Health-Data Privacy Basics
Sources and review status
Review pending — this text hasn’t been signed off by a reviewer yet.
See this lesson’s sources0% read · 2 min left
Fitness and health data is sensitive and often not covered by medical-privacy laws — know who can see it, where it's stored, and what you're consenting to share.
Detail
Tracking generates a detailed, sensitive record: location traces, sleep, heart rate, weight, menstrual cycle (see Menstrual-Cycle Tracking), and inferred health states. Basic privacy literacy matters because of a common misconception:
- Consumer fitness data is usually not "medical records." Laws like the US HIPAA generally cover data held by healthcare providers/insurers, not most consumer fitness apps and wearables. So a workout app's data may have far fewer legal protections than you'd assume. In the EU/UK, GDPR treats health data as a special category requiring explicit consent — protections vary a lot by jurisdiction.
Practical basics for users and app builders:
- Read what's collected and shared. Many apps share or sell data to third parties / advertisers; check the privacy policy and the export/delete options.
- Mind location data. GPS traces can reveal home and routine; use privacy zones around sensitive locations and be cautious with public activity sharing.
- Account security. Strong unique password, 2FA, and reviewing connected third-party app permissions (data shared via integrations).
- Especially sensitive categories. Reproductive/menstrual and any condition-related data warrant extra care, including in jurisdictions where such data could carry legal exposure.
- Consent is granular. "Sign in" is not the same as consenting to data resale; look for per-purpose toggles.
For the data layer being designed here: minimize collection, store securely, make export and deletion easy, and default to private sharing — privacy-by-design. Note composite scores and raw signals are equally sensitive (see Readiness, Recovery, and Strain Scores).
Key facts
- Most consumer fitness data is not HIPAA-protected medical data.
- GDPR (EU/UK) treats health data as special-category, requiring explicit consent.
- Apps may share/sell data to third parties — check policy, exports, and deletion options.
- GPS traces expose home/routine; use privacy zones and cautious public sharing.
- Secure accounts (unique password, 2FA); reproductive data warrants extra care.
Connections
- Menstrual-Cycle Tracking — an especially sensitive data category.
- Readiness, Recovery, and Strain Scores — composite/raw signals are sensitive too.
- Building a Simple Dashboard — design with privacy-by-default.
- Fitness Tracker & Smartwatch — app/integration permissions to review.
Sources
Keep this lesson, or ask how it applies to you.
Educational content only — not medical advice. Always consult a qualified professional for individualized guidance, especially around injury, pregnancy, or medical conditions.