Kárla-Orsolya Hegyi, LLM student in Health and Technology Law, k.hegyi student.rug.nl

During the annual Women’s Week organised at the Faculty of Law of the University of Groningen, the Groningen Centre for Health Law organised an event integrating medical science and human rights, in light of the Faculty’s Health and Technology Law LLM track. The program addressed a central question in the context of health and technology law: when menstrual cycles are tracked, who owns the data, how may it be used, and what are the associated risks?

Setting the scene: understanding what we are tracking

Dr Marco Versluis, a gynaecologist at the University Medical Centre Groningen (UMCG), opened with a foundational lecture on hormones, menstrual cycles and women’s health. The menstrual cycle is not simply a reproductive mechanism but a hormonal system that shapes mood, cognition, and physical well-being throughout a woman’s life. He explained the four phases of the cycle, focusing on the luteal phase when estrogen and progesterone levels drop, and various cycle-related concerns tend to surface.

These concerns include iatrogenic effects (caused by medical intervention), premenstrual syndrome (PMS), premenstrual dysphoric disorder (PMDD), premenstrual exacerbation (PME) of existing conditions like depression or anxiety, and the menopausal transition. Understanding the biology reframes these conditions not as anomalies but as physiological patterns deserving clinical recognition.

A point that drew much attention was his observation on diagnosis. There are no biomarkers or blood tests that definitively identify PMDD or PME. Diagnosis relies on symptom tracking across multiple cycles, making menstrual data clinically significant, which highlights the potential added value of FemTech apps in clinical practice. He therefore closed with an introduction to FemTech, the growing market of apps and wearables designed to track menstrual health, and the data rights questions it raises.

The legal picture: FemTech as a tool and as a risk

Dr Geranne Lautenbach, a legal advisor at Hooghiemstra & Partners with a human rights background, did not start with legislation. She began with historical context: the suffragette movement, the adoption of CEDAW and its Optional Protocols,¹ and the Dutch Dolle Minas, the 1970s feminist movement that pushed for reproductive rights in the Netherlands. The point was not nostalgia but to show how the legal landscape has changed. Present-day developments like general practitioners prescribing the morning-after pill or discussions on decriminalising abortion are part of a longer arc. FemTech, she argued, fits into this story of women reclaiming control over their bodies. These tools can be empowering and cost-effective, but can also bring real problems.

The first is one of scope: many FemTech applications focus mainly on conception and regular cycles, which limits who benefits and whose experience is reflected in the design. This narrow framing also has legal consequences. Software such as FemTech apps could potentially fall under the EU Medical Devices Regulation; however, whether an app qualifies as a ‘medical device’ or a ‘wellness product’ depends almost entirely on its intended use.² Products claiming to support well-being are regulated differently from those making clinical claims. The line between the two is thin, giving companies an incentive to stay on the wellness side which is problematic if women use these apps clinically.

The EU AI Act introduces additional concerns.³ Many FemTech platforms use algorithmic decision-making, raising questions about transparency and explainability. Then there is the General Data Protection Regulation: menstrual data, including cycle length, symptoms, mood, and sexual activity, falls within ‘special categories of personal data’ under Article 9. This means processing requires explicit consent and higher protection.⁴ Dr Lautenbach highlighted concerns about privacy by design, cross-border data transfers, and whether consent obtained through a terms-and-conditions agreement buried in onboarding can truly be informed and explicit.

Autonomy, institutionalisation, and who decides

The panel discussion, prefaced by Dr Nina Mileva, assistant professor of public international law at the Faculty of Law (University of Groningen), marked the point at which the two lectures converged and the issues became more complex.

A central theme in the discussion was the tension between female empowerment and the increasing institutionalisation of women’s health. While formal recognition of conditions such as PMDD represents significant progress, it also integrates women more deeply into institutional frameworks that have not always been supportive. The panel discussed to what extent legal recognition and genuine bodily autonomy are upheld with present FemTech tools.

A second tension discussed was the balance between regulatory enforcement and individual agency, as well as the commercial interests of large technology companies and what Dr Versluis termed epistemic determinism. This concept refers to the risk that algorithmically generated health insights can become self-fulfilling, influencing both women’s understanding of their cycles and healthcare professionals' responses.

As a woman and a student of health and technology law, I attended this event believing I had a solid understanding of menstrual health. However, Dr Versluis’s presentation deepened my awareness of how hormones are connected to conditions such as PMDD. I had not fully considered how this knowledge could be used against me. Dr Lautenbach’s presentation prompted me to reevaluate my own period tracking practices in unexpected ways. What resonated most was the subtle manner in which BigTech profits from tools intended to empower: when a user logs her cycle, she may soon be targeted with advertisements for fertility services, prenatal products, or even life insurance. This event clarified that the core tension is not only between technology and privacy, but also between women’s efforts to reclaim their bodies and a commercial infrastructure that benefits from this process without transparency.

Endnotes

^{1.  Convention on the Elimination of All Forms of Discrimination against Women (adopted 18 December 1979, entered into force 3 September 1981) UN GA Res 34/180.}

^{2.  Regulation (EU) 2017/745 of the European Parliament and of the Council of 5 April 2017 on medical devices [2017] OJ L 117/1, recital 19 and art 2(1).}

^{3.  Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act) [2024] OJ L 2024/1689.}

^{4.  Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) [2016] OJ L 119/1, art 9.}