Peloton collects detailed workout and body data from your equipment and app, including heart rate, performance statistics, and physical measurements you enter.
This analysis describes what Peloton's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
Health and fitness data is among the most sensitive categories of personal information, and its collection through always-connected hardware means Peloton builds a detailed picture of your physical condition and activity over time.
Interpretive note: The exact verbatim policy text was not fully accessible due to HTML truncation; the excerpt above reflects the substance of Peloton's disclosed fitness data collection practices based on available document content.
Your heart rate, workout output, and body metrics are collected every time you use Peloton equipment or the app, and this data is stored and may be used for purposes beyond delivering your fitness experience, including advertising personalization.
How other platforms handle this
If we collect health information from these integrations (such as heart rate), we will not sell or use it for advertising or other similar purposes; we do not disclose it to third parties without your prior consent; and we will only use it for the specific purposes described in this Policy.
With your permission, we may also receive data from your mobile device's health app (like Apple HealthKit or Google Health Connect), including hours of sleep and sleep goals. However, we do not infer any health-related characteristics from this information and only process it consistent with the pur...
At Ledger, earning and maintaining our users' trust is a top priority. That's why we are deeply committed not only to protecting your privacy and securing your personal data, but also to being fully transparent about how we handle it.
Monitoring
Peloton has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"We collect information about your fitness activity and health when you use our Products and Services, including workout history, performance data (such as output, cadence, resistance, and pace), heart rate data, and body metrics such as height and weight that you provide.— Excerpt from Peloton's Peloton Privacy Policy
REGULATORY LANDSCAPE: Fitness and health metrics including heart rate and body weight collected through consumer hardware are not covered by HIPAA because Peloton does not operate as a covered entity or business associate in the clinical sense. However, California's CPRA classifies health and medical information as sensitive personal information subject to additional use restrictions and a right to limit use. Illinois BIPA may be implicated if biometric identifiers such as heart rate patterns are processed in ways that constitute biometric data under that statute, though applicability is fact-specific. Washington's My Health MY Data Act and similar state-level health data laws may also engage depending on collection and use specifics. GOVERNANCE EXPOSURE: High. The collection of health-adjacent metrics through connected hardware at scale creates significant compliance exposure across multiple state privacy frameworks. The sensitivity of this data category, combined with its use for advertising purposes, heightens regulatory scrutiny risk particularly in California, Illinois, and Washington. JURISDICTION FLAGS: California residents have a CPRA right to limit use and disclosure of sensitive personal information including health data. EU and UK users benefit from GDPR Article 9 protections for health data, which require explicit consent for processing. Illinois users may have BIPA claims depending on the specific biometric processing involved. Washington state's My Health MY Data Act creates additional obligations for health data collected from Washington residents. CONTRACT AND VENDOR IMPLICATIONS: Any vendor or analytics partner receiving health and fitness data from Peloton's platform must be assessed for compliance with applicable health data frameworks. Data processing agreements should specify permissible uses of health metrics and restrict secondary use. Procurement teams should confirm that advertising technology partners are not receiving raw health metrics without adequate consent and contractual controls. COMPLIANCE CONSIDERATIONS: Compliance teams should conduct a data inventory to map which specific fitness metrics qualify as sensitive personal information under CPRA and analogous state laws. Consent mechanisms for health data processing should be reviewed for adequacy under GDPR Article 9 for EU and UK users. A legitimate interest assessment or consent review should confirm the legal basis for using health metrics in advertising personalization workflows.
Full compliance analysis
Regulatory citations, enforcement risk, and due diligence action items.
Free: track 1 platform + weekly digest. Monitor: 25 platforms + same-day alerts. No credit card required.
Ad personalization controls removed. Contact scanning added. Advertiser data partnerships quietly dropped. A timeline of every change.
Compliance Governance Intelligence
Need to monitor specific governance provisions?
Compliance includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
Health and fitness data is among the most sensitive categories of personal information, and its collection through always-connected hardware means Peloton builds a detailed picture of your physical condition and activity over time.
Your heart rate, workout output, and body metrics are collected every time you use Peloton equipment or the app, and this data is stored and may be used for purposes beyond delivering your fitness experience, including advertising personalization.
ConductAtlas has identified this type of provision across 1 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Peloton.