Your fitness app and your health data: what GDPR gives you
Health data is a special category under GDPR. What a fitness app may do with your sleep, weight and workouts, your rights, and a checklist before you connect.
Key takeaways
- Under GDPR, data about your health is a special category that needs a strong legal basis, usually your explicit consent.
- You have the right to access, correct, delete and take a copy of your data.
- A good fitness app reads only what it needs, explains why, and never uses health data for advertising.
- Check the privacy policy, the permissions screen and the delete-account path before connecting your health data.
You are about to tap “Allow” on a screen asking for your sleep, weight and body fat. In the EU, that tap carries more weight than it seems: the GDPR treats health data as a special category with stricter rules. Here is what that means for you as a lifter, and how to tell a careful app from a careless one.
What counts as health data
The GDPR protects personal data, and gives extra protection to data concerning health. For a lifter, that typically includes:
- sleep duration and quality;
- weight, body fat and other body composition values;
- anything revealing a medical condition or injury.
A training log on its own is usually less sensitive, but combined with sleep and body data it paints a detailed picture of your health.
What an app needs before using it
Processing health data needs a strong legal basis. For a fitness app, that is usually your explicit consent: a clear, specific “yes” that you can withdraw. On top of the law, Apple and Google set their own rules for apps that read Apple Health or Health Connect, such as never using that data for advertising.
Your rights
| Right | What it means in practice |
|---|---|
| Access | Ask what data the app holds about you |
| Rectification | Correct wrong data |
| Erasure | Delete your account and data |
| Portability | Get a copy of your data in a usable format |
| Withdraw consent | Stop the processing based on consent, anytime |
| Complaint | Contact your national data protection authority |
Checklist before you connect
- Read the permissions screen. Does the app ask only for what it needs? A training app has little reason to want your heart-rate history if it never shows it.
- Read only, or write too? Many apps only need to read.
- Advertising. The privacy policy should state that health data is never used for ads.
- Where the data goes. Is it stored on servers, and where? Is any of it kept only on your phone?
- AI features. If the app sends data to an AI model, it should say so and, for health data, ask first.
- Deletion. Is there a clear delete-account path in the app and on the website?
See also Health Connect on Android and Apple Health for strength training.
How rythme helps
rythme reads health data only with your permission and never writes to Apple Health or Health Connect. Body composition stays on your phone; it is sent to an AI analysis only if you explicitly agree, and you can withdraw that consent anytime. Health data is never sold and never used for advertising, and you can delete your account in the app or from our delete-account page. Full details: privacy policy.
FAQ
Is fitness data health data under GDPR?
Data that reveals information about your health, such as sleep, body composition or medical conditions, is treated as health data. Simple workout logs can become health data when combined with other information.
Can a fitness app sell my health data?
In the EU, processing health data needs a strong legal basis, and the app stores add their own rules. Google's Health Connect policy, for example, forbids selling or using that data for advertising.
How do I delete my data from a fitness app?
Look for a delete-account option in the app settings and a deletion page on the app's website. Both Apple and Google require apps with accounts to offer deletion.
Sources
This article is general information, not medical advice. Talk to a qualified professional about your own health.
