The Calmara.ai STI Screening Tool Is a Privacy Nightmare

I’ve been out of the herpes patient advocacy game for a few years now, but every so often a startup founder sends me a cold email about their new company. Sometimes it’s a dating app for people with STIs (which I am firmly against). Sometimes it’s a weird badge you can add to your social media profile that verifies you are STI free (I am not the target market for this!). I have heard from the freaks at PositiveSingles upwards of a dozen times over the years, mostly because they outsource their influencer marketing to a revolving door of overseas freelancers who have no way of knowing that I’ve begged the company to stop contacting me.

I am deeply cynical about entrepreneurs who move into the STI space, especially when they have no background in sex education or public health. People with STIs are a vulnerable population who are easy to exploit. Stigma creates a cloud of isolation, misinformation, and despair around an STI diagnosis, and desperate people are easy to scam. All too often, entrepreneurs sell products that exploit the fear and insecurity of people living with STIs, and add to the very stigma they claim to want to fight. Whether it’s a tool that anonymously informs someone you’ve slept with that they should get tested for an STI, or an herbal treatment with no scientific studies to prove its efficacy or FDA approval, there is a potential for tremendous harm.

The same goes for herpes coaches, by the way. Anyone who charges hundreds of dollars for a one-on-one phone call with themselves is a scam artist. I’m sorry, but having personal experience with an STI does not qualify you to coach anyone in how to handle it. There is a reason that therapists go to graduate school.

But back to the entrepreneurs. STI-related tech startups pop up every few months and inevitably find my contact information, or that of my friend Emily Depasse, a sex educator who also has herpes. This morning Emily made a video about a new service called Calmara, created by the company HeHealth. With Gen Z-friendly illustrations and “bestie” brand voice, Calmara claims to use AI to screen photos uploaded by users for STIs. They want you to open their website, take a picture of your partner’s genitals before having sex, and upload it to their database so that an AI can review it and scan for 10+ “conditions” including herpes, syphilis, and HPV.

Buried in the Q&A section of the website, Calmara makes it clear-ish that they cannot actually diagnose anyone with any STI, the AI only “works” for penises, and you should really just go to a doctor for an accurate STI test. But you wouldn’t glean any of that from their cocky Instagram or glossy imagery. “No cap, just facts,” the copy reads beneath an illustration of a dancing robot. “Up to 90% accuracy, our AI is grounded in real science.” Uh… sure.

On its face, the service is so misguided that it’s easy to dismiss it as satire. But the CEO and co-founder’s LinkedIn posts are heartbreakingly and maddeningly genuine. In a post that starts by acknowledging that the company expected Calmara to be controversial, Mei-Ling Lu wrote, “I was recently reminded of the painful stigma and silent struggles women endure when a close friend shared her story of an HPV-positive pap smear. Accusations and blame from her partner followed (THE AUDACITY!!!!!!!!), reflecting the sheer ignorance — HPV isn’t just a ‘women’s issue’; it’s a shared one.”

Lu went on to say that “health decisions, especially those concerning STIs like HPV, need to be informed, free from stigma, and supported by mutual responsibility.”

It’s a noble intention, and one I share! I was given herpes by a partner who either didn’t know his herpes STI status or didn’t care to tell me the truth. We absolutely need to create a culture where folks are educated about STIs and empowered to discuss sexual health safely and openly with partners. That’s why I dedicated years of my life to writing and talking about STI stigma, disclosure, and safer sex practices. But STI stigma is a deeply human problem that cannot be eradicated by mobile apps or artificial intelligence. Education requires actual education, not tech hacks.

So Calmara is real, not satire, and available to download right now. There are many layers to why this is terrible news.

First, the most common symptom of STIs is no symptom at all. You cannot know someone’s STI status from just looking at their genitals, and you definitely cannot diagnose someone with an STI from a picture taken on a cellphone. I just don’t buy Calmara’s claim that their scans are accurate or trustworthy. Even if the AI they’ve created can recognize physical symptoms as that of a specific virus, what about the much more common reality of people who are STI+ and asymptomatic? Services like this create a false sense of security, making people think they know their STI status, or that of their partner, when in reality they have no real information.

To use herpes as an example, you cannot know your status unless a culture is taken directly from a sore, or you get a full blood test that still might return a false positive. Herpes can be transmitted when no visible symptoms are present. Theoretically you could take a picture of a sore on your partner’s penis and submit that photo to the Calmara site for confirmation that they might have herpes. But in that case, why not go to the doctor? It’s not worth the risk that Calmara’s AI could give you a false negative result and give you the false confidence to have sex with someone during an active herpes outbreak.

I do not have faith that artificial intelligence based on visual learning can provide accurate information for young people in possession of a smartphone in 60 seconds. I also do not think it is rational to expect a woman to stop before sex to ask their male partner to let her take a picture of his penis, upload that image to a website, and then wait for the results. This is not how human beings interact with each other. This is not how to normalize conversations about sexual health. And this is not how to promote safer sex practices.

As Calmara’s own fine print says, “These offerings should not be used as substitutes for professional medical advice, diagnosis, treatment, or management of any disease or condition.” So what is this service for? Literally why does it exist when it cannot provide the service it advertises?

Second, artificial intelligence is not that intelligent. I don’t have the insight or the expertise to judge whether or not HeHealth’s “cutting edge technology” that classifies “penile diseases” is trustworthy, but I do know that AI ventures are the new startup goldrush. AI is a glossy, opaque term that attracts venture capital and press buzz. For the average Joe, AI sounds impressive and abstract, much like the blockchain and Web3.

But for folks with a passing understanding of AI technology, this type of marketing sends up red flags. Generative AI is known to absorb and distribute corrupt information from bad data sets, and hallucinate weird nonsense. Any startup founder can slap the word “AI” on a product to make it sound more innovative and impressive than it really is.

Calmara’s Q&A section anticipates this criticism. “Calmara’s AI is pretty sharp, but it’s not infallible. There’s a slim chance it might throw a false positive — like sounding an alarm when there’s no fire — or miss the mark with a false negative, skipping over something it should’ve caught. Sometimes AI gets a bit too imaginative, seeing things (we call ‘em hallucinations) that aren’t actually there.”

So what is the user supposed to make of this confession that their AI makes mistakes? Are we supposed to trust it or what? “While Calmara does a stellar job for a quick peek, it’s just the first step. If your gut or Calmara suggests something’s up, or if you just wanna be sure, following up with a healthcare provider is your best bet.”

Oh, so we should go to the doctor for accurate STI testing! Which once again renders this product useless! Again I ask, why does this exist?

Finally, the data privacy ramifications here are a nightmare. At the top of its website, Calmara claims to be “Encrypted, anonymized, and under lock.” The Q&A says that users don’t need to submit any personal information like names, birthdays, or addresses. As for storing data, “our lair’s built on AWS cloud magic, making us HIPAA compliant. What’s that mean? Your info’s stashed in a digital stronghold, wrapped in layers of encryption, and handled by rules that would make even the strictest dungeon master proud. Your secrets are safe in our vault, guarded by the latest in cloud castle security.”

So Calmara keeps our dick pics locked in a metaphorical dungeon where they’ll never see the light of day. Sounds great! But digital privacy expert Carey Lening took a peek at the Calmara Terms of Service and Privacy Policy and was less than impressed. Lening wrote on Substack, the Privacy Policy “doesn’t include any details on how images are used (beyond to deliver services and to ‘enhance and innovate our service offerings’), their legal reasons for processing data beyond the image itself, how long images are kept, how these very intimate images are secured, how data is shared and with whom.”

Lening concludes, “Given that the only personal data/information they admit to collecting is images, cookies, and ‘user behaviors’ and their statement is extremely vague about what they do with this data, it seems entirely reasonable to assume that they are mass-blasting dick pics and everything else with all parties involved.”

Given that Calmara is currently free to use, it’s natural to wonder if the pictures uploaded by users are what HeHealth plans to monetize, either to sell to other companies or train additional algorithms. Users get an unreliable scan for STIs, and in exchange they give up pictures of their genitals that HeHealth can use however it wants (I am speculating, do not sue me). Not great, Bob!

It’s also worth asking about age verification. How Calmara intends to handle pictures uploaded by minors? In their Terms and Conditions, they state “HeHealth Inc. requires all users to affirm that they are of legal adult age (18 years or older) as part of the account registration process. However, HeHealth Inc. does not have the means to verify the age of individuals who access and use the Service.”

When I opened Calmara’s website on my phone and uploaded a random photo of a penis I found on Google Image search, I was never asked to affirm that I was of legal age, or that my partner was of legal age. It didn’t even ask me to scroll through their ToS before using the tool. Instead, a line of copy says, “By continuing, you agree to Calmara’s Terms & Conditions and Privacy Policy.” They’re not even trying to confirm that users are not minors.

Back to the Terms of Service! They go on to say, “HeHealth Inc. shall not be held liable for any use of the Service by individuals who are not legal adults, including any consequences arising from such use.” Because simply wishing away responsibility for collecting the sexually explicit photographs of minors is a great legal strategy! Calmara is explicitly targeting young users with its slang-heavy branding, but does not do enough (or anything) to make sure those users are eighteen years of age or older. It does not even tell users that they need to be 18-years-old or above to use the service. This is a disaster waiting to happen.

I could throw a lot more shade at Calmara for their cringe social media presence and their website typos (“Can I use Calmara on other area other than penis?”) I’ll resist the urge, because pettiness undermines the real harm that services like Calmara can cause for users. It is profoundly unethical to ask someone to upload an intimate photograph to your database, especially if they are not thinking clearly because they are worried that they or their partner may have an STI. It’s even more unethical to target that service at young people who may be underage.

Not every problem has or needs a technological solution. While advances like virtual healthcare visits can improve our access to medical treatment, there is no replacement for an in-person evaluation and STI testing from a trained professional. Likewise, an MBA graduate doesn’t know better than the public health experts who have been studying the issue of STI stigma for decades. Startup founders are not going to save us.

Ask any sex educator if you should upload a picture of your dick to an app for an STI diagnosis. They will all tell you the same thing: Absolutely fucking not.

If you enjoyed this article, please consider subscribing to my Patreon. My patrons make free posts like this one possible. For $3 a month, you will get access to essays about sexual and mental health, relationships, gender issues and pop culture. 

And hey, while you’re here, why not watch my TEDx talk about having herpes?

Featured Images taken from the calmara.ai website.

Posted by

Ella Dawson is a sex and culture critic and a digital strategist. She drinks too much Diet Coke.