Strava uses your health data — including heart rate, HRV, and other fitness metrics — to train and improve its AI and machine learning models.
Your sensitive health information is being used not just to provide you a service, but to build Strava's AI products, which raises significant privacy concerns about the secondary use of intimate personal data.
The use of health data for AI/ML training implicates GDPR Article 9 special category data protections, Washington My Health MY Data Act, and similar state health data laws. Legal teams should assess whether consent obtained at collection is sufficient for this secondary use purpose and whether adequate safeguards are in place.
Compliance intelligence locked
Regulatory citations, enforcement risk, and due diligence action items.
Watcher: regulatory citations. Professional: full compliance memo.
Strava collects highly sensitive personal data including precise GPS location, health metrics, and fitness activity, which is used for AI model training, advertising, and publicly accessible features like the Global Heatmap. Consumers should be aware that even with default settings, their anonymized or aggregated activity data may contribute to public features visible to anyone. You can adjust your privacy controls in Strava account settings at https://www.strava.com/settings/privacy to limit data visibility and opt out of certain data uses.