Fitness Tracker Data Security: A Step-by-Step Health Privacy Guide

Fitness trackers promise healthier habits, but the heart rate, sleep and GPS data they collect can end up in places you never chose. A 2021 exposure of 61 million Apple and Fitbit records through a third-party company most users had never heard of shows how quickly a wellness gadget becomes a privacy problem. This guide explains the current breach rules, what major platforms actually promise, and how to reduce the data you share.

The FTC’s 2026 rule change

On September 9, 2026, the Federal Trade Commission withdrew a 2021 policy statement about breaches by health apps and connected devices, calling the guidance controversial and unnecessary. The statement had been superseded by a 2024 update to the Health Breach Notification Rule, which now explicitly covers health apps and connected devices such as fitness trackers. The withdrawal therefore removes an older interpretive document, not the rule itself.

Under the 2009 version of the rule, vendors of personal health records and related entities must notify affected consumers, the FTC, and prominent media outlets in a state when 500 or more residents are affected. The 2024 revision clarified that the rule applies to developers of health apps not covered by HIPAA, revised the definition of a breach to include unauthorized disclosures, modernized notice requirements, and articulated penalties for non-compliance. The FTC framed the September 2026 withdrawal as consistent with the administration’s deregulatory agenda.

What your tracker collects and who sees it

Modern fitness trackers and health apps record an average of 12 different data types, including heart rate, sleep stages, GPS routes, weight, blood oxygen, menstrual cycle data, stress scores and raw accelerometer readings. One analysis found Fitbit collects up to 24 data types, while Strava uses 21 for purposes beyond basic app functionality. None of this is automatically protected by HIPAA, which applies only to hospitals, insurers, clearinghouses and their business associates—not consumer tech companies.

That gap has real consequences. In 2021 a security researcher discovered an unsecured database holding 61 million Apple and Fitbit user records—names, birthdates, weight, height and location—without password protection. The database belonged to GetHealth, a third-party company most users had never heard of, whose data collection was buried in app terms. Surveys cited by EFF suggest around 40 percent of people in the United States own a wearable health device, and companies can share the data for marketing, insurance pricing, AI training or law enforcement requests.

What major platforms promise

Apple states that it does not sell consumer health personal data, that Health app data is end-to-end encrypted, and that Cycle Tracking predictions are calculated on-device rather than on a server. Apple’s App Review Guideline 5.1.3 also forbids other apps from using HealthKit data for advertising or data mining, and tells developers they may not store personal health information in iCloud. In the Health app, you can open your profile, tap Privacy, then Apps to see which categories each compatible app can track.

Google’s Fitbit line sits in the middle: Google says health and wellness data is not used for Google ads and that it never sells personal information, and it offers deletion within 30 days for most data, up to 90 days for backups. Garmin, by contrast, shares identifiers, activity data and non-precise location with third-party advertising networks, according to its own CCPA notice. Samsung’s policy does not claim an advertising ban for health data, and it names menstrual cycle information as collected data. Oura says it does not sell personal data or share it for cross-context behavioral advertising, and treats reproductive health as sensitive data processed only with consent.

Shrink what you sync

Start with permissions. On an Apple Watch, open the Health app on your iPhone, tap your profile picture, then Devices, select your watch and turn on only the categories you care about; if Health isn’t tracking steps, enable Fitness Tracking in the watch’s Privacy Settings. You can also delete records you entered manually or remove Health data from iCloud in the same settings.

For a quick step-to-distance estimate, you don’t need to create a wearable account or upload more health data. A free web calculator like Step Calculator lets you enter your number of steps, step length and walking speed, and it returns the distance in miles and kilometres plus an estimated walking time—no sign-in and no syncing of heart rate or sleep data. This is a useful option when you only want to convert a step count and would rather keep the rest of your metrics out of the cloud.

A healthier privacy habit

Review the privacy policy of any tracker or companion app before you buy, and search for the words sell, share, de-identified and aggregate. Prefer devices and apps that process health data on-device, allow one-action deletion, and do not run an advertising business. Policies can change, but data you never upload cannot be exposed in a third party’s open database.