In order to determine their 6.5% failure rate, Natural Cycles used real-world data from their users. The data likely do not represent the experiences of the average contraceptive user and may not even represent many of the people who try the app before ultimately quitting. One medical expert cautioned that “there is a significant amount of missing data, and drop-out rates are quite high. The study was not designed according to the standards of an efficacy trial, so it seems inappropriate and misleading to offer this claim.”

"On the pill, it didn’t matter if I’d just woken up, was lying down or standing up when I took it. With Natural Cycles, the slightest motion seemed to count. It was comedic until it became tragic; I got pregnant when the predictions of fertile and infertile changed back and forth in one day, turning from green to red, after I had unprotected sex."
- Olivia Sudjic, The Guardian

When pressed, the company seemed to acknowledge these limitations. Calling them “highly motivated,” Natural Cycles chief executive described their users as “age 30 on average, in a stable relationship with a regular daily routine, and willing to take their temperature on a daily basis and use protection on fertile days.”

Yet the company’s aggressive marketing campaigns target contraceptive users among the general public with the idea that the pill and the app are comparable. Many of these users are likely to find that correctly using the app is more difficult than correctly using hormonal contraceptives such as the pill.

All of this suggests that the effectiveness of the app is almost certainly overestimated for the general public. And in fact, the FDA itself warns that “Natural Cycles should not be used by women who have a medical condition where pregnancy would be associated with a significant risk to the mother or the fetus.” Annovera, the new vaginal ring approved on the same day, has a similar typical use failure rate but did not carry this same warning, suggesting that even the FDA may believe the app’s real failure rate is higher. But by accepting Natural Cycles’ claims uncritically, the FDA is allowing the company to promote a potentially false effectiveness rate with the agency’s stamp of approval.

The FDA label requires Natural Cycles to compare its effectiveness as a "stand-alone contraceptive." But unlike hormonal contraceptives such as the pill that act on the body to prevent pregnancy during all times of the month, Natural Cycles must be used in combination with either abstinence or a barrier method of contraception for approximately 11 days each month in order to prevent pregnancy. No other FDA-approved contraceptive requires the use of another method to make it effective at all times in the cycle.

The Natural Cycles database stores highly personal medical information, including information that can identify users as well as data about their sex lives, pregnancy intention, use of contraception, body temperature, menstrual cycle, specific dates of intercourse, ovulation test results, and pregnancy test results. The app also asks to sync with other smartphone health data (including Apple's Health Kit) and rewards users for sharing as much information about themselves as possible. The app is not required to comply with medical information privacy laws.

"Right now, they’re sort of a provider of health care, but they’re not a covered entity under HIPAA [the Health Insurance Portability and Accountability Act] so they’re sort of in a gray area where there’s a patchwork of state laws and consumer expectations."
- Bloomberg Law Article

Like any cloud-based service, Natural Cycles is vulnerable to a security breach; they warn users that “no system can be 100% secure and despite our best efforts, there is always a risk of unauthorized access to your Personal Data.” The app’s privacy policy also explicitly permits its owners to sell user information to third parties so long as personally identifying information is removed first. However, studies suggest that it is relatively easy to re-identify specific individuals associated with “anonymized” data by combining it with other publicly available data sets.

Natural Cycles' data is also vulnerable to exploitation as a form of intimate partner violence. Reproductive coercion as a form of abuse is well-established. As one expert explained, it's "about power and control—the perpetrators get off on that feeling of having complete power over their partners, even to the point of controlling a bodily function exclusive to women: pregnancy.” In recent years, abusive partners have also found ways to use smart technology to stalk and harass their current and former partners. Yet Natural Cycles actively promotes the ability of partners to "download and login to the app on their phone so they can stay up to date" on the user's cycle. Co-opting feminist language, the company frames this feature as "sharing responsibility" for avoiding pregnancy, but does not caution against the potential for misuse.

Finally, Natural Cycles’ privacy policy notes that it “may disclose your Personal Data in order to comply with a legal or regulatory obligation.” With abortion rights at risk in the US and elsewhere, there is no guarantee that Natural Cycles’ data won’t be used by law enforcement to target individuals who’ve had abortions.

This is true whether or not users themselves tell the app that they had been pregnant. In the efficacy studies discussed above, the authors explicitly noted their ability to determine that users had become pregnant even when they had stopped using the app: “We considered users likely to be pregnant if they discontinued at a late day of their luteal phase and/or reported high BBT when discontinuing after ovulation. We treated these women as pregnant for all calculations unless they stated explicitly in follow-up that they were not.” And there is anecdotal evidence that Natural Cycles employees may be updating the app to include pregnancy and abortion information even if the user has not done so themselves.

The consequences of data sharing and security breaches could be severe so a discussion of the risks posed by fertility apps must include more than their efficacy as contraceptives. In uploading data about their fertility and sexual history, users are potentially sharing sensitive information with hostile governments or unscrupulous third parties.