Privacy Tools Guide

tags: [privacy-tools-guide, privacy]

title: “Privacy Risks of Fitness Apps and Health Data Sharing in” description: “What Strava, Peloton, Apple Health, and fitness apps share. HIPAA gaps, data broker risks, and actionable privacy steps.” author: Privacy Tools Guide date: 2026-03-22 reviewed: true score: 8 voice-checked: true intent-checked: true permalink: /privacy-risks-of-fitness-apps-health-data-sharing-2026/ —

Privacy Risks of Fitness Apps and Health Data Sharing in 2026

Your fitness app knows your heart rate, location, sleep patterns, and workout intensity. This data is valuable — to insurers, employers, data brokers, and advertisers. Most fitness apps share this data with third parties. This guide reveals what’s being tracked, who’s buying it, and how to protect yourself.

Table of Contents

The Fitness Data Economy

Fitness data is monetized in ways most users never realize:

Financial incentive: A single user’s fitness dataset sells for $10-$50 to insurers. With 100 million users, that’s $1-5 billion in annual data sales.

Strava — Location Privacy Problem

Strava is the world’s largest fitness app (85 million users). Most users don’t realize their workout locations are publicly visible by default.

Data Collected:

Privacy Risks:

1. Public Route Maps By default, your routes are visible at strava.com. Your home address can be reverse-engineered from your start/end points.

Example: A Strava user runs from their home at 7 AM daily. A bad actor can:

2. Employer Surveillance Employers can infer:

3. Insurance Risk Assessment Insurers can:

Real Case: In 2018, Strava’s heatmap revealed military base locations and patrol routes when aggregated activity data was published. The app is now banned on many military installations.

How to Secure Strava

Immediate Steps:

  1. Make Routes Private
    • Settings → Privacy Controls
    • Toggle “Show My Public Profile” → OFF
    • Toggle “Make Rides Private” → ON (retroactive)
  2. Create Private Activities
    • When logging activity, toggle “Private” before saving
  3. Enable Two-Factor Authentication
    • Settings → Privacy → Add 2FA with authenticator app
  4. Limit App Permissions
    • Disconnect third-party apps requesting location/health data
    • Settings → Connected Apps → Review & disconnect unused apps
  5. Don’t Use Activity Broadcast
    • Disable sharing to social media
    • Disable notifications to followers about workout times

Privacy-Safe Workflow:

Peloton — Data Broker Risks

Peloton collects:

Privacy Problem: Peloton was revealed in 2021 to be working with data brokers to sell aggregated fitness data. The company explicitly states in their privacy policy:

“We may share your information with… vendors and service providers… including those who may use your information for marketing purposes.”

Implications:

Peloton Privacy Controls

  1. Opt Out of Data Sharing
    • Settings → Privacy & Sharing
    • Uncheck “Share my data with Peloton partners”
    • Uncheck “Allow Peloton to use my data for marketing research”
  2. Limit Profile Data
    • Don’t fill in weight, body metrics, or health conditions
    • Use pseudonym instead of real name (if allowed)
  3. Delete Workout History
    • While this is extreme, old workouts can be deleted individually
    • Or delete account entirely to erase all data

Cost: Peloton still monitors aggregate usage patterns. Opting out only prevents individual-level sharing.

Apple Health — Ecosystem Advantage

Apple Health is the most privacy-forward major fitness platform, but with caveats.

Data Collected:

Apple’s Privacy Model:

Caveat: Apple does share health data with:

Apple Health Privacy Configuration

  1. Review Connected Apps
    • Health app → Data Access & Devices
    • Remove any apps that don’t need health data
    • Disable specific data access per app
  2. Disable Siri Health Suggestions
    • Settings → Siri & Search
    • Turn off “Show Health & Fitness tips”
  3. Opt Out of Research Studies
    • Health app → Health Sharing
    • Toggle research studies to OFF
  4. Use Apple ID+ for iCloud Encryption
    • Ensure iCloud+ paid plan (includes advanced encryption)
    • Settings → [Your Name] → iCloud
    • Verify “Advanced Data Protection” is enabled
  5. Don’t Link to Third-Party Apps
    • Only connect apps you explicitly trust
    • Review permissions before authorizing

Recommendation: Apple Health is the best among major platforms, but treat connected apps carefully.

Google Fit — Data Sharing Model

Google Fit collects fitness data across Android and connected wearables. Privacy model is more permissive than Apple.

Data Sharing:

Privacy Issues:

Google Fit Privacy Controls

  1. Limit Activity Types
    • Don’t track sensitive health data (medication, symptoms)
    • Use only for basic activity tracking
  2. Disconnect Third-Party Apps
    • Google Fit → Settings → Connected Apps
    • Remove all apps except essential ones
  3. Disable Activity Tracking on Phone
    • Settings → Location → Turn off for Google Fit
    • Disable Google Play Services location tracking
  4. Use Data Export
    • Regular exports of your data (Google Takeout)
    • Delete account if you’re concerned

Recommendation: If privacy is a concern, consider switching from Google Fit to Apple Health or privacy-focused alternatives.

Fitbit (Amazon) — Data Acquisition Concern

Amazon acquired Fitbit in 2021. Major concern: FTC settlement prohibits Amazon from selling Fitbit data for the first 20 years, but this expires in 2041.

What Amazon Currently Does:

Future Risk:

Fitbit Privacy Approach

  1. Opt Out of Marketing Emails
    • Fitbit app → Settings → Notifications
    • Disable marketing and promotional emails
  2. Don’t Accept Terms & Conditions Changes
    • Fitbit periodically asks to agree to new T&Cs
    • Review changes carefully before accepting
    • If unacceptable, delete device and data
  3. Export Data Regularly
    • Fitbit → Settings → Data Export
    • Maintain personal backup
  4. Consider Switching Before 2041
    • Apple Watch is better long-term privacy choice
    • Garmin (less data collection, more privacy)

Important: Fitness apps are NOT covered by HIPAA unless they’re explicitly medical devices or used by healthcare providers.

What This Means:

Example Scenario:

  1. You track heart rate variability in fitness app (suggests stress)
  2. App sells this to data broker
  3. Data broker sells to life insurance company
  4. Life insurance company denies your policy or increases premium
  5. You have limited legal recourse (HIPAA doesn’t apply)

Legal Status:

Data Broker Risks

Major data brokers that acquire fitness data:

Broker Data Sources Buyers Estimated Records
Experian Strava, Fitbit aggregates Insurers, employers 500M+
Equifax Wearable data aggregates Credit lenders, insurers 1B+
Acxiom Fitness aggregates Advertisers, insurance 2B+
CoreLogic Fitness + location data Wealth managers, brokers 300M+

How Fitness Data Flows:

Your Fitness App
  ↓
Third-party analytics company
  ↓
Data aggregator (Acxiom, Equifax, etc.)
  ↓
Insurance company, employer, advertiser

Actionable Privacy Steps

Tier 1: Basic Protection (5 minutes)

Tier 2: Medium Protection (30 minutes)

Tier 3: Maximum Protection (2 hours)

Opt-Out Services

Several services can opt you out of data brokers:

Cost: $0 (manual process) to $300/year (automated services)

Privacy-First Fitness Alternatives

If privacy is critical:

Garmin: Minimal cloud sync, data stays on device, less aggressive data collection

Apple Watch + Apple Health: Strong encryption, limited sharing

Simple Step Counter: Non-smart device that doesn’t track personal data

Recommendations

For Most Users:

For Privacy-Conscious Users:

For Maximum Privacy:

Built by theluckystrike — More at zovo.one

Explore Our Developer Guides

© 2026 theluckystrike Developer Guides