Strava promises it will not sell or use your health data (such as heart rate, HRV, or VO2max) for advertising, and will not share it with third parties without your consent.
Health and biometric data is among the most sensitive personal information you can share, and this provision limits how it can be monetized.
This provision engages GDPR Article 9 special category data obligations and Washington's My Health MY Data Act; compliance teams should verify that consent mechanisms and data flow controls operationalize this commitment across all third-party integrations.
Compliance intelligence locked
Regulatory citations, enforcement risk, and due diligence action items.
Watcher: regulatory citations. Professional: full compliance memo.
Strava collects highly sensitive personal data including precise GPS location history, health metrics (heart rate, HRV, VO2max), and biometric data, which is used for AI training, advertising personalization, and aggregated into publicly visible features like the Global Heatmap. Your activity data may be shared with third-party advertising partners, though Strava commits not to use health data for advertising. You can adjust your data sharing and visibility settings by navigating to Privacy Controls in the Strava app settings, and can request data deletion by visiting strava.com/athlete/delete_your_account.