My Body, My Data Act of 2023

The My Body, My Data Act of 2023 requires companies (called "regulated entities") that collect personal reproductive or sexual health information - such as health apps, clinics, or service providers - to minimize data collection to only what's necessary for the services individuals request. It grants individuals the right to access, correct, or delete their data, with companies required to provide clear privacy policies, respond to requests within 15 days, and avoid retaliation (like higher prices or denied services) for exercising these rights. The bill also prohibits companies from sharing such data without consent and mandates enforcement through the Federal Trade Commission and private lawsuits, with penalties up to $1,000 per violation. It excludes entities already covered by HIPAA health privacy rules but applies broadly to digital services handling sensitive health data.