Washington educational resource

Washington MHMDA for Fitness Apps: Steps, Heart Rate, and Workout Data Are Consumer Health Data

Fitness app teams typically think of step counts, heart rate, sleep stages, and workout logs as "lifestyle" data. The Washington My Health My Data Act does not. Chapter 19.373 RCW reaches any personal information reasonably linkable to a consumer that identifies past, present, or future physical or mental health status, and the statute extends the same treatment to model-derived inferences. The recovery score your training algorithm spits out, the "elevated resting heart rate" flag your watch surfaces, the "low cardio fitness" tag your onboarding model assigns, all of that is consumer health data under . The fact that your team would never call it "medical" does not change the analysis.

Why "fitness data is not medical data" is the wrong frame

The consumer-health-data definition under reaches inferences derived from non-health information that are used to associate or identify a consumer with a health-related category. That is the prong fitness apps miss. A raw step count is borderline; a "this user is sedentary and at cardiovascular risk" inference is clearly inside the statute. The same logic applies to:

If your model takes raw fitness signal and outputs anything that categorizes the user's body or health state, the output is consumer health data even if the input was not.

The four MHMDA hooks that decide most fitness-app matters

1. Separate Consumer Health Data Privacy Policy under . Fitness apps are the worst offenders here in my review experience. The team writes one long "Privacy Policy" covering everything including health data, and assumes a section on health data is enough. It is not. The statute requires a separate standalone document with five substantive disclosures including the categories of consumer health data collected, the purposes, the sources, the categories shared, and the list of specific affiliates and categories of third parties, plus the rights-exercise mechanism. The link must be prominently published on the homepage. A burst-collapsed mobile footer link is often inadequate.

2. Two-layer consent under . Collection consent and sharing consent are separate. A signup that says "I agree to the Terms of Service and Privacy Policy" does not collect either consent under MHMDA. The collection consent must specify the purpose. The sharing consent must be distinct and disclose data categories, purpose and usage methods, receiving entities, and withdrawal mechanism. Most fitness apps fail the sharing prong because they treat their analytics SDK, advertising attribution platform, and AI inference vendor as part of the bundled "operating the service" disclosure.

3. Adtech and analytics audit under and . If you send workout data, heart rate, or any derived inference to Meta, TikTok, Google Ads, AppsFlyer, Branch, Amplitude, Mixpanel, or a similar platform without a binding processor contract that limits processing to documented instructions, you have a processor problem. If that vendor uses the data for its own purposes (training its own model, ad targeting beyond your campaigns), you have a candidate "sale" under the broad definition in , which requires the nine-element written authorization under . The authorization is one year, revocable, and invalid if missing any element.

4. Geofence prohibition under . Fitness apps with location features should map their ad-campaign geofences against the 2,000-foot perimeter around any in-person healthcare facility. The statute is a categorical ban: it is unlawful to implement a geofence around an entity that provides in-person health care services to identify or track consumers, collect consumer health data, or send notifications, messages, or advertisements related to health care. Consent does not cure the violation.

The per se CPA hook for fitness apps

declares an MHMDA violation a per se Consumer Protection Act violation. For a fitness app with a single Washington user that means a private plaintiff gets actual damages, discretionary treble damages capped at $25,000 on the enhancement, and one-way attorney's fees under RCW 19.86.090, with the public-interest and unfair-or-deceptive elements declared by statute. The plaintiff still pleads injury and causation. The four-year SOL under RCW 19.86.120 applies. This is the highest-leverage state health-privacy statute in the United States, and fitness apps with national footprints are squarely inside it.

What I review when you send me a fitness-app matter

Service tiers

Sergei's practical note

Fitness apps come to me with the same misconception: "we are not HIPAA-covered, so we are not regulated." HIPAA scope and MHMDA scope are different statutes with different reach. The MHMDA was written for exactly the data your app collects. Send the privacy policy, the signup-flow screenshots, the SDK list, and a brief product description. I will tell you whether the matter looks like a $499 scope memo or a $1,500 full package. Regulatory advisory work under California license; not Washington representation.

Related Washington resources

For the full statutory walk-through, see my Washington My Health My Data Act resource. To self-assess, use the Wellness App MHMDA Risk Checker or the MHMDA Scope Analyzer. Adjacent verticals: wellness apps, sleep tracking, period tracking, and weight loss.

Educational resource. Sergei Tokmakov is a California attorney (CA Bar #279869) currently seeking admission to the Washington State Bar. Nothing on this page creates an attorney-client relationship or is Washington legal advice. A Washington-admitted attorney should verify operative statute text before relying on it in a live matter.