Strava collects health data such as step count, sleep information, heart rate, HRV, and VO2max from connected devices and apps like Garmin, Peloton, and Apple Health that you link to your account.
Connecting fitness devices and apps to Strava expands the scope of health data Strava holds significantly, and users may not fully appreciate how much sensitive health data flows into Strava from these integrations.
Collection of health data via third-party integrations triggers analysis under GDPR Article 9, HIPAA (if applicable), CCPA sensitive personal information rules, and the Washington My Health MY Data Act. The explicit commitment not to sell or use for advertising health data from integrations is a notable but contractually limited safeguard.
Compliance intelligence locked
Regulatory citations, enforcement risk, and due diligence action items.
Watcher: regulatory citations. Professional: full compliance memo.
Strava collects highly sensitive personal data including precise GPS routes, heart rate, sleep data, and other health metrics, which may be used to train AI/ML models and contribute to publicly accessible features like the Global Heatmap. Health data from connected devices will not be sold or used for advertising, but activity data can be shared in aggregated or de-identified form and used for AI development. You can adjust your privacy and visibility controls in the Strava app under Settings > Privacy Controls to limit how your data is shared and used.