Your fitness tracker measures heart rate, sleep and steps, and the companion app stores everything in the manufacturer’s cloud. That raises the question of who may process these values and whether you agreed to it when you installed the app. Under data protection law, health data belong to a specially protected category. This guide explains what the General Data Protection Regulation (GDPR) says and what to watch for with wearables and health apps.
Short answer: Under Article 9 (1) GDPR, a provider generally may not process health data such as heart rate or sleep patterns. Exceptions exist, for example the explicit consent to specified purposes under Article 9 (2) point (a). You can withdraw consent and request deletion. Last updated: November 2026.
Key points
- Values that allow conclusions about your state of health count as special categories of personal data.
- Processing such data is generally prohibited under Article 9 (1) GDPR. An exception must apply in the individual case.
- Explicit consent for specified purposes is one such exception under Article 9 (2) point (a).
- Consent is only valid if the purpose is clearly named. A pre-ticked box when installing the app is often not enough.
- You can request information, deletion and data export, as far as the legal situation allows.
Why fitness data can count as health data
Article 9 (1) GDPR lists several categories of data whose processing is prohibited. These include health data as well as genetic data and biometric data used to identify a person uniquely. Whether a single value such as the step count falls under this is a question for the individual case. Once heart rate, sleep phases, blood pressure or indications of illness are recorded, classing the data as health data is the obvious reading.
Apps often link these values to your account, your location or your training goals. This combination allows conclusions that go beyond the single measurement. For that reason, fitness trackers should not be treated as a harmless gadget.
When may a provider store health data?
The basic rule under Article 9 (1) GDPR is that processing is prohibited. The provider therefore needs one of the exceptions in paragraph 2. The best known exception is the explicit consent under point (a) for one or more specified purposes. The wording requires that consent is given explicitly and relates to particular purposes.
Consent is also possible only within narrow limits. According to the statutory text, it is only exceptionally permissible where Union law or national law does not exclude the prohibition from being lifted by consent. For you this means that consent is not always the final word, but it is the most common basis for health apps.
| Question | What you should check |
|---|---|
| Which data are recorded? | Heart rate, sleep, steps, location, cycle data |
| For which purpose? | Training analysis, health advice, advertising or passing data on |
| Who receives the data? | Manufacturer, partners, service providers, advertising networks |
| How long is it stored? | Details in the privacy policy |
| How do you withdraw consent? | A switch in the app or a request to the provider |
The table is a checklist and not an assessment of individual providers. You will find the answers in the app’s privacy policy. Check whether it names concrete purposes or relies on general wording such as improving the service.
How to check your consent
Review the permissions and sharing settings in the app. Data are often passed on to partners for analyses, even though this was not the focus during setup. Switch off everything you do not need. A short check after each app update is worthwhile, because settings can change with an update.
If you want to withdraw consent, this is generally possible at any time. Withdrawal takes effect for the future. Processing carried out up to that point remains unaffected. Additionally request deletion of your data once the purpose has lapsed. The conditions are set out in Article 17 GDPR. The guide Recht auf Löschung: So lässt du Daten bei Online-Diensten entfernen (in German) explains the process in more detail.
Data export and access
Anyone who wants to know which data are held about them can request access. Many providers offer an export function that downloads the measurements as a file. Check the file before you pass it on, because it contains very sensitive information. The guide Auskunftsanspruch nach DSGVO: Welche Daten Unternehmen über dich speichern (in German) explains how to make a formal request for information.
Request only the data you need. An export of all values from several years is not always necessary, but it makes it easier to see which information the provider holds. The provider must answer within one month of receiving the request, and this period can be extended by two months where necessary (Article 12 (3) GDPR).
Typical mistakes with wearables and health apps
The most common mistake is accepting all terms quickly during setup. Anyone who does not read the consent screen often agrees to purposes that have nothing to do with training. The second mistake is using free apps without checking their links to other services. The third mistake is sharing login data or using weak passwords, because health data are an attractive target.
Caution is also advisable with third-party providers that promise analyses. Check whether they have their own privacy policy and which body is responsible for the data. Without a clear allocation, meaningful control is hardly possible.
Frequently asked questions
Is the step count a health data point?
This cannot be said in general. What matters is whether the value allows conclusions about your state of health and in which context it is processed. Combined with other measurements, classing it as health data becomes more likely.
Can I object to the processing without an account?
Consent is the central lever. Whether you can use the product without an account depends on the offer. If you need an account, at least review the privacy settings and switch off sharing with third parties wherever possible.
What happens to my data when I delete the app?
Deleting the app from your phone does not automatically remove the data from the provider’s server. Request deletion explicitly and keep the confirmation. The provider’s answer must follow the deadlines set by the GDPR.
May my employer or university see the values?
Without your explicit consent, third parties should not have access to your health data. Sharing with an employer or university is a separate decision that you can reconsider at any time.
What to do now
- Read the app’s privacy policy and note purposes, recipients and storage period.
- Check the permissions in the app and switch off every transfer you do not need.
- Withdraw consent and request deletion if you no longer want to use the app.
- Keep the information you received and the confirmation of deletion with your records.
Related guides
- Digital Rights in Everyday Life: An Overview for Students
- Sprachaufnahmen löschen: So gehst du mit Sprachassistenten-Daten um (in German)
- Auskunftsanspruch nach DSGVO: Welche Daten Unternehmen über dich speichern
- App-Berechtigungen prüfen: Welche Zugriffe eine App wirklich braucht (in German)
- Data breach at a service: what you should do now
Sources: Article 9 GDPR, gesetze.legal, accessed November 2026 (EU text), Article 17 GDPR, dejure.org, accessed November 2026 (EU text), Article 12 GDPR, gesetze.legal, accessed November 2026 (EU text)
Last updated: November 2026. This guide is general information, not individual advice.
