Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
The policy states that Peloton does not collect health or medical information but acknowledges that regulatory frameworks in some jurisdictions may classify certain fitness data categories, including heart rate, pregnancy-related workouts, mood-related workouts, and meditation workouts, as health-related information.
This analysis describes what Peloton's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision creates a material tension between Peloton's self-characterization of its data as non-health information and regulatory frameworks that may classify the identified data categories as health information, creating compliance exposure under statutes such as Washington's My Health MY Data Act and potentially HIPAA-adjacent state health data laws. The disclosure that streamed workouts are visible to public profile viewers or approved followers adds a secondary data visibility consideration.
Interpretive note: Whether specific Peloton fitness data categories constitute regulated health data under applicable state statutes depends on jurisdiction-specific legal analysis and regulatory interpretation, which varies across state frameworks.
Under this clause, fitness data categories including heart rate (when a monitor is connected), pregnancy-related workout participation, mood-related workout participation, and meditation workouts may be classified as health-related information under applicable state regulations, even though the policy characterizes Peloton's data collection as outside health or medical information. Workout streaming history is visible to other members if a profile is set to public or followers are permitted to view workout activity.
Cross-platform context
See how other platforms handle Fitness Data and Health-Adjacent Information Processing and similar clauses.
Compare across platforms →Monitoring
Peloton has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 20 platforms.
"Fitness Data. Information relating to your fitness performance and/or workouts, for more information see the FITNESS DATA section below. We do not collect health or medical information, however, some privacy-related regulation may classify some of our data collection and our workouts or accessibility offerings as health-related information. Some examples: heart rate, if you connect a monitor, pregnancy-related workouts, some meditation workouts, workouts related to your mood. Please note that the workouts you stream will be seen if your profile is public, and seen by any follower you allow to view your workout activity.Excerpt from Peloton's Privacy Policy
REGULATORY LANDSCAPE: Washington's My Health MY Data Act applies to consumer health data processed by entities that are not HIPAA-covered entities and may classify workout participation data related to pregnancy, mood, and heart rate as regulated health data. Similar health data statutes have been enacted or proposed in other states including Nevada and Connecticut. CCPA sensitive personal information provisions may apply to health-related inferences derived from fitness data. The FTC has indicated enforcement interest in health data practices outside HIPAA coverage. GOVERNANCE EXPOSURE: High for Washington State and jurisdictions with consumer health data statutes. The policy's assertion that it does not collect health or medical information, combined with its acknowledgment that regulation may classify certain data categories as health-related, creates a documented tension that regulators may assess. The visibility of workout streaming history to public profile viewers or followers creates a secondary disclosure pathway for health-adjacent behavioral data. JURISDICTION FLAGS: Washington My Health MY Data Act creates the most immediate exposure given its broad definition of consumer health data and its application to non-HIPAA entities. Nevada and Connecticut health data statutes may create similar obligations. California CPRA sensitive personal information provisions may apply to health-related inferences. EU/EEA users may have GDPR Article 9 protections applicable where workout data is processed as health data. CONTRACT AND VENDOR IMPLICATIONS: Organizations offering Peloton as an employee wellness benefit should assess whether employee health-adjacent workout data processed through Peloton's platform creates obligations under applicable workplace wellness regulations or HIPAA where a health plan is involved. The public profile visibility of workout history creates a data minimization consideration for enterprise deployments. COMPLIANCE CONSIDERATIONS: Legal teams should evaluate whether Peloton's data practices for pregnancy, mood, and heart rate data satisfy the consent and processing requirements of applicable state consumer health data statutes. The default public profile setting that exposes workout streaming history should be assessed against data minimization principles under GDPR and applicable U.S. state frameworks. Members should be advised to review profile privacy settings to limit workout visibility.
Regulatory citations, enforcement risk, and due diligence action items.
Provision-level monitoring, governance timelines, and regulatory mapping built from archived source documents and historical version tracking.
This provision creates a material tension between Peloton's self-characterization of its data as non-health information and regulatory frameworks that may classify the identified data categories as health information, creating compliance exposure under statutes such as Washington's My Health MY Data Act and potentially HIPAA-adjacent state health data laws. The disclosure that streamed workouts are visible to public profile viewers or …
Under this clause, fitness data categories including heart rate (when a monitor is connected), pregnancy-related workout participation, mood-related workout participation, and meditation workouts may be classified as health-related information under applicable state regulations, even though the policy characterizes Peloton's data collection as outside health or medical information. Workout streaming history is visible to other members if a profile is set …
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Peloton.