Fitness tracker privacy: control who sees your health data

Where does your fitness watch data go?

A fitness watch sends its readings via Bluetooth to the manufacturer's app on your phone. From there they can reach your account with the manufacturer and your phone's health platform: the Health app on iPhone, Health Connect on Android. Any app you give access there can read that data or add its own.

According to Google, Health Connect is a database stored on your device. Apple says Health information is encrypted while it is stored in iCloud and as it moves between iCloud and your device. End-to-end encryption requires iOS 12 or later and two-factor authentication. To choose that extra protection, see SMS, app or passkey: which second factor suits you?.

Why is health data specially protected?

Under the General Data Protection Regulation (GDPR), data concerning health is sensitive data. The European Commission explains that processing it is prohibited as a general rule, with exceptions, for example when you have given explicit consent. Consent must be freely given, specific, informed and unambiguous, and you have the right to withdraw it at any time.

In Switzerland, EU law does not apply automatically; Swiss data protection law applies, overseen by the Federal Data Protection and Information Commissioner (FDPIC). Either way, every category you allow an app to read is a decision you can revisit.

iPhone: which apps get data from the Health app?

In the Health app you decide, app by app, which health categories each one receives.

Tip: If your Health data syncs over iCloud, deleting data on one device also removes it from every other device signed in to the same iCloud account, Apple warns.

Android: how do you review permissions in Health Connect?

On Android, Health Connect is the central store. Menus may look slightly different depending on the phone manufacturer.

Important: Google points out that when you remove data permissions, you do not remove the stored data. If you no longer use an app, delete its data too. Data an app has already copied to its own account must be deleted there or by asking the provider.

What should you set in the manufacturer's app?

The manufacturer's app has its own settings that neither Health nor Health Connect controls. Labels differ by brand; look for privacy, connected services or partners, and visibility.

• Connected services: disconnect apps you no longer use.
• Visibility: set activities, routes and profile to private. Italy's data protection authority, the Garante, warns that published usual routes can reveal when you are away from home.
• Connections: Germany's BSI recommends enabling the watch's interfaces to other devices only when essential and disabling them again afterwards.
• Updates: install them immediately and recheck permissions, as every update could alter them (BSI).
• Access: use a PIN on the watch if offered, and two-factor authentication for the account.

France's CNIL suggests switching off automatic data sharing when you link a connected device to social networks. To check what else the app may do on your phone, such as location or contacts, see Does this app need your contacts? Reviewing permissions. For a child's watch, read Smartwatch and tracker for your child: location yes, listening in no.

Insurer or reward scheme: what are you really sharing?

Some insurers and fitness offers reward activity when you link their app to your watch or health platform. Through Health or Health Connect, such an app gets only the categories you allow, plus what you enter in the app itself. Spain's data protection authority, the AEPD, has pointed to the risk that insurers could access such data when policies are taken out.

• If the scheme only counts steps, share only steps, not heart rate, sleep or weight.
• Read the privacy notice: what the provider uses the data for and who receives it.
• Find out beforehand what happens to your data if you leave.

You can withdraw consent at any time: remove the permission and ask the provider to erase data already sent. In Switzerland, the FDPIC notes that revoking consent does not automatically lead to deletion, so ask explicitly. If you are unsure whether a scheme suits you or what your contract allows, get individual advice.

What rights do you have against manufacturers and apps?

In the EU, you can ask the manufacturer and any app for access. According to the European Commission, the copy is free of charge and the reply is due without undue delay, at the latest within one month. You can ask for erasure when data is no longer needed or processed unlawfully, though the right is not absolute. Where processing is based on consent or a contract, you can have your data transferred to another provider in a machine-readable format.

The EU Data Act has applied since 12 September 2025. Users of connected products can access, use and port the data they co-generate and share it with a third party. The Commission lists health monitoring devices among its examples; data holders must provide the data for free.

If a provider in the EU does not respond, you can complain to a data protection authority, which informs you of the progress or outcome within three months, according to the Commission. In Switzerland, too, the FDPIC notes that the right to erasure is not absolute.

An example: Niamh tidies up her permissions

Fictional example: Niamh in Cork has used a fitness watch with an Android phone for two years. Under App permissions in Health Connect she finds five apps, among them a running app unused for a year and her insurer's reward app set to Allow all.

Niamh removes all permissions from the running app, deletes its data with Delete app data and closes her account there. The reward app may now read steps only, as the scheme only counts steps. In the manufacturer's app she sets her routes to private, since most start at her front door. She will check the list again after the next major update.