Your workouts are not our business model

There is a saying about free apps that most people have heard: if you are not paying for the product, you are the product. It is not always true. Some free things are free because a paid tier carries them, or because someone is generous. But when it is true, what is being sold is usually data about you, and in health and fitness apps that data is unusually personal: your heart rate, your weight, your cycle, where you run at six in the morning.

Here is what regulators, researchers and reporters have documented, with links, and then what Sestava does with your data and what it cannot promise.

Where the money comes from

Meta’s latest annual report states the model plainly: “We generate substantially all of our revenue from advertising” (Form 10-K for 2025). Advertising needs to know who might want what, and health apps turned out to be a rich source.

What health apps were caught sharing

• Flo, a period and fertility tracker “used by more than 100 million consumers”, settled the US Federal Trade Commission’s allegations in January 2021. The FTC alleged that Flo had disclosed users' health data to marketing and analytics services, including Facebook’s and Google’s analytics divisions, after promising to keep it private (FTC).
• GoodRx was the first company the FTC pursued under its Health Breach Notification Rule, in February 2023. The FTC alleged it had shared users’ prescription medications and health conditions with advertising platforms including Facebook, Google and Criteo; GoodRx agreed to pay a $1.5 million civil penalty (FTC).
• BetterHelp, an online counselling service, revealed email addresses, IP addresses and health questionnaire answers to Facebook, Snapchat, Criteo and Pinterest for advertising, the FTC said in March 2023. BetterHelp agreed to pay $7.8 million to consumers (FTC).

None of this needed a sale in the usual sense. Handing data to an ad platform so that it could find more people like you was enough.

The market behind the apps

Data brokers buy, combine and resell information about people. In late 2021 Joanne Kim, a researcher at Duke University, asked 37 of them about data on Americans’ mental health; her report appeared in February 2023. Twenty-six answered, and 11 “were ultimately willing and able to sell the requested mental health data”. One quoted $275 for 5,000 aggregated counts of mental health records; the broker most willing to sell data on depressed and anxious people was ready to do so at her budget of $2,500 (Duke Sanford Cyber Policy Program).

Location is the other sensitive trail. In January 2024 the FTC reached its first settlement with a data broker over sensitive location data: X-Mode Social, now Outlogic, agreed to stop selling sensitive location data. The FTC alleged it had sold data that “could be used to track people’s visits to sensitive locations such as medical and reproductive health clinics, places of religious worship and domestic abuse shelters” (FTC).

The most sensitive apps are not always the careful ones either. When Mozilla reviewed 32 mental health and prayer apps in 2022, 28 of them received its *Privacy Not Included warning label (Mozilla Foundation).

A workout is location data too

A workout has a starting point, a route and a time of day. In January 2018 an analyst, Nathan Ruser, noticed that Strava’s global heatmap, built from a billion activities, showed military bases and the jogging routes around them (The Guardian). In October 2024 Le Monde found 26 US agents, 12 members of the French president’s security group and six of Russia’s Federal Protection Service, all guarding heads of state, with public Strava accounts that showed where they were, and so where their principals were (Associated Press, via Fortune). The US Secret Service said it did not see any impact on its protective operations.

Neither case involved a sale. The data was stored, and shared by settings people did not think about. Stored data can also be taken: in 2018 Under Armour said an unauthorised party had acquired data from about 150 million MyFitnessPal accounts, namely usernames, email addresses and hashed passwords (Under Armour, filed with the SEC).

The regulator saw the ad value

Google agreed to buy Fitbit for about $2.1 billion (Fitbit). The European Commission cleared the deal in December 2020 only after Google committed not to use the health and wellness data of Fitbit users in the European Economic Area for Google Ads, and to keep that data in a separate “data silo”. The commitment runs for ten years, and the Commission may extend it by up to ten more (European Commission). A competition authority treated Fitbit users’ health and fitness data as an advertising asset.

Not every fitness company works this way. Garmin’s annual report describes a business that sells devices, with subscriptions such as Garmin Connect+ on top (Form 10-K for 2025). Nothing in it says Garmin sells data. Garmin does work with insurers, though: Garmin Health offers them solutions built on wearable data, and in November 2019 Garmin and the reinsurer SCOR launched a model with the Taiwanese insurer Nanshan that combines SCOR’s “risk knowledge with wearable health data insights from Garmin” and, in SCOR’s words, “enables dynamic underwriting”. In 2020 it was extended to Manulife-Sinochem in China, and BOC Life in Hong Kong and SNACK by Income in Singapore were to launch it within six months (SCOR). These are programmes people sign up for: Garmin’s announcement speaks of “Nanshan customers who participate in the program” (Garmin).

The saying is about free products; the fair question for any app is simply: who pays for this?

Apple’s rules help

On iPhone, data from Apple Health comes with rules. Apple’s App Review Guidelines (5.1.3) say that apps “may not use or disclose to third parties data gathered in the health, fitness, and medical research context … for advertising, marketing, or other use-based data mining purposes” (Apple). Apple’s developer licence adds: “You must not share or sell information collected through these APIs to advertising platforms, data brokers, or information resellers” (Apple Developer Program License Agreement). They bind every app that uses Apple Health, Sestava included. We would keep them anyway.

What Sestava does instead

Sestava is paid for the old way: the app is free to start, and Sestava Pro is a one-time purchase in the App Store. That is the whole business, so there is nothing to gain from your data:

• No account. We never ask for your email address, your name or a password.
• Your workouts stay with you, on your iPhone and in Apple Health. No server of ours receives them.
• Apple Health only with your permission, which you can change at any time in Settings. Health data is processed on your device and is not sent to us.
• No ads, and no third-party tracking or advertising SDKs in the app.
• No sale of data. We do not sell your data, and we will not sell it to data brokers.
• No tracking on the website either: sestava.app sets no cookies. It counts visits with Cloudflare Web Analytics, which keeps no cookies and is never loaded on plan links.

What we cannot promise

A few honest edges:

• A plan shared as a sestava.app link travels inside the link itself, so opening it in the app downloads nothing. A link to a file elsewhere, your coach’s website for example, is downloaded from that server, which sees your IP address, as with any web request.
• Apple sees what Apple sees: it processes your purchase and, if you turn it on, your iCloud backup, under its own privacy policy. If you choose to share analytics with app developers in iOS settings, Apple gives us aggregated, anonymous statistics.
• If you let another app read your workouts from Apple Health, what you pass on is governed by that app’s rules. The choice is yours each time an app asks, and we will not stand in your way. Our promise covers what Sestava does with your data, not what an app you picked does with it.

The short version

Our privacy policy covers the same ground. If you ever find the app doing something this post or that page does not say, write to [email protected].

Cover photo by Karla Arróniz on Unsplash.