Strava promises not to sell health data it receives from connected devices like Garmin or Apple Health, and says it will not use that data for advertising, but it can still use it for other purposes described in the policy including AI development.
This analysis describes what Strava's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This commitment offers meaningful protection for sensitive health metrics like heart rate and VO2max collected from wearables, but the carve-out for 'specific purposes described in this Policy' means AI training and service improvement uses may still apply.
Interpretive note: The interaction between the health data non-sale commitment and the broader AI development authorization elsewhere in the policy creates ambiguity about which uses of connected-device health data are permitted under this specific commitment.
Your heart rate, HRV, sleep, and VO2max data from connected devices will not be sold or used for ads, but the policy reserves the right to use this data for AI model training and service improvement purposes described elsewhere in the document.
How other platforms handle this
to request that your data be transferred to a third party (data portability)
Your organization may allow you to access and export your data in order to back it up or transfer it to a service outside of Google.
To stop us collecting your location information, you can update your device settings, stop using the Service, or uninstall our mobile apps.
"If we collect health information from these integrations (such as heart rate), we will not sell or use it for advertising or other similar purposes; we do not disclose it to third parties without your prior consent; and we will only use it for the specific purposes described in this Policy.Excerpt from Strava's Privacy Policy
REGULATORY LANDSCAPE: This provision engages GDPR Article 9 (special categories of personal data, including health data), CCPA's sensitive personal information provisions, and Washington State's My Health MY Data Act, which imposes heightened consent requirements for …
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Search "[your state] attorney general consumer complaint" to find your state's direct complaint form
Ad personalization controls removed. Contact scanning added. Advertiser data partnerships quietly dropped. A timeline of every change.
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
This commitment offers meaningful protection for sensitive health metrics like heart rate and VO2max collected from wearables, but the carve-out for 'specific purposes described in this Policy' means AI training and service improvement uses may still apply.
Your heart rate, HRV, sleep, and VO2max data from connected devices will not be sold or used for ads, but the policy reserves the right to use this data for AI model training and service improvement purposes described elsewhere in the document.
ConductAtlas has identified this type of provision across 290 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Strava.