When you connect devices like Garmin or Apple Health, Strava collects sensitive health data including heart rate, HRV, sleep, and VO2max, but commits not to sell this data or use it for advertising, and not to share it with third parties without your consent.
This analysis describes what Strava's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision creates operational constraints on how Strava handles health-category data distinct from other activity data. By categorizing certain data streams (heart rate, HRV, sleep information) as health information subject to stricter protocols, the clause establishes a differentiated data handling framework that requires consent-gating and limits monetization pathways for that category of information.
Your heart rate, sleep, HRV, and VO2max data from connected devices like Garmin or Apple Health cannot be sold or used for advertising by Strava, which is a stronger protection than the default for other personal data on the platform.
How other platforms handle this
Customer may not distribute or disclose to third parties the results of benchmarking, competitive analysis, regression or performance data relating to the Software without the prior written permission from NVIDIA...
Discriminate regarding access to communities or groups that you create, manage, lead, or participate in.
You may not display any personal contact, banking, or peer-to-peer payment information, whether in relation to you or any other person (for example, names, home addresses or postcodes, telephone numbers, email addresses, URLs, credit/debit card...)
"We collect information (including Activity Data) from devices and apps you choose to connect to Strava, such as your Garmin device, Peloton account, or Apple Health app. This could include, for example, step count, sleep information, heart rate, HRV, or VO2max. If we collect health information from these integrations (such as heart rate), we will not sell or use it for advertising or other similar purposes; we do not disclose it to third parties without your prior consent; and we will only use it for the specific purposes described in this Policy.Excerpt from Strava's Privacy Policy
REGULATORY FRAMEWORK: This provision directly responds to obligations under the Washington My Health MY Data Act (SB 1155, effective March 2024), Nevada Consumer Health Data Privacy Law (SB 370), and Connecticut Data Privacy Act health …
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Search "[your state] attorney general consumer complaint" to find your state's direct complaint form
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
This provision creates operational constraints on how Strava handles health-category data distinct from other activity data. By categorizing certain data streams (heart rate, HRV, sleep information) as health information subject to stricter protocols, the clause establishes a differentiated data handling framework that requires consent-gating and limits monetization pathways for that category of information.
Your heart rate, sleep, HRV, and VO2max data from connected devices like Garmin or Apple Health cannot be sold or used for advertising by Strava, which is a stronger protection than the default for other personal data on the platform.
ConductAtlas has identified this type of provision across 282 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Strava.