Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
The policy acknowledges that Food and Activity Diary Data, which includes medications, body measurements, physiological conditions, dietary habits, and progress photos, may qualify as sensitive personal information when it indicates or allows inference of a health condition.
This analysis describes what MyFitnessPal's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision identifies a broad category of health-adjacent data collected through core service features as potentially sensitive, which under CCPA, Washington's My Health MY Data Act, and similar frameworks may impose heightened consent and processing obligations beyond standard data handling requirements.
The agreement establishes that data users voluntarily enter into the food and activity diary, including medications, physiological conditions, and body measurements, may be classified as sensitive personal information, which triggers additional privacy rights in certain states, including the right to opt-in to processing of sensitive information outside the provision of the core service.
Cross-platform context
See how other platforms handle Food and Activity Diary Data as Sensitive Personal Information and similar clauses.
Compare across platforms →Monitoring
MyFitnessPal has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 20 platforms.
"Food and Activity Diary Data may include sensitive personal information when the information indicates or allows someone to infer a health condition. This includes your: Dietary habits; Food, drink, and medications you consume (including as submitted via voice logging) and purchase (via our grocery integrations); Calorie count; Dietary restrictions; Fitness level, activity, and goals; Lifestyle information (e.g., sleeping data); Body measurements (e.g., height, weight, and BMI); Information related to any physiological conditions; Progress photos you may choose to provide.Excerpt from MyFitnessPal's Privacy Policy
1) REGULATORY LANDSCAPE: This provision directly engages CCPA's sensitive personal information category (California Civil Code Section 1798.121), Washington's My Health MY Data Act (which covers consumer health data capable of identifying a health condition), and potentially GDPR Article 9 (special categories of personal data including health data) for EEA users. The FTC also has enforcement authority over deceptive or unfair health data practices under the FTC Act. State AG offices in California and Washington have heightened enforcement posture on health data. 2) GOVERNANCE EXPOSURE: High. The policy collects medications, physiological conditions, body measurements, and health-inferential dietary data at scale through a consumer app. If any of this data is disclosed to advertising or analytics partners without appropriate consent or opt-in, it may create exposure under CCPA's sensitive data provisions or Washington's My Health MY Data Act, which imposes strict consent requirements and data processing restrictions. 3) JURISDICTION FLAGS: Washington state creates the highest exposure, as the My Health MY Data Act broadly covers consumer health data that can identify a health condition and applies to entities not covered by HIPAA. California's CPRA sensitive data opt-in right applies. EEA and UK users are protected by GDPR Article 9 explicit consent requirements for health data processing. 4) CONTRACT AND VENDOR IMPLICATIONS: Data processing agreements with advertising, analytics, and research partners must specifically address restrictions on use of health-inferential data. Any partner receiving Food and Activity Diary Data should be subject to contractual prohibitions on processing for purposes beyond those disclosed, and the adequacy of current vendor agreements should be audited against the sensitive data classification acknowledged in this provision. 5) COMPLIANCE CONSIDERATIONS: Compliance teams should evaluate: (a) whether the consent mechanism for sensitive information processing is operationally implemented for all applicable state residents; (b) whether downstream data flows to advertising and analytics partners include health-adjacent data and whether appropriate restrictions are contractually imposed; (c) whether voice-logged food and medication data is subject to additional state wiretapping or biometric data statutes; and (d) whether the Washington My Health MY Data Act's geofencing and consent requirements apply to the company's data collection infrastructure.
Regulatory citations, enforcement risk, and due diligence action items.
Provision-level monitoring, governance timelines, and regulatory mapping built from archived source documents and historical version tracking.
This provision identifies a broad category of health-adjacent data collected through core service features as potentially sensitive, which under CCPA, Washington's My Health MY Data Act, and similar frameworks may impose heightened consent and processing obligations beyond standard data handling requirements.
The agreement establishes that data users voluntarily enter into the food and activity diary, including medications, physiological conditions, and body measurements, may be classified as sensitive personal information, which triggers additional privacy rights in certain states, including the right to opt-in to processing of sensitive information outside the provision of the core service.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by MyFitnessPal.