---
title: "Washington's My Health My Data Act for Fitness and Health Apps"
canonical: "https://aifitnessapi.com/compliance/washington-my-health-my-data-act"
cluster: "Compliance"
primary_query: "washington my health my data act for fitness and health apps"
last_reviewed: "2026-10-17"
description: "What Washington's My Health My Data Act (RCW 19.373) asks of fitness and health apps: who it covers, consent, deletion, sale and geofencing rules."
publisher: "AIFitnessAPI — independent, not sponsored"
cite_as: "\"Washington's My Health My Data Act for Fitness and Health Apps\", AIFitnessAPI, https://aifitnessapi.com/compliance/washington-my-health-my-data-act"
---

# Washington's My Health My Data Act for Fitness and Health Apps

> Washington's My Health My Data Act, chapter 19.373 RCW, applies to any legal entity that does business in Washington or targets products or services to consumers there and decides how consumer health data is collected, processed, shared or sold. Its definition of consumer health data lists bodily functions, vital signs, symptoms and measurements, and the state Attorney General's example of an app collecting it is one that tracks digestion or perspiration. The Act requires consent to collect such data beyond what a requested service needs, separate consent to share it, a signed authorization to sell it, action on deletion requests within 45 days, and no geofencing of health care facilities; the Attorney General says violations are enforced by the Attorney General and through private action. This summarizes the statute as of October 17, 2026 and is not legal advice.

- Canonical: https://aifitnessapi.com/compliance/washington-my-health-my-data-act
- Last reviewed: 2026-10-17
- Publisher: AIFitnessAPI (https://aifitnessapi.com) — independent, not sponsored
- Cite as: "Washington's My Health My Data Act for Fitness and Health Apps", AIFitnessAPI, https://aifitnessapi.com/compliance/washington-my-health-my-data-act

---

Washington's My Health My Data Act is [chapter 19.373 of the Revised Code of Washington](https://app.leg.wa.gov/RCW/default.aspx?cite=19.373&full=true), enacted in 2023. The legislature's finding explains why app makers meet it: HIPAA "only covers health data collected by specific health care entities", and "Health data collected by noncovered entities, including certain apps and websites, are not afforded the same protections." Washington's Attorney General calls it "the first privacy-focused law in the country to protect personal health data that falls outside the ambit of" HIPAA. This page sets out what the statute and the [Attorney General's FAQ](https://www.atg.wa.gov/protecting-washingtonians-personal-health-data-and-privacy) say, as read on October 17, 2026. It is not legal advice.

## Who has to comply

The Act's duties fall on a regulated entity: any legal entity that "(a) Conducts business in Washington, or produces or provides products or services that are targeted to consumers in Washington; and (b) alone or jointly with others, determines the purpose and means of collecting, processing, sharing, or selling of consumer health data."

- **Storing data in Washington is not the trigger.** The Attorney General's FAQ says "An entity that only stores data in Washington is not a regulated entity."
- **Small businesses** are regulated entities that handle the consumer health data of fewer than 100,000 consumers in a calendar year, or that earn less than 50 percent of gross revenue from it and handle fewer than 25,000 consumers' data. They comply with most sections from a later date.
- **Processors** handle data on a regulated entity's behalf under "a binding contract", and one that processes data outside its instructions "is considered a regulated entity or a small business with regard to such data". The Attorney General says out-of-state processors for regulated entities must comply.
- **Consumers** are Washington residents and people "whose consumer health data is collected in Washington", acting in an individual or household context. The definition "does not include an individual acting in an employment context", a phrase the Act does not define.

The Attorney General gives the start dates: the geofencing section from July 23, 2023, and sections 4 through 9 from March 31, 2024 for regulated entities and June 30, 2024 for small businesses.

## What counts as consumer health data

Consumer health data is "personal information that is linked or reasonably linkable to a consumer and that identifies the consumer's past, present, or future physical or mental health status." The statute's list of what health status includes has several items a fitness or health app touches:

| Item in RCW 19.373.010(8)(b) | Why an app maker should notice it |
| --- | --- |
| Bodily functions, vital signs, symptoms, or measurements | The metrics wearables and health apps record |
| Biometric data | Defined to include gait patterns or rhythms that contain identifying information |
| Precise location that could reasonably indicate an attempt to receive health services | Precise location means within a radius of 1,750 feet |
| Health information derived or extrapolated from nonhealth information | Including inferences made by any means, including algorithms or machine learning |

The Attorney General's FAQ draws the line with examples: buying toilet paper or deodorant is not consumer health data, while "an app that tracks someone's digestion or perspiration is collecting consumer health data", and health inferences drawn from purchases can be. Personal information "includes, but is not limited to, data associated with a persistent unique identifier, such as a cookie ID, an IP address, a device identifier".

## What the Act requires

| Duty | What the text requires | Section |
| --- | --- | --- |
| Consumer health data privacy policy | Disclose the categories collected and why, their sources, what is shared and with which third parties and affiliates, and how to exercise rights; link it prominently from the homepage | RCW 19.373.020 |
| Consent to collect | Collect only with consent for a specified purpose, or to the extent necessary to provide a product or service the consumer requested | RCW 19.373.030 |
| Separate consent to share | Share only with consent that is separate and distinct from the consent to collect, or as necessary for a requested product or service | RCW 19.373.030 |
| Access, withdrawal and deletion | Confirm and give access, with a list of third parties and affiliates; honor withdrawal of consent; delete on request | RCW 19.373.040 |
| Security | Restrict access to people who need it, and keep safeguards that meet a reasonable standard of care in the industry | RCW 19.373.050 |
| Sale | Sell only with a signed valid authorization, separate from the consent to collect or share | RCW 19.373.070 |
| Geofencing | No geofence around a place that provides in-person health care, for tracking, data collection or messaging | RCW 19.373.080 |

### Consent has a statutory definition

Consent is "a clear affirmative act that signifies a consumer's freely given, specific, informed, opt-in, voluntary, and unambiguous agreement". It may not be obtained through "A consumer's acceptance of a general or broad terms of use agreement", by "A consumer hovering over, muting, pausing, or closing a given piece of content", or through deceptive designs. Consent must come before the collection or sharing, and the request must disclose the categories of data, the purpose and specific uses, the categories of recipients, and how to withdraw.

### For an app, the homepage includes the store listing

The privacy policy link goes on the homepage, and for "an online service, such as a mobile application, homepage means the application's platform page or download page, and a link within the application, such as from the application configuration, "about," "information," or settings page." The Attorney General adds that the policy "must be a separate and distinct link" on the homepage and may not contain additional information the Act does not require.

### Rights requests have deadlines

A regulated entity must act on access, withdrawal and deletion requests "within 45 days of receipt", extendable once by 45 more days if it tells the consumer why within the first 45. Deletion must cover "all parts of the regulated entity's or the small business's network, including archived or backup systems", where deletion may be delayed by up to six months, and every affiliate, processor, contractor or other third party that received the data must be told of the request and must delete it too. Responses are free up to twice a year, an appeal process is required, and a company "may not require a consumer to create a new account in order to exercise consumer rights".

### Selling needs a signed authorization

It is unlawful to sell or offer to sell consumer health data without a valid authorization signed by the consumer. The authorization must name the specific data, the seller and the purchaser with contact details, and the purpose; say that goods or services cannot be conditioned on signing, that it can be revoked, and that the purchaser may redisclose the data; carry "an expiration date for the valid authorization that expires one year from when the consumer signs"; and bear the consumer's signature and date. Seller and purchaser must each keep a copy for six years.

### Geofencing

It is "unlawful for any person to implement a geofence around an entity that provides in-person health care services" to identify or track consumers seeking health care, to collect consumer health data, or to send notifications, messages or advertisements about their health data or health care services. A geofence here is "a virtual boundary that is 2,000 feet or less from the perimeter of the physical location."

## Enforcement

The Act makes a violation "an unfair or deceptive act in trade or commerce and an unfair method of competition for the purpose of applying the consumer protection act, chapter 19.86 RCW." The Attorney General's FAQ says any violation "is a per se violation of the Washington Consumer Protection Act (CPA), RCW 19.86, which is enforced by the Attorney General as well as through private action." The Consumer Protection Act's civil-action section, [RCW 19.86.090](https://app.leg.wa.gov/RCW/default.aspx?cite=19.86.090), lets a person injured in their business or property by a violation of the sections it lists "bring a civil action in superior court to enjoin further violations, to recover the actual damages sustained by him or her, or both, together with the costs of the suit, including a reasonable attorney's fee."

## What the Act does not cover

RCW 19.373.100 exempts, among other things: protected health information under HIPAA; information originating from that data and intermingled with it so as to be indistinguishable, when maintained by a HIPAA covered entity or business associate; identifiable private information for human subjects research under 45 C.F.R. Part 46 and related research rules; and personal information governed by laws including the Gramm-Leach-Bliley Act, the Fair Credit Reporting Act and FERPA. The definition of consumer health data also leaves out information used in public-interest research that an institutional review board or similar independent oversight entity approves, monitors and governs. Data used to prevent or respond to security incidents, fraud and other illegal activity is not restricted, but the entity relying on that exception bears the burden of showing it qualifies.

## What this means for a fitness app

In our reading of the text, these are the product consequences:

- **Expect Washington users to bring you in scope.** The tests are doing business in Washington or targeting products or services to consumers there, and a consumer includes anyone whose consumer health data is collected in Washington.
- **Design two consent moments, not one.** Collection beyond what a requested feature needs, and sharing beyond it, each need their own opt-in, and neither can ride on accepting terms of use. In our reading an operating system's health-permission prompt is not, by itself, the consent the Act defines.
- **Make deletion reach backups and processors** on a 45-day clock, with the six-month window for archived and backup systems tracked.
- **Put the policy link where the Act says an app's homepage is:** the store listing page and a settings, about or information screen.
- **Check every analytics and advertising SDK against the sharing rules.** A disclosure to a processor is not sharing when it provides goods or services consistent with the purpose the data was collected for; a partner that is not your processor receives it as a third party unless another exception applies.
- **Never geofence health care facilities** to track people, collect their data or send them health-related messages.

For research use, see [wearable data platforms for research studies](/fitness-apis/wearable-research-data-platforms). For how this sits with HIPAA and the federal breach rule, see [is fitness data PHI?](/compliance/is-fitness-data-phi) and [the FTC Health Breach Notification Rule](/compliance/ftc-health-breach-notification-rule).

## Sources

- [app.leg.wa.gov/RCW/default.aspx?cite=19.373&full=true](https://app.leg.wa.gov/RCW/default.aspx?cite=19.373&full=true) — Full text of chapter 19.373 RCW: finding and intent, definitions, privacy policy, collection and sharing, consumer rights, security, processors, sale authorization, geofencing, consumer protection act, exemptions, short title. (checked 2026-10-17)
- [www.atg.wa.gov/protecting-washingtonians-personal-health-data-and-privacy](https://www.atg.wa.gov/protecting-washingtonians-personal-health-data-and-privacy) — Attorney General's FAQ: enactment, effective dates by section, enforcement by the Attorney General and private action, storage-only entities, out-of-state processors, the separate homepage link, the toiletry and digestion examples. (checked 2026-10-17)
- [app.leg.wa.gov/RCW/default.aspx?cite=19.86.090](https://app.leg.wa.gov/RCW/default.aspx?cite=19.86.090) — Consumer Protection Act civil action for damages. (checked 2026-10-17)

## FAQ

### Does Washington's My Health My Data Act apply to an app company based outside Washington?

It can. A regulated entity is any legal entity that conducts business in Washington or produces or provides products or services targeted to consumers in Washington, and that decides the purpose and means of handling consumer health data. Washington's Attorney General says out-of-state processors working for regulated entities must also comply, while an entity that only stores data in Washington is not a regulated entity for that reason alone.

[Permalink](https://aifitnessapi.com/compliance/washington-my-health-my-data-act#faq-1)

### Is heart-rate data from a fitness app consumer health data in Washington?

In our reading, usually, when it is linked or reasonably linkable to a user. The statute's list of what counts as physical health status includes bodily functions, vital signs, symptoms, or measurements, and the Attorney General's FAQ gives an app that tracks digestion or perspiration as an example of collecting consumer health data. The Act does not define vital signs, so confirm borderline metrics with counsel.

[Permalink](https://aifitnessapi.com/compliance/washington-my-health-my-data-act#faq-2)

### How long does a company have to act on a My Health My Data Act deletion request?

45 days from receiving the request, extendable once by another 45 days if the company tells the consumer why within the first 45. Deletion must reach archived and backup systems, where it may be delayed by up to six months, and every affiliate, processor, contractor or other third party that received the data must be notified and must delete it too.

[Permalink](https://aifitnessapi.com/compliance/washington-my-health-my-data-act#faq-3)

### Can an app sell consumer health data under Washington law?

Only with a valid authorization the consumer signs, separate from any consent to collect or share. It must name the data, the seller, the purchaser and the purpose, state that goods or services cannot be conditioned on signing and that it can be revoked, expire one year after signing, and seller and purchaser must each keep a copy for six years. Selling or offering to sell without it is unlawful.

[Permalink](https://aifitnessapi.com/compliance/washington-my-health-my-data-act#faq-4)

### Who can sue under Washington's My Health My Data Act?

Washington's Attorney General says any violation is a per se violation of the state Consumer Protection Act, enforced by the Attorney General and through private action. The Consumer Protection Act's civil-action section, RCW 19.86.090, lets a person injured in their business or property bring a civil action to stop violations and recover actual damages, with the costs of the suit and a reasonable attorney's fee.

[Permalink](https://aifitnessapi.com/compliance/washington-my-health-my-data-act#faq-5)