This policy is a supplement to Strava's Privacy Policy. It applies where information Strava, Inc. processes may count as "Consumer Health Data" under the Washington My Health My Data Act, the Nevada Health Data Privacy Act, or other applicable U.S. state consumer health privacy laws, which the policy calls "Applicable State Laws". It does not say it replaces the Privacy Policy.
Supporting quotations
This Consumer Health Data Policy (“Policy”) supplements the
applies in circumstances where information Strava, Inc. (“Strava,” “us,” “our,” or “we”) processes may be considered “Consumer Health Data” subject to the Washington My Health My Data Act, the Nevada Health Data Privacy Act, or other applicable U.S. state consumer health privacy laws (“Applicable State Laws”)
Qualifications & exceptions
The policy applies only "in circumstances where" the information may be considered Consumer Health Data under an Applicable State Law.
Applicable State Laws is limited to the two named laws and "other applicable U.S. state consumer health privacy laws"; other laws are not named.
Not stated here
The Strava Privacy Policy that this policy supplements is linked but not supplied, so how the two documents interact in a conflict is not shown here.
The policy does not say which states' residents it is meant to cover beyond Washington and Nevada, or how Strava decides that information is Consumer Health Data.
Legal Rights & Agreement Rules · Context
Effective date of the policy
The policy states an effective date of January 1, 2026.
Supporting quotations
Effective Date: January 1, 2026
Legal Rights & Agreement Rules · Context
What counts as Consumer Health Data
"Consumer Health Data" means personal information that is linked or reasonably could be linked to you and that identifies your past, present, or future physical or mental health status, as defined by Applicable State Laws. Capitalized terms not defined in this policy take the meanings given in the Strava Privacy Policy.
Supporting quotations
When we say “Consumer Health Data,” we mean personal information that is linked or reasonably could be linked to you and that identifies your past, present, or future physical or mental health status, as defined by Applicable State Laws.
Capitalized terms not defined in this Policy have the meanings given to them in our Privacy Policy.
Qualifications & exceptions
The definition depends on how Applicable State Laws define health status, so the exact boundary is set by those laws, not by this text.
Not stated here
Terms such as "Activity Data" and "Services" are defined in the Privacy Policy, which is not supplied here.
Cross-references
related (model-proposed): When this policy applies — defines: The definition paragraph explains the term 'Consumer Health Data' that the scope paragraph relies on to say when the policy applies.
Data Access & Collection · Company practice
Kinds of data that may be Consumer Health Data
Strava says it helps people record, measure, improve and, when they choose, share their athletic performance. Because of how broad certain privacy laws are, it says a limited amount of the Activity Data it collects may be considered Consumer Health Data. The categories "may include" information that identifies vital signs or health-related measurements, or reproductive information. The wording is a non-exhaustive "may include" and does not list specific data fields.
Supporting quotations
a limited amount of the Activity Data we collect may be considered to be Consumer Health Data
The categories of such data may include information that identifies vital signs or health-related measurements, or reproductive information.
Qualifications & exceptions
Only "a limited amount" of Activity Data is described as possibly being Consumer Health Data.
The category list is introduced by "may include", so it is not stated to be complete.
Not stated here
Specific data fields (for example, which measurements or what reproductive information) are not named.
"Activity Data" is not defined in this document.
Data Access & Collection · Company practice
Source: data you provide yourself
Strava may collect Consumer Health Data from you, depending on your preferences and how you engage with the Services. The example given is when you choose to record or upload your heart rate.
Supporting quotations
We may collect such information from:
You, depending on your preferences and how you engage with our Services. For example, when you choose to record or upload your heart rate.
Qualifications & exceptions
The heart-rate example is an illustration ("For example"), not a limit.
Data Access & Collection · Company practice
Source: third-party apps, services and devices you connect
Strava may collect Consumer Health Data from third-party apps, services and devices, but only to the extent you allow those third parties to share it. The examples are sharing with Strava through Zwift, Peloton, Garmin Connect or Apple Health.
Supporting quotations
Third-party apps, services, and devices, to the extent that you allow third parties to share such information with us.
if you choose to share information with us via Zwift, Peloton, Garmin Connect or Apple Health
Qualifications & exceptions
Collection from third parties is tied to your permission ("to the extent that you allow").
Not stated here
The named integrations are examples, so which other third parties can send data is not listed.
Data Access & Collection · Company practice
Source: Strava corporate family
Strava may also collect Consumer Health Data from its corporate family of companies, including affiliates and subsidiaries. The policy points to a separate page about its subsidiaries, which is not supplied here. The source sentence reads "including affiliates subsidiaries", which appears to be missing a word.
Supporting quotations
Our corporate family of companies, including affiliates subsidiaries.
The linked subsidiaries page is not supplied, so which companies are in the corporate family is not shown.
Unlike the two sources above, this source is not tied to your choice or permission.
Use & Processing · Permission or license
Purposes: providing the services you requested
Strava may collect, use and disclose Consumer Health Data as necessary to provide the products and services you have requested. The policy says this may include providing insights into your workouts and activities; providing, improving and personalizing the platform and Services; and promoting safety, integrity and security on the platform.
Supporting quotations
We may collect, use, and disclose Consumer Health Data as necessary to provide you with the products and services you have requested.
This may include providing insights into your workouts and activities; providing, improving, and personalizing our platform and Services; and promoting safety, integrity, and security on our platform.
Qualifications & exceptions
The first sentence is limited to what is "necessary" for products and services you have requested; the list that follows is introduced by "may include" and is not stated to be exhaustive.
"Improving and personalizing our platform and Services" is listed as part of this purpose, so it is not limited to services you individually requested.
Not stated here
The policy does not say whether disclosure under this purpose goes beyond the recipients in the sharing section.
Use & Processing · Permission or license
Purposes: other uses with consent or as permitted by law
Strava may also collect, use and disclose Consumer Health Data for other purposes with your consent or authorization, or as otherwise permitted by law. The "permitted by law" route is not tied to your consent and is not limited to a list in this policy.
Supporting quotations
We may also collect, use, and disclose Consumer Health Data for other purposes with your consent or authorization or as otherwise permitted by law.
Qualifications & exceptions
Two alternative bases are stated: your consent or authorization, or "as otherwise permitted by law".
Not stated here
The policy does not say which other purposes Strava has in mind or how consent is requested.
Cross-references
qualifies (model-proposed): Purposes: providing the services you requested — qualifies: The purposes paragraph first states the necessary-for-requested-services basis, then adds other purposes with consent or as permitted by law, which widens the first basis.
Sharing & Disclosure · Company commitment
No sale; sharing limited to named recipients, with exceptions
Strava states it does not sell Consumer Health Data. It says that, except as noted in the sharing section, it does not share it with third parties. It says it only discloses it to its corporate affiliates (including subsidiaries), its service providers, and third parties you choose to share it with, such as other users, the public or third-party integrations. This general rule is qualified by the further disclosures in the next paragraph: corporate transactions, legal process, compliance with law and preventing harm.
Supporting quotations
We do not sell Consumer Health Data. And except as noted in this section, we do not share it with third parties.
We only disclose it to our corporate affiliates (including our subsidiaries), our service providers, and third parties you choose to share it with (such as other users, the public, or third-party integrations).
We may also disclose Consumer Health Data to parties in a corporate transaction
Qualifications & exceptions
"Except as noted in this section": the paragraph after this one adds further permitted disclosures.
"We only disclose it to" lists corporate affiliates, service providers and third parties you choose; the third group depends on your choice.
Not stated here
The policy does not say what "sell" means for this purpose or define "service providers"; the Privacy Policy is not supplied.
Sharing & Disclosure · User right or choice
Sharing you choose can reach other users or the public
Among the third parties Consumer Health Data may be disclosed to are those you choose to share it with, which the policy says includes other users, the public, or third-party integrations. This depends on your choice to share.
Supporting quotations
third parties you choose to share it with (such as other users, the public, or third-party integrations)
Qualifications & exceptions
The examples (other users, the public, third-party integrations) are introduced by "such as" and are not an exhaustive list.
Not stated here
The policy does not say which settings control this sharing.
Sharing & Disclosure · Permission or license
Disclosures for corporate transactions, legal process and harm prevention
Strava may also disclose Consumer Health Data to parties in a corporate transaction, such as new owners if there is a change of ownership or control of all or part of its business, products or services. It may also disclose it to law enforcement or other third parties in connection with valid legal process, to comply with applicable law, or to prevent harm. These disclosures do not depend on your choice.
Supporting quotations
We may also disclose Consumer Health Data to parties in a corporate transaction (such as new owners in the event of a change of ownership or control of all or part of our business, products, or services)
and to law enforcement or other third parties in connection with valid legal process, to comply with applicable law, or to prevent harm.
Qualifications & exceptions
The transaction recipients are an example ("such as new owners"), not a closed list.
Disclosure to "law enforcement or other third parties" is tied to valid legal process, compliance with law, or preventing harm.
Not stated here
The policy does not say whether you would be notified of a disclosure for these reasons, or whether the buyer must keep honoring this policy.
Cross-references
narrows (model-proposed): No sale; sharing limited to named recipients, with exceptions — exception_to: The 'except as noted in this section' wording in the general no-sharing paragraph points to the additional disclosures listed in the next paragraph (corporate transaction, legal process, compliance, harm prevention).
Account & Service Control · User right or choice
Your rights over your Consumer Health Data
The policy says you have certain rights with respect to your Consumer Health Data, "including" the right to access it, delete it, withdraw consent for the collection and sharing of it, and ask Strava to confirm whether it is collecting or disclosing it and with whom. The list is introduced by "including", so it is not stated to be complete.
Supporting quotations
You have certain rights with respect to your Consumer Health Data, including to:
Access your Consumer Health Data.
Delete your Consumer Health Data.
Withdraw consent for the collection and sharing of your Consumer Health Data.
Request that we confirm whether we are collecting or disclosing your Consumer Health Data, and with whom.
Qualifications & exceptions
The rights are described as "certain rights ... including"; the policy does not say the list is complete.
Withdrawal of consent covers "collection and sharing" only.
Not stated here
The policy states no deadlines for responding, no identity verification steps, and no exceptions to the right to delete.
Account & Service Control · Procedure
How to exercise your rights
To exercise your rights, review or request changes to your Consumer Health Data, or ask questions, the policy points you to the Strava Privacy Policy and/or says you can contact Strava through support.strava.com.
Supporting quotations
If you would like to exercise your rights, review or request changes to your Consumer Health Data, or ask any questions, please see the Strava Privacy Policy and/or contact us through support.strava.com.
Not stated here
The Privacy Policy steps are not supplied here, so the exact process, forms and timing are not shown.
Legal Rights & Agreement Rules · User right or choice
Appealing a denied request and complaining to regulators
If Strava denies a request to exercise a right, you may appeal by contacting DPO@strava.com. If the appeal is unsuccessful, you can raise a concern or lodge a complaint with the Washington State Attorney General, the Nevada State Attorney General, or another regulatory authority as applicable.
Supporting quotations
If we deny a request to exercise a right, you may appeal that decision by contacting DPO@strava.com.
If your appeal is unsuccessful, you can raise a concern or lodge a complaint with the Washington State Attorney General at www.atg.wa.gov/file-complaint, with the Nevada State Attorney General at https://ag.nv.gov/, or other regulatory authority as applicable.
Not stated here
The policy states no deadline for appealing and no timeframe for Strava's appeal decision.
Legal Rights & Agreement Rules · Company commitment
Strava may change the policy; notice for material changes
Strava reserves the right to modify this policy at any time. If it makes changes, it will post the revised policy and its effective date on its website. If it makes changes it deems material, it will give prominent, advance notice. Whether a change is material is Strava's own determination ("we deem").
Supporting quotations
Strava reserves the right to modify this Policy at any time.
If we make changes to this Policy, we will post the revised policy and its effective date on our website.
If we make changes we deem to be material, we will provide prominent, advance notice.
Qualifications & exceptions
Advance notice applies only to changes Strava "deem[s] to be material"; other changes are announced by posting.
Not stated here
The policy does not say how "prominent, advance notice" is delivered or how far in advance.
Account & Service Control · Restriction or exception
If you object to changes
If you object to any changes to the policy, it tells you to stop using the Services and delete your account. It describes no other way to object, and does not say what happens to your data after you delete your account.
Supporting quotations
If you object to any changes to this Policy, you should stop using the Services and delete your account.
Not stated here
What Strava does with your Consumer Health Data after you delete your account is not stated in this policy.