Why does a heart-rate monitor need your location? In most cases, it doesn't. The less honest answer is buried in the permissions screen, framed as “enhanced experience.” The fitness data alone is already more revealing than most people realize: a continuous step trace tells anyone reading it where you live, where you work, and roughly when you sleep. Add GPS and you have a diary of your movements. Add heart rate and you have a stress map. The fix starts with a question: what does the device actually need to function, and what is it taking because it can?
The pitch (what they say it does)
The pitch is familiar: track your workouts, improve your sleep, get personalized insights. The device is sold as a tool for self-improvement, and the data is presented as the raw material for that service. Under the GDPR, that framing matters. Processing must have a lawful basis, and for most fitness features it's consent or contract performance. But consent must be specific, informed, and revocable. A single “I agree” at setup, buried under a wall of text, rarely meets that bar. Transparency is also required about purposes. If the app says it uses your data to “enhance your experience,” that is not a purpose—it's a slogan. You are entitled to know the actual categories of data collected, the recipients, and the retention period. The pitch is not the problem. What the pitch leaves out is.
What they collect (often more)
What they collect is usually more than the pitch admits. Step counts, heart rate, sleep phases, workout routes, and sometimes continuous location. Under Article 2, the GDPR applies to processing of personal data wholly or partly by automated means. Fitness data qualifies. Some of it may fall into special categories if it reveals health status. The data-flow question is simple: where does the data go? On-device processing is one thing. Syncing to a cloud account is another. Sharing with third-party analytics or advertising partners is a third. Each hop changes the risk. Supervisory authorities have investigative powers under Article 58, including audits and access to premises—but those powers are reactive. They act on complaints. Your first move is to map the flow yourself: check the app's privacy settings, look for a data download option, and read the section on sharing. If the app offers a way to limit sharing without losing core functionality, take it on day one.
What they don't tell you (usually about resale or model training)
What they don't tell you is often about resale or model training. The privacy policy may mention “business partners” or “research collaborations” without naming them. Under Article 35, a data protection impact assessment is required for processing that involves systematic and extensive evaluation of personal aspects based on automated processing, or large-scale processing of special categories of data. Fitness data used to train models that infer health risks could trigger that requirement. But you won't see the DPIA. You'll see a clause about “improving our services.” Article 23 restrictions are for Member States, not vendors. The vendor's obligation is transparency about purposes. If the purpose is model training, it should say so. If it's resale, it should say that too. The absence of plain language is not an accident. It's a choice. Your countermeasure: look for an opt-out of data sharing for “product improvement” and take it. If there isn't one, ask why.
Your move (what to do about it)
Your move is concrete. First, open the app's privacy settings and find the data download option. Under the GDPR, you have a right to access your data. Request it. The response will tell you what they hold and often how they categorize it. Second, review the sharing permissions. Disable anything that isn't essential to the core function. Third, check the retention policy. If it's vague, ask for clarification. Fourth, if you suspect a violation, lodge a complaint with your supervisory authority. Article 57 requires them to handle complaints and inform you of progress. That is a lever. It is not dramatic, but it works. The point is not to be alarmist. The point is to be informed. Free at point of sale rarely is. Take the opt-out on day one, and read the policy down to clause eleven.
FAQ
Does my step count really count as personal data?
Yes. Under Article 2, the GDPR covers processing of personal data by automated means, and a continuous step trace identifies you well enough to qualify. If the data reveals health status, it can even land in the special-categories bucket, which raises the bar for the vendor.
What happens if I ask for my data and they stall?
They owe you access, and the response itself tells you what they hold and how they categorize it. If the stall continues, that's your cue to lodge a complaint with your supervisory authority—Article 57 requires them to handle it and keep you informed. Slow is not the same as refused, but it's worth documenting.
Is it worth opting out of “product improvement” sharing?
Yes, and it takes a minute. That toggle is usually where model-training and partner-sharing permissions hide, and the GDPR requires the vendor to be transparent about those purposes. If there's no opt-out, ask why in writing—the answer is often more informative than the policy.
