Strava maintains a separate Consumer Health Data Policy for US users that governs how it handles sensitive health-related data like heart rate, sleep, and fitness metrics.
Several US states have enacted specific consumer health data laws (e.g., Washington My Health MY Data Act) that give users stronger rights over their health data, and this separate policy is intended to address those obligations.
The existence of a separate Consumer Health Data Policy signals Strava's awareness of Washington My Health MY Data Act (and similar state laws) which broadly define consumer health data and impose strict consent, deletion, and non-discrimination requirements. Compliance teams should assess whether the policy's scope and protections satisfy all applicable state health data statutes.
Compliance intelligence locked
Regulatory citations, enforcement risk, and due diligence action items.
Watcher: regulatory citations. Professional: full compliance memo.
Strava collects highly sensitive personal data including precise GPS location, health metrics, and fitness activity, which is used for AI model training, advertising, and publicly accessible features like the Global Heatmap. Consumers should be aware that even with default settings, their anonymized or aggregated activity data may contribute to public features visible to anyone. You can adjust your privacy controls in Strava account settings at https://www.strava.com/settings/privacy to limit data visibility and opt out of certain data uses.