Nev. Fertility Clinic Shares Patients' Private Data With Meta Without Consent: Suit

Despite “intentionally incorporating invisible tracking codes from unauthorized third parties” on its website and servers, at no point has FCLV informed users that their personally identifiable information (PII) or protected health information (PHI) was intentionally disclosed to a third party, “let alone Facebook, which has a sordid history of privacy violations,” said the redacted complaint.

Sarita Lundin of Las Vegas began using the patient portal and website prior to her first appointment as an FCLV patient in July 2020, it said. She used the website to search for a doctor, pay for services, schedule appointments and do research, it said. After Lundin, also a Facebook user, provided information to FCLV, she began receiving ads for certain information on her Facebook and Instagram accounts, said the complaint. FCLV worked with Facebook to intercept her communications with her private information and transmitted her Facebook ID, IP address, location, treatment sought, appointment type, physician sought and medical history to Facebook, the complaint said. By doing so, it breached her right to privacy, it said.

Information concerning fertility and reproductive health “is among the most confidential and sensitive information in our society,” said the complaint, citing a 2020 New York Times article, saying most infertile women choose to keep that information private from family or friends. The mishandling of such private PHI “can have serious consequences,” said the complaint, referencing workplace discrimination and denial of insurance coverage. If people don’t trust that their sensitive private information will be kept private and secure, “they may be less likely to seek medical and fertility treatment which can lead to much more serious health consequences down the road,” said the complaint. “Protecting medical information and making sure it is kept confidential and not disclosed to any unauthorized entities is vitally necessary to maintain public trust in the healthcare system as a whole,” it said.

Without telling Lundin and class members, FCLV installed the Meta Pixel tracking tool on its website to collect and disclose “an incredible amount of personal and protected data” about them to Facebook “for its own pecuniary gain” and without notice to or consent from users, it said.

Tracking pixels are configured by the website owner to collect and transmit information from users’ browsers to unauthorized third parties such as Facebook, said the complaint. The data sent to Facebook includes how long users spend on a web page, which buttons they click and the text they type into search bars or chat boxes, it said. Pixels also disclose users’ “unique and persistent Facebook ID (FID),” which allows the social media company and other third parties to identify the users and associate their private information with their Facebook profile, it said.

The Meta Pixel collects a “substantial ‘data packet’” that, coupled with the FID, enables FCLV to send targeted ads to users based on their sensitive and protected personal information, the complaint said. The defendant also uses the “impermissibly obtained data for analytics purposes to gain additional insights” into how patients use the website, it said. The pixel discloses information allowing Facebook to know when and where a patient sought confidential medical care and the precise care the patient sought or received, it said. Facebook sells that information to third-party marketers, who target the users based on that information, it said.

FCLV discloses “every detail of a User’s search for medical fertility conditions and treatments, including male and female infertility, in vitro fertilization, intrauterine insemination, surrogacy, egg and sperm donation, third party parenting, and embryo donation,” said the complaint. In addition to fertility conditions, treatments and appointments, FCLV also discloses “sensitive information" about the gender identity and sexual orientation of users and reveals when users seeking fertility treatment are "a minor or HIV positive,” it said.

Lundin’s claims include violation of the Electronic Communications Privacy Act, common law invasion of privacy, breach of implied covenant of good faith and fair dealing, breach of implied contract, unjust enrichment and negligence. She seeks an order enjoining FCLV from the unlawful practices alleged, plus actual or statutory damages, punitive damages, prejudgment interest and attorneys’ fees and costs.