Peloton collects detailed data about every workout you do — including heart rate, calories, cadence, and resistance — and can share that information with third-party companies that help run Peloton's services.
Every workout you complete on a Peloton device generates detailed health and fitness data — including heart rate and calories — that Peloton collects and may share with third-party vendors, creating potential exposure of sensitive health indicators beyond your control.
Cross-platform context
See how other platforms handle Health and Fitness Data Collection and similar clauses.
Compare across platforms →Your fitness and health metrics are among the most sensitive personal data categories, and their sharing with third parties creates privacy risks including potential use for insurance, employment, or health assessments beyond your fitness context.
REGULATORY FRAMEWORK: This provision implicates GDPR Art. 9 (special categories of personal data — health data requires explicit consent), CCPA/CPRA §1798.121 (sensitive personal information — health and fitness data requires opt-in for sharing), Illinois Biometric Information Privacy Act (740 ILCS 14/1 et seq.) if biometric identifiers are captured, Washington My Health MY Data Act (2023) which broadly covers consumer health data regardless of HIPAA coverage, and HIPAA 45 C.F.R. Parts 160/164 (Peloton is not a covered entity but the 'HIPAA-adjacent' nature of the data creates reputational and regulatory risk).
Compliance intelligence locked
Regulatory citations, enforcement risk, and due diligence action items.
Watcher: regulatory citations. Professional: full compliance memo.