Why You Own Your Training Data (and Most Apps Don't Let You Keep It)

Before Astrea, we built an app called Vitalina that does one specific job: turn a raw Apple Health export into something a person can actually read. Building that meant spending months looking at how dozens of other apps handle the data they collect from your Apple Watch and iPhone. Getting your data into most apps takes one tap. Getting an equivalent copy back out, in a form you could use anywhere else, often doesn’t exist as a feature at all.

Quick digest

• EU residents have a legal right (GDPR Article 20) to a copy of their data in a structured, reusable format, not just a PDF summary.
• California residents have a similar portability right under the CCPA, but it explicitly excludes HIPAA-style medical records, which is a narrower category than most people assume.
• HIPAA generally does not cover fitness trackers or wellness apps unless a doctor’s office sent the data there directly.
• A 2019 study of popular health apps found that roughly 4 out of 5 shared user data with outside companies, most often analytics and advertising firms.
• The FTC has taken enforcement action against GoodRx and Flo Health for sharing sensitive health data with advertisers after promising not to.
• Apple’s App Store rules ban using HealthKit data for advertising or data mining, but that’s a platform policy, not a law protecting you directly.

“Owning” your data is mostly a legal fiction, but “getting it back” isn’t

People say “I own my data” the way they’d say they own a car. Legally, that’s not quite how it works. In the US, there’s no single law that grants a general property right over your personal health data. What exists instead is a patchwork of narrower rights: the right to access it, the right to a portable copy of it, and rules about who a company can share it with.

The EU’s GDPR gets closest to what people mean by ownership. Article 20 gives you the right to receive data you provided to a company in a “structured, commonly used, machine-readable format,” and to have it transferred directly to another provider where that’s technically possible (GDPR, art. 20). California’s CCPA, updated by the CPRA, gives residents a comparable right: businesses have to deliver your data in a “readily useable format that allows the consumer to transmit this information from one entity to another entity without hindrance” (Cal. Civ. Code § 1798.130). Both are real, enforceable rights, not just goodwill gestures from a company.

Here’s the part that surprises most people: HIPAA, the law everyone assumes covers health data, almost certainly doesn’t cover your fitness tracker. HIPAA only applies to “covered entities” like hospitals and insurers, and their business associates. A wellness app you downloaded yourself, with no doctor involved, generally falls outside it entirely (Jodka, 2019). Your Apple Watch data isn’t protected by HIPAA. It’s protected, if at all, by whatever GDPR or CCPA rights apply to where you live, and by the app’s own privacy policy.

Why data flows out of apps more easily than it flows back to you

The asymmetry is the real problem. Most apps are built to accept data readily and pass it along to partners just as readily, while making it genuinely hard for you to get a clean copy back. A 2019 study in BMJ analyzed 24 popular medicines-related apps and found that 19 of them, about 79%, shared user data with outside companies. Those companies then had connections to a further 216 “fourth parties,” including advertising networks and a consumer credit reporting agency (Grundy et al., 2019). That’s the direction data moves by default: out, sideways, and further out again, long before it moves back to you in a usable form.

Two real cases show what that looks like in practice. Flo Health, a period-tracking app, told users their data was private while sharing details like pregnancy plans with Facebook and Google; the FTC required Flo to get affirmative consent before sharing health data going forward (Federal Trade Commission, 2021). GoodRx shared sensitive health and medication information with advertisers through tracking tools embedded in its app, and paid $1.5 million to settle the FTC’s first-ever case under the Health Breach Notification Rule (Federal Trade Commission, 2023). Neither company was accused of selling data on a black market. They shared it through the ordinary, boring infrastructure of analytics and ad tech that a lot of apps use by default.

The one real technical backstop, and its limit

If you’re on an iPhone and Apple Watch, there’s a specific rule doing more work than most people realize. Apple’s App Store Review Guidelines, section 5.1.3, prohibit apps from using HealthKit data, or Motion and Fitness data, for advertising or other data-mining purposes. It’s grounds for app rejection or removal (Apple Inc., n.d.).

That rule is worth knowing, and it’s also worth being precise about what it does and doesn’t cover. It applies to data an app reads through HealthKit specifically. It doesn’t apply to data an app collects through its own account system, its own servers, or a web dashboard sitting outside Apple’s review. And it’s enforced by Apple’s review process, not by a court you could personally take a company to. It’s a real constraint, just not a substitute for knowing what an app’s privacy policy actually says.

What to actually do

• Check whether the app writes your data back into Apple Health, not just its own private database. If it only reads from HealthKit and never writes to it, your history lives in one app’s silo, not in a format anything else can use.
• Test the export before you need it. Open Settings and try exporting your data from an app you already use, and see whether what comes out is a structured file or a readable PDF summary. Either is genuinely useful; most people don’t need a machine-readable export, just a copy of their own history they can actually open and read.
• Read for “service providers,” “analytics partners,” and “advertising partners” in a privacy policy, not just the word “sell.” Most companies can truthfully say “we don’t sell your data” while still sharing it with a dozen partners under a different label.
• If you’re in the EU or California, you can make a formal data portability request even if the app doesn’t offer a one-tap export button. Both GDPR and CCPA give you that right regardless of whether the company built a convenient interface for it.
• With Astrea, we work directly on top of your existing HealthKit history instead of copying it into a private database of our own, and anything new we do generate, like journal entries, gets written back into Apple Health too. It’s yours to export whenever you want, with no subscription standing between you and your own numbers.

FAQ

Does GDPR or CCPA mean I automatically own my fitness data? Not exactly. Both give you a legal right to access and receive a portable copy of it, which is close to what people mean by “owning” it in practice, but the underlying legal concept is closer to control and access rights than property ownership.

Is my Apple Watch or HealthKit data protected by HIPAA? Almost certainly not, unless a doctor’s office or hospital sent that specific data to the app on your behalf. Data you generate yourself through a consumer fitness or wellness app generally sits outside HIPAA’s scope (Jodka, 2019).

What’s the real difference between an app “sharing” my data and “selling” it? Legally, not as much as companies would like you to believe. Sharing data with an advertising partner in exchange for services, discounts, or platform access can functionally look a lot like selling it, even if no direct payment for the data itself changes hands. That’s part of what the FTC’s GoodRx case was about (Federal Trade Commission, 2023).

If an app’s privacy policy says “we don’t sell your data,” is that enough? Read past that one line. Ask whether it shares data with “partners” or “service providers” for advertising or analytics, since that’s functionally similar in effect and legally distinct from “selling.”

Can I still get my data back after I delete an app? It depends entirely on the company, and this is exactly where GDPR and CCPA portability rights matter most: they give you a formal way to ask, with a legal deadline for a response, rather than relying on the app still existing or replying to a support email.

Does data written into Apple Health actually solve this? It helps a lot, because Apple’s platform rules restrict what any app can do with HealthKit data specifically, and it means your history isn’t locked inside one company’s database. It’s not a complete guarantee, since it depends on Apple’s enforcement, but it’s a meaningfully stronger position than data sitting only on a company’s own servers.

Sources

Apple Inc. (n.d.). App Store Review Guidelines. Retrieved August 1, 2026, from https://developer.apple.com/app-store/review/guidelines/

California Consumer Privacy Act, Cal. Civ. Code § 1798.130 (2023). https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.130.

Federal Trade Commission. (2021, June 22). FTC finalizes order with Flo Health, a fertility-tracking app that shared sensitive health data with Facebook, Google, and others [Press release]. https://www.ftc.gov/news-events/news/press-releases/2021/06/ftc-finalizes-order-flo-health-fertility-tracking-app-shared-sensitive-health-data-facebook-google

Federal Trade Commission. (2023, February 1). FTC enforcement action to bar GoodRx from sharing consumers’ sensitive health info for advertising [Press release]. https://www.ftc.gov/news-events/news/press-releases/2023/02/ftc-enforcement-action-bar-goodrx-sharing-consumers-sensitive-health-info-advertising

General Data Protection Regulation, Regulation (EU) 2016/679, art. 20. (2016). https://gdpr-info.eu/art-20-gdpr/

Grundy, Q., Chiu, K., Held, F., Continella, A., Bero, L., & Holz, R. (2019). Data sharing practices of medicines related apps and the mobile ecosystem: Traffic, content, and network analysis. BMJ, 364, Article l920. https://doi.org/10.1136/bmj.l920

Jodka, S. H. (2019, May). App users beware: Most healthcare, fitness tracker, and wellness apps are not covered by HIPAA and HHS’s new FAQs makes that clear. Dickinson Wright. https://www.dickinson-wright.com/news-alerts/app-users-beware

A note from us We’re Martin and Marina, Astrea’s co-founders. We’re both into data and serious about our own training, but neither of us is a doctor or a clinical researcher. The health and physiology claims in this article come from published, peer-reviewed research, not our own expertise, which is why every article ends with a Sources list above. If a claim doesn’t trace back to a real source, we cut it before it gets published.