Rethinking the regulation of digital contraception under the medical devices regime

Abstract

Contraceptives are vital healthcare for women and people with wombs. Recently, there has been a rise in the use of ‘digital contraceptives’, a type of ‘femtech’ software available for download on app stores which require data input in order to make predictions about users’ fertility. Digital contraceptives, when marketed as such, fall within the definition of a ‘medical device’ and under the authority of the Medical Devices Regulations 2002 are a ‘medium-risk’ device. However, not all femtech which may be used as contraception is captured by this framework. In this article it is argued that the regulatory category into which digital contraceptives have been placed by the medical devices regime is (a) unduly limited in scope, (b) insufficiently stringent to protect users, considering the grave and life-changing effects this technology can have if things go wrong, and (c) ill-conceived as a regulatory response to a technology that affects large sections of the population. It is suggested here that the broader context in which software as a contraceptive sits (i.e. within the general contraceptive market) is key to understanding the regulatory blindness that is occurring when it comes to digital contraceptives and some other forms of fertility-related femtech. As such, software which can be used as a contraceptive is in fact ‘high risk’ and should be reclassified as such.

Introduction

The ways in which we manage our health are changing dramatically in the digital age. It is notable that in the wake of the COVID-19 pandemic, the adoption of digital healthcare practices has hastened. It is estimated, for example, that the adoption of digital technologies accelerated by 5 years in the space of 8 weeks during the pandemic. ¹ One of the fields of technology that has witnessed this is ‘femtech’, a category of diagnostic software and product aimed specifically at women and people with wombs, which has been described as ‘a major disrupter’ in the global healthcare and technology markets. ² For example, in 2018, investments into women’s health tech startups totalled over $300 million, ³ and by 2025, the industry is projected to reach a market worth of $50 billion. ⁴ Femtech is touted as a response to a lack of attention to women and people with wombs in healthcare and technology, and it is claimed to give them greater control over choices about their bodies. The focus of this article is a sector of femtech that has benefitted from this growing popularity - fertility-related femtech (‘FRF’), including ‘digital contraceptives’ which track and monitor female ⁵ fertility via smartphone apps in order to calculate, via algorithm, the time of the month when users can and cannot get pregnant. FRF make up a substantial proportion of the market, ⁶ and all require the input of user data in order to calculate a user’s menstrual cycle via an algorithm, which may be used by some apps to determine a user’s ‘fertile window’.

Contraceptives are an important part of women’s health, and like any other medicine are stringently regulated in the United Kingdom. Digital contraceptives normally fall within the definition of a ‘medical device’ and under the authority of the United Kingdom’s medical devices (‘MD’) regime. However, some forms of FRF which may be used as a contraceptive (‘FRFC’) (explained further below) sit outwith the MD framework. ⁷ Even when digital contraceptives are captured by the MD regime, the risk level attached to it is ‘medium’, ⁸ despite the potentially devastating consequences contraceptive failure (and the risk of unwanted pregnancy) can have on the physical and mental health of women. Accordingly, the central contention that this article rests on is that FRFC is inadequately regulated when scrutinised from a feminist perspective, ⁹ compared to the legal protections afforded to other contraceptives in common use in the United Kingdom and elsewhere. Unlike other long-term contraceptive options, FRFC is available to users without prescription, often free to download onto one’s smartphone or tablet from an app store. ¹⁰ In a recent consultation by the UK Government, ¹¹ flaws were noted with regard to the current MD regime but it did not make reference to improving the regulation of FRFC.

It is argued here that – compared to other contraceptives that are classed as MDs by the United Kingdom’s regulatory framework – the regulatory category into which FRFC has been placed is (a) unduly limited in scope, (b) insufficiently stringent to protect users considering the grave and life-changing effects this technology can have if things go wrong, and (c) ill-conceived as a regulatory response to a technology that affects large sections of the population. As previously argued by this author and others, ¹² digital contraception raises serious questions about regulation from a feminist conceptual perspective, accounting for women and people with wombs’ needs and interests in their diversity. Yet, overhauling regulation in such a way would be a long-term regulatory project requiring a whole-systems approach, ¹³ and with the implementation of the new MD regime in Great Britain (GB) delayed, ¹⁴ this article offers a more granular solution in the short term to some of the problems others have carved out. ¹⁵ In brief, it is argued here that FRFC is in fact ‘high risk’ and should be reclassified as a Class III MD in GB. The analysis proceeds as follows.

After a brief background to this topic, the first part of this article highlights that the relative lack of robust regulation of FRFC compared to other long-term contraceptives (medicinal or non-medicinal) is of significant concern. This argument has two prongs. First, much of FRFC that has the power to act as and be used as a contraceptive is not actually ‘captured’ by existing regulation. Second, it is asserted that where FRFC is captured by regulation (namely the MD framework), the ‘risk’ classification assigned to them is not high enough to mitigate concerns surrounding effectiveness and lack of evidence base supported by empirical evidence in recent years. ¹⁶ Moreover, these are not the only kinds of concerns at stake. Even if this technology were efficient, there remain deeper concerns surrounding its very nature as a long-term contraceptive that relies almost entirely on data input by the user; it is more akin to the pill than a condom because it necessitates long-term use, yet the condom and FRFC are regulated in the same manner. Therefore, in the second part of this article, it is argued that because FRFCs are readily available to those with smart devices without the legal requirement for a medical consultation of any kind (as is the norm for all long-term contraceptives), it poses a considerable threat to the physical and mental health of its users. As with any contraception, FRFC has the power to dramatically disrupt, impair, and change women’s health and well-being should it fail to work. Yet, the critique offered here is not one of technical performance alone (which some might say could be easily remedied), there is a broader array of factors at play here which suggest that FRFC is plainly underregulated compared to other parallel contraceptives. Hitherto, there has not been any legal or ethical interrogation of this particular matter in GB. For this reason, the fundamental contribution of this article lies in the second part. The broader context in which tech as a contraceptive sits within the general contraceptive market is key, it is argued here, to understanding the regulatory blindness that is occurring when it comes to FRFC. When compared to other contraceptives, like for like, it becomes clear that there are clear gaps when it comes to FRFC.

The rise of digital contraceptives

FRFCs claim to act as a ‘fertility-awareness’-based contraceptive which is, in essence, the ‘calendar’ or ‘rhythm’ method enhanced by an algorithm. Users track key indicators in their menstrual cycle (e.g. bleeding, mucus, headaches, mood swings), and after a few months, ¹⁷ the algorithm claims to be able to predict when the user is fertile, and the app relays this information to the user so she can decide when to abstain from sex in order to avoid pregnancy. Of course, for centuries, women have used calendars, and/or inspected their cervical mucus, to track when they are likely to be fertile. Therefore, while the algorithmic aspect of this method of contraception is new, the ‘science’ of it, for example, seeking predictability, is old. ¹⁸ However, with this new technology, FRFC users’ reproductive fates are left entirely in the metaphorical hands of an algorithm.

The development of any new form of contraceptive of course exists against a backdrop of stigma and control surrounding women’s bodies, particularly their reproductive systems. ¹⁹ And, moreover, it is well known that the burden of contraception predominantly falls on women. Despite advances in research, ²⁰ only two male contraceptive options exist: the male condom and vasectomy. In stark contrast, there is a wide variety of contraceptives available that are aimed at women. The associated unsubtle message is that primary responsibility for not becoming pregnant rests with women. As a general class of products, contraceptives range from single-use items available without prescription (i.e. condoms and diaphragms), to self-administered medicines (e.g. contraceptive pill, vaginal ring, or the patch), to long-term acting reversible contraception (‘LARC’) such as intrauterine devices (IUDs) or the implant. Hormonal contraceptives (e.g. the implant, the contraceptive injection, the contraceptive pill) are regulated in the United Kingdom by an amalgam of European and British regulations ²¹ and require rigorous testing before being made available. ²² While prescription is not mandatory for all hormonal contraceptives, ²³ most contraceptives that are not single-use are ‘prescription-only medicines’. ²⁴ Hormonal contraceptives such as the pill are proven to work well, ²⁵ but some users report challenging side effects. ²⁶ For this reason (among others), some women elect for non-hormonal contraceptives. At the moment, the following are available: caps and diaphragms (both single-use), the copper or silver IUD (also a LARC), and, now, FRFC. In recent years, particularly among younger patients, there has been an increasing awareness of the apparent side effects of, and therefore resistance to, the use of hormonal contraceptives. ²⁷ Reasons cited by those who reject hormonal contraception include increased mood swings, weight gain, depression, headaches, breast tenderness, and other symptoms that some wish to avoid. ²⁸ As Pearson et al highlight

A recent survey of unintended pregnancy in England showed that one-third of women not using contraception stated they had not found a suitable method, and a further one third who were using a contraceptive was not satisfied with the method. There remains an unmet need for contraceptive choices, especially for non-hormonal methods. ²⁹

FRFC is only available to those with smartphones, and, despite people of all ages having them, ³⁰ the use of ‘wearables’ to monitor/control details of health is much more common in 18- to 34-year-olds. ³¹ The trend of using smartphones to manage health is here to stay as this generation gets older, as will FRFC. It is therefore of utmost importance that the regulatory standards for FRFC are sufficiently stringent that it is safe and effective for its users.

The first FRFC approved for use in the EU ³² was ‘Natural Cycles’ (‘NC’), which became shrouded in controversy after its entry to the market. In 2017, the UK Advertising Standards Authority had upheld complaints about the claims made in NC’s advertising, specifically that the claims ‘[h]ighly accurate contraceptive app’ and ‘[c]linically tested alternative to birth control methods’ were misleading. ³³ In January 2018, it was reported by news outlets that a Swedish hospital reported that within 4 months, 37/668 women who sought abortions there had become pregnant while using the NC app. ³⁴ Shortly after, NC removed these claims and introduced a Bluetooth-enabled thermometer. An evolving difference between apps which claim to act as ‘digital contraceptives’ (e.g. NC ³⁵ and Eli), ³⁶ and those that do not, is the increasing use of paired Bluetooth devices to collect additional data to improve algorithmic predictions such as this. Some FRFCs which actively claim to be a digital contraceptive do not have paired devices, however, and many more which do not make this claim (but may still be used as digital contraceptive) also use calendar-based predictions. Despite responding to this scandal and other critiques in the ensuing years, ³⁷ NC has ‘a 13-cycle cumulative pregnancy probability of 7.1%’; ³⁸ this is a higher pregnancy outcome than most common long-term contraceptives. ³⁹ Claims such as ‘clinically tested’ or ‘highly accurate’ sound persuasive, but have little to no regulatory weight behind them.

The claimed purpose of FRFC available on app stores ranges in their explicitness. At one end of the scale, some openly call themselves a contraceptive, for example,

Introducing the intelligent contraceptive app. Natural Cycles is a hormone-free method of contraception that learns your unique cycle. The app identifies ovulation by analysing your basal body temperature which you should measure when you wake up. ⁴⁰

The purpose of other apps, given the description given by other companies, is more nebulous:

Eve by Glow is a savvy period tracker and sex app for women who want to take control of their health and sex lives. Eve predicts your next period and your chances of pregnancy. Track your moods and symptoms to discover trends in your cycles. Take daily sex quizzes to become a sexpert. Own your cycle and feel good in bed. Get it, girl. ⁴¹

Despite one having a more obvious claim to act as a contraceptive than the other, both might reasonably be used as contraceptives by users. Both require the input of user data which is processed by an algorithm in order to display predictions on a calendar interface as to likely periods of menstruation, pre-menstrual syndrome, and importantly the ‘fertile window’. However, only the former would be caught by the Medicine and Healthcare products Regulatory Agency’s (‘MHRA’) regime by explicitly stating their intent for the app to act as a contraceptive. Interestingly, one popular app listed within Apple’s ‘period tracking’ section, ‘Clue’, used to have a feature that indicated users’ ‘fertile windows’. However, in 2021, it removed this feature in recognition of the fact that it may reasonably be assumed to be usable as a contraceptive by users. ⁴² In a statement released on their website, they explained that

The fertile window in the Clue app was an approximation that didn’t account for the variability of each person’s cycle. Because there is too much variation from one person to another, and from cycle to cycle, we determined that it could be misleading to those who wish to use the fertile window to avoid pregnancy. ⁴³

Clue’s descriptor on the App Store now comes with a ‘Note’ at the bottom of the page: ‘Clue should *not* be used as a contraceptive’. ⁴⁴ Other popular apps, which do not explicitly claim to be contraceptives, however, still include indications of the fertile window without any warning on their App page. ⁴⁵

So what has the response been of law and regulation to FRFC, especially in light of the risks exposed by the ‘NC scandal’? As discussed in the next two sections, while some FRFCs are captured by regulation, namely the MD regime, many FRFCs are not covered by this framework and even where they are, they are regulated in a fashion similar to single-use contraceptives (e.g. condoms) rather than other long-term contraceptives (e.g. an IUD).

The regulation of digital contraceptives as medical devices

The regulatory discussion herein focuses on the regulation of non-hormonal contraceptives (e.g. the copper coil or IUD, condoms, and diaphragms) as FRFC also falls into this category. Contraceptives that do not have the primary purpose of administering medicine tend to fall under the MD regime. MD regulation ⁴⁶ in GB ⁴⁷ derives from EU Law, ⁴⁸ and any future changes to MD regulation will be brought through the powers granted by the Medicines and Medical Devices Act 2021, which provides a framework for MD and medicine regulation post-Brexit and supplements the Medical Devices Regulations 2002 (‘MDR 2002’). These regulations are enforced by the MHRA. This section highlights that the MD regime does not pay sufficient attention to the risks posed by FRFC in two ways: it does not capture all software which may be used as ‘digital contraceptives’, and even where it does capture it, the protections users are afforded based on supposed ‘medium risk’ (discussed in more detail below) are lacking in transparency.

The definition of ‘medical device’ and the issue of regulatory capture ⁴⁹

FRFCs that are intended by the manufacturer to be used for controlling conception are defined as ‘medical devices’ under the MDR 2002. ⁵⁰ The manufacturer’s intention, and the regime’s definition of ‘intention’, is thus a crucial factor in determining whether software or products are captured. Yet, there is little detail in the MD regime on this matter, save for ‘data supplied . . . on the labelling’, ‘instructions’, and ‘promotional materials’. ⁵¹ The case of FRFC makes clear the inappropriateness of ‘intention’ as a regulatory threshold as it stands, because the advertising language for FRFC) not explicitly claiming to act as a contraceptive (i.e. period tracking apps still clearly indicates to the user messages of ‘power’, ‘control’, and ‘knowledge’ of when one is and is not fertile. Indication of not being within one’s predicted ‘fertile window’ ⁵² by an app may easily be conflated with an indication of not being able to get pregnant during that time. This is the reason why, as mentioned above, the menstrual cycle–tracking company Clue issued a statement on this and thereafter changed the wording of their marketing.

The ambiguity of ‘intention’ for the purposes of interpreting the MD regime shows that the threshold of ‘intention’ is not a suitable test where user expectations and outcomes (i.e. pregnancy) can be the same as for FRFC products that are captured by the regime. Indeed, the meaning of ‘intended purposes’ in the MDR has been widely criticised as unclear, ⁵³ and a recent consultation has suggested that the issue of intention should be clarified in the MD regulations to make clear that it is subject to an objective test, that is, ‘the intended purpose of the manufacturer of a medical device. . . is assessed at the standpoint of an objective observer and is not a question of what the subjective intention of the manufacturer might be’. ⁵⁴ Such clarification is much needed in the context of FRFCs, because while method (i.e. a calendar-based method operated by an algorithm) and outcome (i.e. pregnancy) are the same in many apps that track cycles and indicate ‘fertile windows’, an MD framework that leaves open the possibility for the subjective intention of the manufacturer to determine an MD regulatory capture is ineffective as a test without further substance. Therefore, it is suggested FRFC that does not fall within the MHRA’s regime because of the lack of stated ‘intention’ to act as a contraceptive should nevertheless be regulated under this regime because of its potential to be used as such, specifically where it indicates a user’s ‘fertile window’, and because of the significant risks that are inherent in the use of such FRFC products.

An issue of regulatory capture may also be found in the meaning of ‘manufacturer’. In the world of technology and software development, multiple companies and/or persons spread across several countries may be attributed as ‘manufacturer’, and a single, easily identifiable company or person may be difficult to trace. ⁵⁵ Focusing on manufacturer intention, rather than consumer protection, exposes a major flaw in the medical devices regime. FRFC may be used for a medical purpose that differs from what the manufacturer intended; it follows that any danger to users posed by the app can be expressly denied by the manufacturer and leave consumers open to serious health risk. It is not often that regulatory frameworks focus on the de facto effect or use of a particular product being regulated, but FRFC demonstrates that in some cases it should focus on effect and use. There is room to infer intention with the marketing of particular products, but to go one step further, it is clear that it is not intention that matters in order to protect the users of FRFC; rather, it is the reasonable way in which it may be used (i.e. as a contraceptive). There is something to be said for the distinct focus that the MD regime has on the product (i.e. ‘does it work?’), rather than the experience of the person(s) using said product (i.e. ‘does it work for all women/users who might use a particular MD?’).

Categorising MDs: flaws in the ‘risk-based’ system

Where devices (including software) are captured by the framework, medical devices are classified ⁵⁶ according to ‘risk’ in one of four categories: I, IIa, IIb, or III. ⁵⁷ The MHRA classification guidance explains that

The classification of medical devices is a ‘risk based’ system based on the vulnerability of the human body taking account of the potential risks associated with the devices. This approach allows the use of a set of criteria that can be combined in various ways in order to determine classification, e.g. duration of contact with the body, degree of invasiveness and local vs. systemic effect . . . ⁵⁸

However, there is no specific explanation regarding the classification of any specific device, including FRFC. There are four types of contraceptives regulated by the MD regime besides FRFC, namely, condoms (without spermicide), diaphragms, IUDs, and condoms with spermicide. The former two (notably both single-use) are Class IIb (considered ‘medium risk’), and the latter two are Class III (considered ‘high risk’). The consequences of the grading system are discussed further below. For now, it is of note that despite requiring months data to provide accurate results, FRFC that is captured ⁵⁹ by the MD regime is considered to be of ‘medium’ risk, like condoms and diaphragms. The rationale for classifying FRFC as a IIb device is not clear. The MHRA’s guidance on the classification of medical devices ⁶⁰ and the original Directive ⁶¹ has an extensive list of when certain devices should and should not be placed in a particular category, but the rationale pertaining to FRFC cannot be gleaned from either of these. Notably there is no comparable medical aim to prevention of pregnancy, and thus it is difficult to apply a rationale used for other MDs to contraceptives; there is a lack of transparency here. Pregnancy and prevention of pregnancy are unique, especially when considered relative to the conditions normally managed by MDs, the lack of specific acknowledgement of this in the frameworks or guidance indicates the regime’s blindness to this fact.

No clear rationale may be gleaned by looking at the types of devices in each class, either. Class III contraceptive devices seemingly have a ‘medicinal’ element (i.e. copper or silver in IUDs and spermicide on condoms); however, it is not clear that the presence of a medicinal substance is what makes them Class III as opposed to another class. The guidance refers to copper and silver in the context of other devices which contain, ‘as an integral part’ ⁶² a substance which can be considered to be a medical product. It is clear here that where the purpose of an IUD is to release progestogens it is not a MD. It is therefore assumed for the purposes of the argument offered here that the integration of a medicinal product is not critical to classification as a Class III MD. Elsewhere in the same guidance, ⁶³ reference is made to the ‘implantable or long-term invasive’ nature of IUDs as a reason for its classification as Class III. One of the key reasons given in the classification guidance for the class of IUDs is they are ‘implantable or long-term invasive’. The guidance clarifies that invasive means inside the body, ⁶⁴ yet again it is not asserted that this is an essential quality. The proxies of risk are merely two examples of the kinds of devices that we consider to pose a greater risk (relative to other MDs), yet as proxies of risk they do not reflect the only kinds of high risk that exist, as has been argued here. This points to a wider view of risk assessment being required of the regime, in order to capture the full range of devices that pose a high degree of risk to their users and therefore require more regulatory oversight.

As explained in the next section, there is in fact no logical rationale for classifying FRFC as IIb considering the relative risk that it presents to users; not only relative to other contraceptives in IIb, but as discussed below, it arguably also presents a high relative risk compared to Class III devices, too. Yet, would re-categorising FRFC as Class III offer more protection to its users in practical terms? The final section of this article offers an explanation as to why the proposed re-categorisation is key to mitigating the high relative risk that FRFC poses compared to other contraceptive MDs.

Performance and evidence requirements: the difference between Classes IIb and III

In GB, MDs must be ‘UKCA’ marked ⁶⁵ (as of 2021, this replaced the European CE mark system, but manufacturers have until July 2024 to comply). The ‘conformity assessment’ routes to achieving a UCKA mark, however, differ depending on the MD’s class. ⁶⁶ To be UKCA marked, all MDs must comply with several requirements, including a ‘clinical evaluation’. ⁶⁷ In short, a clinical evaluation is an ‘assessment and analysis of clinical data pertaining to a medical device in order to verify the clinical safety and performance of the device’ and must be performed during the conformity assessment and periodically throughout the MD’s life on the market. ⁶⁸ Once MDs in Classes IIa, IIb, and III ⁶⁹ have received a certificate from an ‘approved body’ (now the UK Approved Body post-2021), companies may put their device on the market with a UKCA mark. Notably, a ‘clinical evaluation’ can consist of evaluating already existing literature, ⁷⁰ or evidence from a similar device already on market. ⁷¹ Given the precedent set by NC this could be dangerous, given that it was CE marked when that ‘scandal’ occurred. NC had gone through the IIb conformity assessment route of the time, which clearly did not catch several flaws in their evidence and data. This is an obvious safety issue where users rely on that data to not get pregnant, and notably the recent consultation on MDs ⁷² acknowledges that more attention to detail could be required of this process. The root of this issue may be said to lie in the fact that the traditional focus of the MDR has always been safety and performance, ⁷³ yet this approach is arguably still lacking for FRFC given its similarity in function to medicines; indeed, safety and efficacy are the focus of clinical trial regulation.

The conformity process for Class III, however, is more rigorous. Implantable devices and devices in Class III require a ‘clinical investigation’, ⁷⁴ which is a more rigorous process than ‘clinical evaluation’. The objective of a clinical investigation is ‘to assess the safety and clinical performance of the device in question and evaluate whether the device is suitable for the purpose(s) and the population(s) for which it is intended’. ⁷⁵ In brief, it requires manufacturers to take further steps to establish the device’s performance in several ways. In order to meet MHRA requirements it must go through several more rigorous steps. It ‘must’ ⁷⁶

• be performed on a basis of an appropriate plan with well-defined aims and objectives;

• make use of procedures appropriate to the device under examination;

• be performed in circumstances similar to the intended conditions of use;

• include sufficient devices to reflect the aims of the investigation taking into account the risk of the device;

• examine appropriate features involving safety and performance and their effects on patients so that the risk/benefit balance can be satisfactorily addressed;

• fully record all adverse events and report serious adverse events to the MHRA;

• be performed under the responsibility of a medical practitioner or a number of medical practitioners and include the making of a final written report, signed by the medical investigator(s) responsible, which must contain a critical evaluation of all the data collected during the clinical investigation, with appropriate conclusions. ⁷⁷

In short, a clinical investigation is a systematic clinical assessment of the MD in question that uses human participants to assess its safety and performance, which is not (normally) ⁷⁸ required of devices lower than Class III. As an aside it is worth noting that the clinical investigation results need to be submitted as part of a ‘design dossier’, ⁷⁹ another aspect of the conformity assessment route that is only required for Class III. ⁸⁰ No specific guidance on the contents of these documents exists, ⁸¹ but this dossier also includes technical documentation such as details of the manufacturing process, shelf-life testing, and software validation.

In plain terms, the key difference in the regulatory oversight of Class IIb and Class III MD lies in the conformity assessment. The additional steps for Class III, described above, is a vital layer of protection for this analysis. FRFC is of course primarily a form of software and may therefore fall under the umbrella of ‘software as medical devices’ (‘SaMD’) ⁸² for which there is separate guidance written by the MHRA. ⁸³ Significantly, no SaMD is currently under Class III according to the guidance. However, as the next section briefly discusses, there has been recent recognition by the government that SaMD can and should be classified under a broader spectrum than Class I to IIb.

Interim conclusion

A recent MHRA consultation on the future of MD regulation in the United Kingdom acknowledged that the SaMD aspect of the regime needs updating. ⁸⁴ There is an opportunity here to classify software beyond Class IIb (currently no software is classed higher than IIb/‘medium risk’ according to the existing SaMD guidelines). It was noted in the consultation that ‘[w]e propose to change the classification of SaMD to ensure the scrutiny applied to these medical devices is more commensurate with their level of risk and more closely harmonised with international practice’. ⁸⁵ The international practice referred to here is guidance by the International Medical Device Regulators Forum (‘IMDRF’) which discusses a four-level classification system specifically for SaMD (‘Categories I–IV’). ⁸⁶ While these measures are to be welcomed, a glaring omission remains. These guidelines do not acknowledge contraception as SaMD in any way. As such, any plans to align our regime with international practice could fall across a mix of categories and meet multiple tests within the framework. Unintended pregnancy could be ‘critical’ or ‘serious’ by the definitions given therein, which in these guidelines would make it Category IV or III, respectively, but conversely, SaMD that uses data to make predictions about conditions remains Category II here.

The premise upon which the risk-based categories are determined is as best, not transparent, but at worst, internally incoherent. It is not clear why femtech, which can have serious health outcomes for its users, is not placed in a higher risk category alongside more similar contraceptives (for a full discussion of this, see below). The current classification matrix and absence of any clear discussion of the rationale for placing digital contraceptives as Class II SaMDs strongly suggests that this framework needs revisited, at least, as it relates to femtech. While any live consultation can, of course, result in changes to the law and practice, the analysis thus far reveals a much deeper, systemic, and longer-term issue: the current medical devices regime is simply ill-equipped to address the kinds of harms and issues arising from femtech. This is because there is a clear public benefit to women and people with wombs having the tools to learn more about their cycles and fertility. As an example, FRFC shows that ‘intention’ is particularly unsuitable when MDs are available on the market for personal use. For MDs that are prescribed or normally available through healthcare services, medical professionals arguably act as a buffer to make sure (or at least advise) that the intended use and actual use of the device match up. This, of course, is not current practice with FRFC. However, the MHRA, as a regulator of SaMDs, including those which act as contraceptives, has a clear obligation to respond to and regulate the apps described here which currently fall outwith their remit. Even if an objective interpretation of the use of these MDs were implemented (e.g. ‘reasonable use’ instead of ‘intention’) to capture apps which fall outside of the current framework, FRFC users would still be at risk of unintended pregnancy. This is discussed next.

Digital contraceptives in context: why FRFC comes with relative risk

Building on the above, in this section, it is argued that the rationale for grading FRFC IIb devices is neither clear nor defensible, even if we allow for the differences current Class III devices have. It should be noted at the outset of this part of the analysis that a key difference between IUDs and Class II contraceptive devices is that IUDs remain inside the body long term. Yet as discussed above, internal physical placement is not a clear requirement of Class III categorisation, and nor, it is argued here, should it be. While FRFC has no long-term internal physical placement, there are enough similarities between IUDs and FRFC for them to be placed in the same MD class. Moreover, in some ways FRFC use carries additional risks that requires more stringent regulatory oversight than Class II. The MHRA should therefore re-categorise all FRFCs as Class III devices and require that these apps go through a clinical investigation, reported in a ‘design dossier’ (discussed below) for four key reasons: lack of thorough evidence base, unsuitability for diverse populations, dependence on user input, and the fact that often FRFC requires long-term use.

FRFC is not thoroughly evidenced

It is well evidenced that FRFC is not as clinically effective as other forms of contraception (i.e. it is less successful in preventing pregnancy). Indeed, healthcare professionals have expressed scepticism about FRFC given that apps are not tested with the same rigour as other contraceptives, for example, the contraceptive pill or IUDs. ⁸⁷ As this section shows, their scepticism is well-placed.

A key example is the study that NC (the market leader, if not dominator, in ‘digital contraception’) relied on to obtain approval in the EU and the US Food and Drug Administration. It claimed 93% efficacy with ‘typical use’, but has been criticised for its ‘poor design’. ⁸⁸ These critiques included a 2017 study which claimed that NC’s ‘perfect use’ rate was incorrectly calculated, and further, that the ‘available data (based on basal body temperature) are insufficient to establish precision and accuracy of the NC proprietary algorithm’. ⁸⁹ The study used was a prospective observational study of 22,785 users who were mostly of Swedish nationality, with an average age of 29. ⁹⁰ NC’s study claimed that with ‘perfect use’, the app had a failure rate of only 1%, and with ‘typical use’ (i.e. with some errors, forgetful days, etc.) that rate increased to 6.8%. A crucial feature of this data set, as Hough et al. note, however, is that less than 10% of the data in the study qualified as ‘perfect use’, and if they had included all users in the study (i.e. women for whom pregnancy status was unknown by the end of the study) that rate goes down to 9%. ⁹¹ While NC acknowledge both ‘perfect use’ and ‘typical’ use statistics in their marketing, they do not mention that fewer than 10% of women in their study actually managed to achieve ‘perfect use’. ⁹² Furthermore, their website details comparisons of their app to contraceptive methods such as the pill, condoms, and IUDs. NC are not the only company that advertises information in this way; a user could easily infer on reading the claims made by FRFC that they are of comparable risk to other forms of contraceptive, indeed as many companies claim on their websites, ‘no method of contraception is 100% effective’. Yet, displays of efficacy percentages that are similar to common contraceptives are misleading given the lower standard of testing required of FRFC to make these claims compared to medicinal contraceptives such as the pill.

A more recent, independent study found that the pregnancy rate for 1-year typical use of NC was 6.1%, and when they measured the 13-cycle pregnancy rate that increased to 7.1%. ⁹³ Furthermore, a broader review of 73-cycle tracking apps found that all of them failed to correctly predict ovulation. ⁹⁴ This is not necessarily surprising. Fertility awareness–based methods are generally agreed to be less effective than other contraceptive methods in the scientific community. As a 2012 Cochrane Review stated, ‘the comparative efficacy of fertility awareness-based methods of contraception remains unknown . . . contraceptive methods should be properly evaluated, preferably in randomized controlled trials, before adoption and dissemination’. ⁹⁵ Yet it is clear that little rigour is required of the FRFC to make the claims stated in their marketing; for example, one study found that 5% of menstruation and fertility tracking apps cite medical literature. ⁹⁶ Furthermore, the above NC study has never been evaluated by a randomised controlled trial. ⁹⁷

As discussed further below, more stringent regulatory oversight from the MHRA may prevent FRFC with dubious evidence bases from qualifying for use as an MD. Yet, the performance of an app, while key to obtaining the goal of preventing pregnancy for FRFCs user, is not the only feature of this technology that creates an environment of relatively high risk. Even if there was a push from companies to make their products more clinically efficient, as the following subsections describe, deeper concerns remain. For example, FRFC may perform well in some cases, but does it work for all women and users in their diversity? This is the subject of the next section.

FRFC is unsuited to diverse populations

Empirical evidence gathered on FRFC points to their limited evidence base with regard to the range of users FRFC may perform well for. In other words, not only is the effectiveness of FRFC open to question, but it is not being manufactured with a diverse range of users in mind. As argued elsewhere, ‘we cannot have technical accuracy without diversity’, ⁹⁸ yet femtech has been critiqued as assuming user conformity and for creating ‘the idealised subject position of the reproductive citizen’. ⁹⁹

A common strand of this critique is that algorithms tend to be based on the notion of a ‘regular’ menstrual cycle (i.e. 28 days), ¹⁰⁰ whereas menstrual cycles in practice range from 21 to 35 days in length. Furthermore, it has been estimated that between 9% and 14% of women have ‘irregular’ cycles, and 1 in 10 women in the United Kingdom suffer from endometriosis, a condition that can affect women’s menstrual cycles and fertility. ¹⁰¹ There is also mounting evidence that much of the FRFC market tends to make assumptions about aspects other than the user’s health, including sexual orientation, gender identity, having a uterus or womb, being fertile, and intending to get pregnant. ¹⁰² The prompts and ‘emojis’ used in some apps have been critiqued as being heteronormative, ¹⁰³ as too have the phrasing and branding that is often used. ¹⁰⁴ Indeed, the marketing strategies of these apps are not to be overlooked. Generally speaking, these apps often have monosyllabic, ‘feminine’ names (‘Flo’, ‘Clue’, ‘Glow’, ‘Eve’, etc.) and upon download, users are commonly confronted by pink, floral, purportedly feminine designs, which have been critiqued as infantilising and gender normative. ¹⁰⁵ Clearly, this technology is marketed with a specific user group, indeed, a specific kind of ‘woman’, in mind.

It has been argued that ‘we should not dismiss the potential for tech-based contraception to offer affordable, convenient healthcare in countries like the US where birth control is often not covered by health insurance’. ¹⁰⁶ While this is true, this argument only carries weight in countries where smartphones are affordable for the average citizen, as well as any subscription fees and the cost of any Bluetooth devices required. The broadening of contraceptive options available to women is of undeniable benefit, particularly, for example, for those who suffer from severe side effects of hormonal contraception or those who live in remote areas. Yet it would appear that viable, safe options have only been broadened for a particular kind of user, and even then, as described above, it is not always effective (e.g. the NC study above mainly sampled young Swedish nationals, yet analysis of the data shows it was relatively less effective for those users than other contraceptives). It has been suggested that the efficacy of FRFC for a range of users could be improved if it were used in consultation with a healthcare professional, and education about the ‘calendar’ method. ¹⁰⁷ Yet, this solution is limiting for those who struggle, for whatever reason, to access healthcare providers. For example, it has been shown that minority ethnic communities have low levels of trust in healthcare providers in the United Kingdom. ¹⁰⁸ This issue is made more acute because women in some minority ethnic communities are disproportionally negatively impacted by pregnancy and childbirth. ¹⁰⁹

Notwithstanding issues of performance standards, which affect all users, the ineffectiveness of FRFC is clearly exacerbated if the user does not fit into norms regarding menstruation, race, gender, sex, and so on. Only some users, then, can benefit from this apparent ‘diversity of choice’. Diversity and inclusion in medicine and technology is, of course, a broader issue that merits distinct policy attention long term. And it is acknowledged that re-classing FRFC as Class III would not solve this wider systemic and societal issue (or indeed any of the performance issues highlighted here). The claim made here is that FRFC urgently needs more stringent regulatory oversight and that re-categorising FRFC as a Class III MD would offer better protection to users until a thorough overhaul of the policy issues highlighted here can take place. Indeed, these wider social questions about equality and diversity might, in turn, cause us to question the kinds of clinical assessment that is required for Class III devices – Is the time approaching when the assessment criteria need to be revisited and subjected to an equality and diversity impact assessment? The issues of technical efficacy and performance for a diverse set of users sit within a broader context of issues that are inherent to FRFC which cannot be solved by, for example, requiring more rigorous and diverse clinical testing. These two distinctive issues are dealt with next.

FRFC relies heavily on user input

A further reason to advocate that FRFC requires the highest level of regulatory oversight relates to the fact that the degree of risk is greatly affected by the high reliance on user input. ¹¹⁰ As with any health app, its effectiveness in making predictions about users’ bodies and bodily processes depends on the amount and quality of data input. ¹¹¹

FRFC, whether marketed specifically as a ‘digital contraceptive’ or not, relies on users to regularly (i.e. daily) enter information into the app, in addition to taking measurements via a Bluetooth device where one comes paired with the app. For example, NC users must record their temperature at the same time every morning with a thermometer and enter data about their menstrual cycle (among other details). Only in this way can the app produce accurate predictions about users’ periods and fertility. This means that there is little to no room for error via lie-ins, hangovers, illness, forgetting the thermometer while on a weekend trip, a broken thermometer, one-night stands, and so on. Even where user data input is ‘perfect’, it is questionable as to whether the collection of bodily data via devices can be fully relied upon. For example, a person’s temperature can be affected by multiple factors illness, alcohol, stress, and sleep deprivation to name a few. ¹¹² And it is unlikely that data input will ever be ‘perfect’. As Olivia Sudjic, a journalist who required termination of pregnancy after using FRFC, has commented,

I now know that the ideal Cycler is a narrow, rather old-fashioned category of person. She’s in a stable relationship with a stable lifestyle. (Shift-workers, world-travellers, the sickly, the stressed, insomniacs and sluts be advised.) She’s about 29, and rarely experiences fevers or hangovers. She is savvy about fertility and committed to the effort required to track hers. I could add that her phone is never lost or broken and she’s never late to work. She wakes up at the same time every day, with a charged phone and a thermometer within reach. ¹¹³

This is reflected in the trials that have been done on FRFC, as noted above in NC’s own trial only 10% of user data qualified as this type of ‘perfect use’.

The claim here is not necessarily that FRFC is more burdensome, nor that it leaves more room for error than other contraceptives in this particular respect. Other forms of long-term contraceptives may be described as requiring a high degree of ‘user input’, such as the pill. Some forms of the pill require ingestion at a similar time each day and missing one may decrease its effectiveness. Indeed, many contraceptives require a high degree of user input (other than those put in place by a clinician, e.g. the IUD or the implant, which require little to no patient input thereafter). Condoms, for example, require being put on correctly, as do diaphragms and caps. However, this does not undercut… the argument that FRFC requires more regulatory oversight. The pill is a medicine, and not covered by the same regime, and indeed has a high degree of regulatory oversight in its manufacture and sale. IUDs of course require no ‘user input’; they are prescribed and fitted by a healthcare professional, yet they are afforded the highest degree of regulatory oversight in GB by the MD regime. Yet save for some recent exceptions, ¹¹⁴ the pill requires a consultation with and prescription by a healthcare professional. ¹¹⁵ Furthermore, ingestion is a simpler task than the entry of data into a mobile device, which not only takes longer but requires multiple technological aspects to work efficiently, for example, Wi-Fi, no ‘bugs’, a charged phone, and a working Bluetooth connection. Indeed, evidence suggests that apps such as NC have a high discontinuation rate of 54% at 12 months, and it has been suggested that the time-consuming nature of its use, and the high level of dedication required, explains this. ¹¹⁶ In sum, the point here is that the focus is not on likelihood of user misuse per se, but rather similarity of devices in terms of difficulty of use, complexity, and degrees of risk. In other words, FRFC is dissimilar to a condom and more like other methods of contraception.

FRFC is more similar to contraceptives in Class III

IUDs, condoms, diaphragms, and FRFCs are all MDs that are intended to be used to prevent pregnancy, yet IUDs (as Class III MDs) and FRFCs have three key similarities of note: outcome where they fail, degree of user or patient information required, and the fact they are used long term. The rest of this section discusses each, in turn.

First, pregnancy, whether intended or not, can result in complications ranging from low risk to severe or life-threatening. It is well known that pregnancy involves a host of side effects which can affect day-to-day life, ¹¹⁷ giving birth is traumatic for many women, and for marginalised groups childbirth can be relatively dangerous. ¹¹⁸ The health concerns posed are not merely physical, but psychological and social. Furthermore, the process of pregnancy itself, including time off work for any symptoms, and the cost of child-rearing increases financial burdens. Statutory maternity pay (if entitled) is currently £156.66 after the first 6 weeks of leave in the United Kingdom, and over a woman’s lifetime having children is well evidenced to negatively influence women’s careers and income. ¹¹⁹ Where pregnancy is unintended, for those who do not wish to continue the pregnancy, termination of pregnancy can be an upsetting, if not traumatic experience. Pregnancy, therefore, while joyful for many women, is a serious physical, psychosocial, social, and financial undertaking to be lightly. The potential for harm where contraception ‘goes wrong’ is therefore multifaceted and severe. FRFC is more likely to fail than other contraceptives, but this outcome is nonetheless comparable to the other forms of contraceptive regulated by the MD regime. The danger of outcome is not a strong enough reason alone to suggest that FRFC should be regulated as Class III, However, there are two further similarities which require FRFC to be reclassified.

Second, FRFCs and IUDs both require the user to provide detailed and intimate information about their body and fertility plans to the app/their healthcare provider. ¹²⁰ In both of these scenarios, this information is used to deliver suggestions according to their fertility plans (i.e. fitting an IUD or abstaining from sex). Where information given by the app or healthcare provider is false or inappropriate, then it is possible that both forms of contraception may fail to prevent pregnancy. That being said, the quantity and detail of data collected by FRFC arguably far exceeds that given to a healthcare provider, because that detail is given repeatedly, every day. This puts users at risk where data protection rules are breached, for example, if a company’s database were to be hacked. This is in stark contrast to the other Class II devices which are currently regulated with the same standards as FRFC (e.g. condoms) which, to state the obvious, require no conversation or divulgence of information. This not only risks user privacy, which engages other forms of regulation (namely data protection, which of course the MD regime cannot mitigate), ¹²¹ but can lead to wider well-being risks which render women more vulnerable. Privacy International, for example, has found that some FRFC companies share detailed and sensitive health data with Facebook. ¹²² Moreover, as highlighted by recent privacy discussions in the United States following the overturning of Roe v Wade, the sharing of intimate data can lead to prosecution for accessing abortion services. ¹²³

Third, the strongest similarity between FRFC and contraceptives in Class III is that they need to be used long term in order to work. In order for the algorithm to ‘accurately’ predict a user’s FRFC daily data entry is required over a long period of time, akin (it might be argued) to taking the contraceptive pill every day. Popular FRFC websites claim to be able to ‘accurately predict’ cycles and fertility after 2–3 months. ¹²⁴ In order to prevent pregnancy, most contraceptive pills must be taken from the first day of a woman’s menstrual cycle, with most cycles settling into a ‘rhythm’ after several months. If a patient misses the beginning of her/their cycle, then they will need to use additional protection such as a condom for the first 7 days. Both require monitoring and action if a day of taking the pill/data input is missed, and both require use over months, perhaps years, in order to prevent pregnancy during that time. LARCs such as IUDs are similar too, not because they require long-term user input (they are fitted and removed by a healthcare professional), but because they need to be ‘used’ continuously to be effective. Other contraceptives in Class II are single-use, ‘throw-away’ items, that of course require a high degree of ‘user input’ to be put on/in the right place, but of course, there is no requirement for long-term monitoring or ingestion as with FRFC, IUDs and the pill.

Finally, it should also be noted that there is a more subtle, deceptive aspect of FRFC which could be said to straddle all three of the above in a way that misleads its users about the extent to which they are at risk of unwanted pregnancy: their heavy emphasis on empowerment. ¹²⁵ This is misguided for there is a tension here, between supplying users with impressions and narratives of control, and in many ways taking away user control by processing (sometimes selling) their data, and promising an efficacy rate that is only true percentage of users. In sum, FRFC is not only similar to IUDs (as a Class III MD) but also strikingly unlike other contraceptives categorised as Class II (condoms and diaphragms which are single-use only).

Conclusion

Choice for women, trans men, and other people with wombs about the ways in which they access contraception is important, but it is also important that those choices are safe. The choice to access FRFC privately, without consultation, should remain; particularly for those who have difficulty accessing a GP or pharmacies, but regulation of that available choice needs to better reflect the relevant risk it presents. In the case of FRFC, not discussing its use with doctors is not problematic in and of itself; women should be trusted with choices about their bodies. This article is not a call for FRFC, alongside other forms of accessible contraception, to be ‘medicalised’, the argument is rather that user protection and safeguarding should be taken seriously in a regulatory context. The degree of reliance on user input, relative lack of evidence base, relative lack of efficiency, and the devastating consequences these apps can have for users (i.e. unwanted pregnancy) mean that arguably more stringent controls are required. The key concern for this article is, therefore, that while the regulatory ecosystem takes other forms of contraception seriously, it fails to do so with FRFC as a new technological development, driven by consumerism and profit, rather than protectionism. ¹²⁶

Regulatory blindness lies in the fact that the regulatory focus and objective of the current framework that governs FRFC in GB is missing a vital point about the disruptive nature of the apps for women’s wider health and well-being. Ontologically, the FRFCs discussed here are all ‘digital contraceptives’, not merely ‘software’, as it is traditionally understood and should be treated as such by law. In order to achieve an appropriate regulatory response, we need to take a wider view of what is at stake here. Significantly, taking such a view should address deep-rooted concerns with the MD framework discussed in this article: the lack of attention to issues of equality and diversity, the lack of reflexivity and transparency of MD categorisation, and the ‘inadequacy’ of intention as a test for regulatory capture of such a product. In the short term one consequence of this view is protecting users under the current framework by reclassifying FRFC within the MD regime as a Class III device.

Yet, taking a wider view would recognise that the risks that FRFC poses to the mental, social, and physical health and well-being of FRF users cannot be solved within the current landscape. This requires work on the regulatory ecosystem that governs several areas of regulation that affect femtech users, for example, data protection and privacy of users. ¹²⁷ Therefore, it is suggested in this article that while reclassifying FRFC addresses regulatory capture and mitigates the risks highlighted above to an extent (namely by reducing the risk of unintended pregnancy for FRFC users), there is much work to be done in terms of tackling longer-term policy concerns.