United States v. Easy Health Care Corporation

[Editor’s Note: This brief summarizes an excerpt from a complaint that the United States government brought against Easy Health Care Corporation in federal district court.] The United States government (plaintiff) filed a complaint against Easy Health Care Corporation (Easy Health) (defendant) in the United States District Court for the Northern District of Illinois. The complaint alleged that Easy Health violated § 5 of the Federal Trade Commission (FTC) Act and the FTC’s Health Breach Notification Rule. In the complaint, the government specifically alleged the following. Easy Care developed an app called the Premom Ovulation Tracker (Premom) by which users could track their personal health information, including information and data about their ovulation cycles. Premom permitted and even encouraged users to import health information from other apps, including the Apple Health app. Easy Care’s privacy policy stated that it would not share users’ health information with third parties absent consent. Despite this, Easy Care shared users’ health information with Google, LLC, and AppsFlyer Inc. In addition, Easy Care shared users’ health information with analytics companies Jiguang and Umeng. Easy Care’s agreements with Jiguang and Umeng permitted the companies to use Premom users’ information in a variety of ways, including for advertising. Easy Care failed to take reasonable care with respect to the security risks of these companies. This failure constituted an unfair business practice. Easy Care did not inform its users of any of these disclosures to third parties. Easy Care’s representation that it would not share users’ health information with third parties without consent was false and misleading. Given Easy Care’s privacy policy and sharing of its users’ highly sensitive health information to third parties without consent and without reasonable care regarding the third parties’ security risks, Easy Care engaged in unfair and deceptive business practices in violation of § 5 of the FTC Act and the FTC’s Health Breach Notification Rule.