MyFitnessPal
Heart rate, sleep, routes and cycles are filed as fitness, not medical records, so the protections around medical records mostly do not apply. Join through a workplace scheme or an insurer's plan and your activity goes to the sponsor. The file stays as long as the account does.
Reported incidents
Usernames, emails and passwords of about 150 million users taken
2018-03-29Affected MyFitnessPal app and website
Under Armour, which then owned MyFitnessPal, said on 29 March 2018 that the diet and exercise app had been breached in late February and that it found out on 25 March. It put the number of affected users at about 150 million. Usernames, email addresses and passwords may have been taken; the company said the passwords were protected by strong encryption. Have I Been Pwned later counted 144 million unique email addresses, with IP addresses and passwords stored as SHA-1 and bcrypt hashes, after the data was listed for sale in 2019. The company required users to change their passwords.
People affected typically ask MyFitnessPal to confirm whether their information was included, and which categories.
The verified route
DÆTRAX is a personal data accountability ledger: a dated record of which companies hold your personal data, what you asked them to do about it, and what they claimed in reply.