GDPR and Fitness Apps: Who Sees Your Health Data?

Your fitness app knows when you get up, how your heart beats in your sleep, where you live and which route you run every Tuesday. Hardly any other app category collects such intimate data — and hardly any is installed as carelessly. Yet heart rate, sleep and location histories are classed as specially protected data under the GDPR. This article shows which data sports apps actually collect, where it flows, which concrete rights the GDPR gives you — and how to tell whether an app handles your health data responsibly.

Why your sports data deserves special protection

Article 9 of the GDPR defines a category of "special" personal data — explicitly including health data. That is exactly where the core metrics of every sports app belong: heart rate and heart rate variability reveal training state, fitness and potential illness. Sleep data shows sleep quality, shift rhythms and exhaustion. Anyone analysing these data over months may know your state of health better than your family doctor.

Location data is at least as sensitive: recurring GPS tracks allow your home, workplace and daily routine to be reconstructed with precision. How real the risk is became clear in 2018 with the Strava heat map — aggregated, "anonymised" movement data from soldiers suddenly revealed the running routes and layouts of covert military bases abroad. Anonymising movement data is far harder than providers' marketing suggests.

That is why the GDPR sets stricter requirements for processing health data: it generally requires explicit consent — not just a checkbox in the terms of service —, specific security measures and transparent information about who processes what, and why. That transparency is exactly what you can and should demand as a user.

What sports apps typically collect — and where the data flows

The data collection of modern fitness apps goes far beyond the training values you see on the display. Five categories are common:

• Body and health data: weight, height, age, resting heart rate, HRV, sleep times, sometimes blood pressure and cycle data.
• Training data: distance, pace, power, workout times — building fitness histories over years.
• Location data: GPS tracks of every session, often also background location for live tracking.
• Device and usage data: device model, IP address, in-app behaviour, click paths.
• Profile and contact data: name, email, payment details, sometimes address-book access for "finding friends".

The critical question is where the data goes: many apps — especially free ones — finance themselves through advertising and third-party analytics. Audits by privacy organisations of popular fitness apps regularly find dozens of embedded trackers forwarding device identifiers and usage behaviour to ad networks. Then there is the server question: providers headquartered in the US or running on US cloud infrastructure are subject to the US CLOUD Act — under certain circumstances, US authorities can access European users' data without you ever finding out.

Your rights under the GDPR — applied to sports apps

The GDPR is not theory: it gives you five workable tools that every app provider in the EU — and every provider serving EU users — must honour:

• Access (Art. 15): You may ask at any time which data about you is stored, where it came from, why it is processed and who receives it. An informal email is enough; the answer is free and must generally arrive within one month.
• Rectification (Art. 16): Incorrect entries — a wrong date of birth or outdated body metrics — must be corrected.
• Erasure (Art. 17): The "right to be forgotten". If you withdraw consent or delete your account, training data, profile and location histories must be removed. Exceptions apply only to legal retention duties, such as invoicing records.
• Data portability (Art. 20): You can demand your data in a common, machine-readable format — practically relevant when you want to move your multi-year training archive to another app.
• Objection (Art. 21): Processing based on "legitimate interest" — the ad industry's favourite clause — can be objected to at any time.

If a provider ignores these rights, you can complain to the supervisory authority — in Austria the Datenschutzbehörde (DSB), in Germany the state data protection authorities, in the UK the ICO. The complaint is free and obliges the authority to investigate.

How to recognise a privacy-friendly sports app

Six checkpoints before you entrust an app with your pulse:

• Headquarters and server location: Providers based in the EU with servers in European data centres are directly bound by the GDPR — no detour via third-country transfers. A look at the imprint and the privacy policy is enough.
• Business model: Are you paying with money or with data? Free apps with aggressive advertising typically finance themselves through user data. A fair subscription model is often the more privacy-friendly option.
• Readable privacy policy: Serious providers explain in clear sections which data flows where and which processors are used. Forty pages of legalese without concrete details are a warning sign.
• Minimal permissions: A running app needs location during the workout — not permanently in the background, and certainly no access to contacts or the microphone.
• Self-service export and deletion: Data export and account deletion should work without email ping-pong. Hiding deletion behind conditions or support tickets violates the spirit of Art. 17.
• AI processing in view: If the app uses AI features, it should be clear which data goes to which model. Responsible providers pseudonymise personal details before handing content to AI services.

Six immediate measures for better training privacy

You don't have to wait for new providers — these steps take ten minutes today:

• Review permissions: In the system settings, set location to "only while using the app" and revoke contact, microphone and photo access the app doesn't strictly need.
• Set your profile to private: Most fitness platforms start with public profiles. Unless you explicitly change it, you share workout times, routes and your home area with the internet.
• Disable heat maps and flyby features: Public maps and "who else was here" features reveal start points and routes — switch them off or restrict them to followers.
• Set up privacy zones: Many apps offer zones where GPS tracks are obscured — for example 500 metres around your home and workplace. Enabling them takes a minute.
• Use a pseudonym: Nobody needs your real name for training analysis. A nickname protects you from your sports data being merged with other profiles.
• Clean up old accounts: Letting apps you no longer use keep hoarding your data is an unnecessary risk. Export what you want to keep — then delete the account and its data.

How Peakora implements privacy in practice

Peakora is developed in Austria and runs on servers in the EU — the GDPR applies here not just on paper but technically: there are no advertising networks in the app, no third-party trackers and no sale or sharing of user data. Funding comes exclusively from the subscription model — you pay with money, not with your training data.

The AI features follow a strict principle: before training content is sent to the language model, personal details are pseudonymised, and processing happens via an EU endpoint under a data processing agreement. Your name, email and other identifiers never leave the EU in that process. How the AI training plan compares to a traditional plan technically is covered in a separate article — the privacy architecture behind it is documented publicly in the privacy policy.

The GDPR rights are built as self-service too: your training data stays available across devices via server sync, and account deletion removes the account, synchronisation data and linked tokens completely — no questions asked, no waiting period. Deletion works directly in the app or via the public page peakora.at/konto-loeschen.

Frequently asked questions about GDPR and fitness apps

Does my sports watch data count as health data under GDPR?

Yes, whenever it allows conclusions about your health. Heart rate, heart rate variability, sleep times and blood pressure from fitness apps fall under Article 9 GDPR and enjoy special protection. GPS tracks are sensitive too, because they reveal where you live and work.

Is a fitness app allowed to transfer my data to the US?

Yes, but only under safeguards. The transfer needs a legal basis such as the EU-US Data Privacy Framework or standard contractual clauses. The provider must state in its privacy policy which data flows where and on what legal basis.

How do I get all the data an app has stored about me?

Use your right of access under Article 15 GDPR: send the provider an informal email requesting full access, including all stored data and recipients. The response is free of charge and must generally arrive within one month.

What happens to my data when I delete my account?

The provider must fully erase your personal data under Article 17 GDPR, unless legal retention obligations apply — for example for invoicing data. Training data, profile and location histories should no longer exist on the servers afterwards.

Do I have to give my real name in fitness apps?

No, the principle of data minimisation allows pseudonyms. No app needs your real name for training purposes — it only matters for paid subscriptions and invoicing. Public profiles work with any name you choose.