The world’s largest women’s health app shares how they achieved regulatory readiness while maintaining 1000+ A/B tests per year
With 420 million downloads and a user base that represents one in five women aged 18-35 in markets like the UK and US, Flo Health faced a critical challenge: How to evolve from a wellness app to a regulated medical device without sacrificing speed.
Their answer? Build regulatory compliance into the fabric of development rather than bolting it on top.
The Stakes: Moving Beyond Wellness
“In the beginning we were more like a digital version of a book,” explains Roman Bugaev, Flo’s CTO. “We had health insights, but we needed to go deeper into the medical space – symptom evaluations, risk assessments, clinical-grade capabilities.”
This transition meant Flo needed FDA compliance for some of the new features they were building. The fear was universal: Would regulation slow them down?
Well. Today the numbers tell a different story. Flo runs 400 concurrent A/B tests and executes over 1,000 experiments annually – all while maintaining FDA-compliant processes.
The 87-Day Sprint to Compliance
Working with regulatory platform Ketryx, Flo achieved something remarkable: Full QMS implementation in under three months. Here’s how they broke it down:
- Weeks 1-2: Planning and mapping existing workflows to regulatory requirements
- Weeks 3-10: Training teams, integrating repositories, connecting CI/CD pipelines, configuring documentation systems
- Weeks 11-12: Review, release, and go-live with compliant QMS
The key was automation. “We want engineers focused on building software, not managing spreadsheets,” Bugaev emphasizes. By automating documentation generation and compliance checks through their existing CI/CD pipeline, engineers barely noticed the change.
The Multifunction Device Strategy
Perhaps Flo’s most impactful move was treating their app as a “multifunction device” – separating medical features requiring QMS oversight from non-medical features like their community forums.
“We put medical features under QMS while keeping social features outside,” explains Bugaev. “It’s a clever way to keep some engineers working at full consumer app speed while others build regulated features.”
This approach meant teams working on non-medical features maintained their rapid release cadence, while medical device teams followed appropriate controls – all within the same app.
AI in the Regulatory Framework
With AI underpinning core features like cycle predictions, Flo couldn’t afford to slow ML development. Director of Engineering Simas Tatoris reveals their solution: Treating AI models and traditional software identically in their CI/CD pipeline.
“Whether you’re developing software or training an AI model, the process is relatively the same,” he notes. “The focus is automating steps so engineers can focus on reviewing outputs, not manually copying information.”
This unified approach positions Flo well for the FDA’s emerging PCCP (Predetermined Change Control Plan) framework, which could allow pre-approved AI model updates without new submissions.
Three Lessons for Digital Health Leaders
The Flo team’s advice for others considering this journey:
1. Treat Regulation as a Growth Enabler “If you can release twice as fast as your competitor in a regulated environment, you’ll be twice as successful,” says Bugaev. Compliance becomes a competitive advantage.
2. Implement Compliance by Design Chief Legal Officer Tsimafei Savitski advocates embedding compliance into organizational design: “The best compliance is the one embedded in systems that allows people to follow requirements without observing rigid processes.”
3. Automate Everything Possible Manual documentation kills velocity. Flo’s engineers never left their GitHub workflow – compliance artifacts generate automatically from their normal development process.
The Results That Matter
Post-implementation metrics tell the story:
- No decrease in developer satisfaction for teams working under QMS; engineers report feeling “proud” to work on medical features
- No reduction in release velocity for regulated features
- Daily releases continue for the overall app
Looking Ahead
As Flo prepares to launch more clinical-grade features, their regulatory foundation enables rather than constrains innovation. They’re now exploring FDA’s PCCP guidance for AI updates and continue to expand their medical device portfolio.
For an industry where many fear regulation hinders innovation, Flo proves the opposite: With the right approach, compliance can accelerate credibility and growth.
The message is clear – in women’s health (and beyond), regulatory readiness isn’t about slowing down. It’s about building the infrastructure to move even faster, with confidence.
For a closer look at the systems and decisions behind this transition, check out the full Flo case study and on-demand webinar by Ketryx.
