For fitness & wearable products · Updated 2026
WMHMDA for Fitness Apps: What Workout & Activity Tracking Apps Must Do
Fitness apps sit at the very center of WMHMDA's definition of "consumer health data." Heart rate is biometric data. Step counts and workout logs are fitness and activity data. Post-workout sleep tracking is sleep data. If your app collects any combination of these — which nearly every fitness app does — you're a regulated entity under RCW 19.373 the moment you have a single Washington-resident user.
In short: Heart rate, step counts, sleep, and GPS routes are all consumer health data. Watch for social-sharing features, wearable integrations, and advertising SDKs that share this data without a separate opt-in. Generate your compliance documents below.
Read the full guide for fitness apps
Data categories a typical fitness app collects
- Heart rate and heart-rate-zone data (biometric)
- Step counts, distance, pace, and workout history (fitness/activity)
- Sleep duration and sleep-cycle data (sleep)
- Calorie burn and nutrition logging (nutrition/diet)
- GPS routes from outdoor workouts (potentially health-related precise location, if routes could reveal clinic/facility visits)
- Body composition, weight, and body-fat percentage (biometric / fitness)
Common fitness-app compliance gaps
- Social/leaderboard features that share workout stats publicly or with friends without a separate opt-in for that specific sharing.
- Third-party wearable integrations (smartwatch and ring manufacturers) where data flows to the hardware maker without disclosure in your privacy policy.
- Advertising SDKs that receive fitness data for ad personalization — this is a "sale" if any value is exchanged, requiring the specific authorization WMHMDA demands.
- GPS route data that could reveal visits to a health facility, triggering the geofencing considerations discussed in our geofencing guide.
Example: a running app with social sharing
A running app that lets users share completed-run stats (distance, pace, route map, heart-rate graph) to a public or friends-only feed needs: (1) a privacy policy disclosing that fitness/biometric/location data is collected; (2) opt-in consent before the data is collected at all; (3) a separate opt-in specifically for the social-sharing feature, since sharing with other users or the public is a distinct disclosure event from simply logging the workout; and (4) if the app monetizes anonymized route data to a third-party analytics firm, a signed sale authorization.
Generate your fitness app's compliance documents
The WMHMDA Compliance Pack builds your privacy policy, consent form, sale authorization, retention schedule, and rights form from your app's specific data categories. Read everything free before you pay — $99.99 one-time.
Generate My Compliance Pack — $99.99Legal limitations
This guide covers common fitness-app data patterns but isn't a substitute for reviewing your specific SDK integrations and data-sharing agreements with an attorney, particularly if you monetize aggregated or anonymized fitness data.
FAQ
Is heart rate data from a fitness app considered consumer health data?
Yes — heart rate is biometric data, explicitly covered under WMHMDA.
Do I need consent to share fitness data with a connected wearable manufacturer?
Yes — sharing with any third party requires separate opt-in consent from the consent to collect.
Does WMHMDA apply if my fitness app doesn't sell user data?
Yes — collecting the data alone triggers privacy policy and consent obligations, regardless of selling or sharing.
Does wmhmda or wa my health my data act apply to a running or cycling app?
Yes, if it collects fitness, biometric, or health-related location data from Washington residents, regardless of app category or name.