Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
With user permission, the policy authorizes collection of health data from connected devices including continuous glucose monitors, heart rate monitors, activity trackers, scales, and wearables, as well as from platform health repositories such as Apple HealthKit and Google Health Connect.
This analysis describes what MyFitnessPal's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes that highly sensitive physiological data, including continuous glucose monitoring readings, heart rate, and body composition metrics, may be ingested from connected devices and platform health repositories into MyFitnessPal's data environment, subject to the broader data use and disclosure practices described in this policy.
The agreement authorizes ingestion of continuous glucose monitor data, heart rate data, and other wearable-sourced physiological data into MyFitnessPal's systems with user permission; the policy separately states that data received from HealthKit and Google Health Connect will not be used for marketing and advertising or transferred to third parties for marketing and advertising purposes.
Cross-platform context
See how other platforms handle Connected Health Device Data Collection and similar clauses.
Compare across platforms →Monitoring
MyFitnessPal has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 20 platforms.
"Certain connected devices, such as heart rate monitors, Continuous Glucose Monitoring devices, activity trackers, exercise equipment, scales, and/or wearables, that integrate with the Services, may allow us to collect Food and Activity Diary Data with your permission. With your permission, we may also collect relevant data from your device's health and fitness repository, such as Apple's HealthKit or Android's Google Health Connect.Excerpt from MyFitnessPal's Privacy Policy
1) REGULATORY LANDSCAPE: Collection of continuous glucose monitoring and other physiological device data engages Washington's My Health MY Data Act, CCPA sensitive personal information provisions, and potentially GDPR Article 9 for EEA users. The policy's carve-out restricting HealthKit and Google Health Connect data from marketing use reflects Apple and Google platform policy requirements. HIPAA does not apply to MyFitnessPal as a consumer app outside a covered entity relationship, but FTC health breach notification rules may apply. 2) GOVERNANCE EXPOSURE: High. Continuous glucose monitoring data and physiological metrics from wearables are among the most sensitive categories of consumer health data. The policy restricts use of HealthKit and Health Connect data for marketing, but the broader Food and Activity Diary Data collection is subject to the full range of uses and disclosures described in the policy, including research partner disclosures. 3) JURISDICTION FLAGS: Washington's My Health MY Data Act applies to consumer health data collected from Washington residents regardless of HIPAA coverage. California CPRA sensitive data provisions apply. EEA users are protected by GDPR Article 9 explicit consent requirements for health data. Illinois users should note that physiological data may intersect with BIPA depending on the specific data modalities collected. 4) CONTRACT AND VENDOR IMPLICATIONS: Apple and Google platform data use restrictions on HealthKit and Health Connect data are incorporated by reference through platform terms, creating an additional contractual layer governing use of device-sourced data. Research partner agreements should be audited to confirm that physiological device data is not transferred under the research partner disclosure category. 5) COMPLIANCE CONSIDERATIONS: Compliance teams should evaluate: (a) whether the permission mechanism for connected device data collection constitutes valid consent under GDPR and applicable state law; (b) whether the marketing restriction on HealthKit and Health Connect data is operationally enforced in data pipelines; (c) whether FTC Health Breach Notification Rule obligations apply given the collection of personal health records from connected devices; and (d) whether Washington My Health MY Data Act consent and geofencing requirements are satisfied for Washington residents.
Regulatory citations, enforcement risk, and due diligence action items.
Provision-level monitoring, governance timelines, and regulatory mapping built from archived source documents and historical version tracking.
This provision establishes that highly sensitive physiological data, including continuous glucose monitoring readings, heart rate, and body composition metrics, may be ingested from connected devices and platform health repositories into MyFitnessPal's data environment, subject to the broader data use and disclosure practices described in this policy.
The agreement authorizes ingestion of continuous glucose monitor data, heart rate data, and other wearable-sourced physiological data into MyFitnessPal's systems with user permission; the policy separately states that data received from HealthKit and Google Health Connect will not be used for marketing and advertising or transferred to third parties for marketing and advertising purposes.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by MyFitnessPal.