their websites, but do you know what they actually mean? More importantly, do you know why you should care about these certifications when choosing a women’s health app?

Let's break down what ISO certifications are and why Flo has them, as well as how it reflects Flo’s dedication to protecting your reproductive health data.

What is an ISO Certification?

ISO certifications are internationally recognized standards that verify a company's commitment to security and privacy. Created by the International Organization for Standardization (ISO), the certifications are an independent international standard with more than 26,518 published standards (as of October 2026) and cover nearly all aspects of technology and manufacturing.

The standards are created and validated by more than 800 committees and subcommittees and align with the General Data Protection Regulation, GDPR: widely known as the most stringent privacy regulation in the world.

According to ISO, conforming with ISO 27001 and ISO 27701 means that an organization, like Flo Health, has implemented a system able to manage risks tied to data security and information privacy and the systems respect all best practices and principles enshrined in this international standard.

In August 2026, Flo was independently audited for ISO 27001 and ISO 27701 recertification, and the third-party auditors came back with zero findings. A clean audit means the third party found no gaps in our privacy and security policies, processes, or infrastructure, with no recommendations for improvement.

Think of ISO certifications as a seal of approval from respected, independent experts who verify that a company's data protection practices meet strict international standards and match what they say. And with a clean audit? Flo users can be certain their most sensitive information is protected against the highest standards.

What Getting Certified Actually Involves

As Lead Counsel on the Privacy Team, I’m one of several people responsible for ensuring we meet our audit requirements. This summer, Flo underwent a recertification audit by a third-party auditor, which was a complex, scrutinous process.

Audit preparation doesn’t begin a few weeks before the auditors arrive — it’s embedded in how Flo’s entire team works. Conversations about ISO requirements happen year-round, which help ensure privacy is built into every feature from the outset.

Now, the audit itself? It’s definitely intense. There are lots of detailed checks and high standards to meet. People across the company — legal, engineering, security, product, and more — come together with an incredible focus and care to show that we meet the many controls required to pass. It’s a true cross-functional effort, and it’s impressive to see in action. The most surprising element for this audit? The third-party auditors came back with zero findings.

Our clean ISO audit findings go beyond controls or compliance. It demonstrates Flo continues to protect some of the most personal and sensitive information about our users with the highest level of privacy and security controls.

So what does one of our audits actually involve? (Spoiler alert: it’s not easy!)

It requires:

• Comprehensive audits: Independent auditors from an accredited certification body examine every aspect of Flo's data protection practices.
• Annual recertification: These aren't one-time achievements. Flo undergoes successful audits every year to maintain our certifications.
• Documented procedures: Every privacy and security process must be thoroughly documented, implemented, and followed.
• Continuous improvement: The certifications require ongoing monitoring and refinement of security practices.
• Full organizational commitment: Everyone at Flo, from engineering to customer support, must follow strict security and privacy protocols.

Additionally, ISO 27701 specifies requirements for establishing, implementing, maintaining, and continually improving a Privacy Information Management System (PIM). The audit looks at the policies and controls that protect personal information.

Why Independent Certification Matters

Anyone can make privacy claims. A company can say it takes privacy seriously, encrypts data, or follows best practices. But words are easy. Actions are not. Flo obtaining ISO certification is different because it's independently verified by experts who don't work for Flo, confirming our practices meet international standards. This independent validation helps consumers trust our commitment to data protection.

ISO certifications mean that Flo's privacy & security practices are regularly examined by independent experts and confirmed to meet strict international standards through annual audits.

But most importantly, it means you can track your reproductive health with confidence, knowing that a respected, independent certification body has verified that your data is protected by industry-leading security measures, giving you peace of mind about your health information. Our actions speak louder than words.

Your body. Your data. 

Want to learn more about Flo's privacy and security practices?

• Our Certifications 
• “Flo’s Security Team”