Who has access to the health data your fitness tracker or smartwatch collects? Most people assume the answer is simple: just them. The actual answer is considerably more complicated. Health data privacy rarely stops at the app you actually opened.
Health data privacy deserves more attention than it typically gets, because health data is among the most sensitive data you generate. Unlike a financial account, you cannot change your health history once it has been exposed.
Regulators are only beginning to catch up. The FTC issued warnings in 2025 that health app data collected without clinical oversight, from fitness trackers, sleep apps, and mental health apps alike, could be sold to data brokers without the protections most people assume apply. EPIC’s health privacy resource covers exactly which protections do and do not apply to this category of data.
This post covers fitness tracker data and insurance discrimination, mental health app data harvesting, genetic testing leaks, and how to review and limit what you are actually sharing. This is part of the wider picture covered in the full guide to high-risk threats.
How Is Fitness Tracker Data Used for Insurance Discrimination?
Fitness and sleep data collected by wearables is increasingly used in actuarial modelling, sometimes through direct insurer partnerships offering premium discounts in exchange for data access, a trade that feels beneficial upfront but establishes a data-sharing relationship that is difficult to fully reverse.
Because most wearable health data falls outside the strict clinical protections applied to data held by a hospital or doctor, it can often be used, shared, or sold in ways that would be prohibited for equivalent data collected in a medical setting.
This connects to how data brokers accumulate detailed profiles over time, since fitness data is a specific, valuable category within the broader profile a broker can build and sell.
Employer wellness programmes introduce a related dynamic, where a company offers a fitness tracker or a premium reduction in exchange for step counts or activity data, creating a workplace incentive to share health information with an employer that would otherwise have no legitimate route to it. Whether participation is genuinely voluntary in practice, given the financial incentive attached, is worth considering carefully before opting in.
In India, health insurers have begun offering premium discounts tied to wearable-verified activity targets through wellness programmes attached to several major policies, a structure that raises the same underlying question as employer schemes: whether declining to share the data effectively costs a policyholder money even though nothing was technically made mandatory.
How Do Mental Health Apps Harvest and Share Data?
Mental health and mood-tracking apps collect deeply personal disclosures, therapy notes, mood logs, medication reminders, and many operate with far less regulatory oversight than a licensed therapist’s own records, since the app itself is rarely classified as a medical provider.
89% of people expressed concern specifically about how platforms collect health data relating to children, according to Usercentrics’ 2025 research, reflecting a broader unease that has not yet translated into meaningfully stronger regulation for these specific categories of app.
This overlaps with how tracking technologies follow you across platforms, since mental health app data is frequently combined with broader advertising and tracking profiles rather than kept isolated as a distinct, protected category.
Some mental health apps have been found sending session data, including specific symptoms and crisis-related disclosures, to third-party analytics and advertising platforms within seconds of the information being entered, according to independent research into the sector. This happens through the same embedded tracking infrastructure used across ordinary consumer apps, applied here to some of the most sensitive disclosures a person can make.
What Happens When Genetic Testing Data Leaks?
Genetic data is unique among all categories of personal data in one specific way: a leak does not only expose you, it exposes your biological relatives, who never consented to having their genetic information implicated by your test results.
Genetic testing companies have faced significant, publicly documented data breaches in recent years, and unlike a password or a credit card number, genetic data cannot be reset or reissued once it has been exposed.
Telemedicine platforms carry a related but distinct risk, since the rapid expansion of virtual healthcare has in some documented cases outpaced the security infrastructure protecting the sensitive medical conversations these platforms process and store.
At-home genetic testing kits often include a consent step for research participation that is separate from the core testing service itself, worded broadly enough that many customers agree to ongoing research use without fully registering that they have done so. Reviewing this consent step specifically, rather than accepting the default bundled option, is worth the extra few minutes during signup.
How Do You Review and Limit Your Health Data Sharing?
Review the privacy policy of any health or fitness app specifically for third-party data sharing clauses before granting access, rather than after, since revoking access retroactively rarely removes data already shared or sold.
Opt out of insurer wearable data programmes where the trade-off does not clearly benefit you, and treat a modest premium discount as a meaningful ongoing cost, not a one-time gain, since the data relationship typically continues for as long as you remain enrolled.
If you suspect medical identity theft, unfamiliar charges on an insurance statement, unrecognised prescriptions, report it to your insurer and healthcare provider immediately, since medical identity theft can also corrupt your actual medical records with someone else’s information.
For mental health and mood-tracking apps specifically, check whether the developer discloses third-party analytics or advertising integrations directly in the app store listing or privacy label, since this disclosure, when present, is often the fastest way to identify which apps route sensitive entries through general-purpose tracking infrastructure rather than treating them as protected health information.
Worth reading further: EFF’s Surveillance Self-Defense guide, Mozilla’s *Privacy Not Included guide, and the Privacy Rights Clearinghouse.
Frequently Asked Questions
Are fitness trackers protected by the same laws as medical records?
Generally no. Data held directly by a doctor or hospital is typically protected under stricter medical privacy law, while data collected by a consumer fitness app is usually governed by ordinary privacy policy terms, which offer significantly weaker protection.
Can I request a company delete my genetic testing data?
Many genetic testing companies do offer a deletion option, though it is worth confirming specifically whether this includes data already shared with research partners, since some sharing agreements are not fully reversible after the fact.
Health data privacy matters because this is among the most sensitive data you generate. Unlike financial data, you cannot change your health history if it is exposed, which makes reviewing what you share worth the twenty minutes it takes.
For better health data privacy, open the settings on one fitness app you use today and check exactly what it shares with third parties, since the default is very often set to share more than most users would knowingly agree to if the choice were presented plainly and clearly upfront, rather than buried several screens deep inside a settings menu that almost nobody ever actually thinks to open on their own without a reason to look.
If this was useful, share it with someone who needs to know.
