AI and athlete data: what you can do and how to ask

The starting point

Most activity data reveals information about health, such as heart rate, heart rate variability, sleep and recovery. Under the GDPR, health data may not be processed on the basis of a contract or legitimate interests. For AI features, that leaves explicit consent from the athlete as the practical legal basis, at every tier described below.

Two further sets of rules apply. The platforms you receive data from set their own conditions on AI, which are often stricter than the law. And the EU AI Act requires that athletes know when they interact with an AI system.

Check what your data sources allow

Check the conditions of each platform before you design an AI feature. Where conditions differ, a feature may have to be available for data from one source and not another. The table shows examples from published terms, checked in October 2026. Terms change, so check the current version yourself.

Record the source of every data point, so that your systems can exclude data from sources that do not allow a particular use.

Determine the tier of each AI use

The requirements increase as data moves further from the athlete it belongs to. Determine the tier of each AI feature separately.

Note: an AI feature for the athlete's own data is part of the service they asked for, so the consent can be tied to the feature: an athlete who does not consent does not get that feature. Training models (tier 3) is a separate purpose, so athletes must be able to refuse it and still use everything else.

Ask for consent

Valid consent is specific to one purpose, informed, given by a clear action, and as easy to withdraw as to give. For health data it must also be explicit: a separate statement or an unticked choice that the athlete selects.

• Ask at the moment it is relevant, for example when the athlete first opens the AI coach, not hidden in sign-up.
• Give "No thanks" the same prominence as "I agree". Do not ask again repeatedly after a refusal.
• Name the data used, the purpose and the AI provider in the request itself, with a link to your full statement.
• Offer a setting where the athlete can see and change each choice at any time.
• Record for each athlete what they agreed to, when, and which version of the text they saw. Ask again when the purpose changes.

Disclose what you do

Publish an AI transparency statement as a clearly marked section of your privacy policy. Garmin's developer terms require one where Garmin data is used for AI, and it is good practice in every case. It should cover:

• each feature that uses AI, and what it does;
• which data each feature uses, and which data sources are excluded;
• which AI providers process the data, where, and for how long they keep it;
• whether you train models on athletes' data, and on what basis;
• how athletes give and withdraw consent, and what happens when they withdraw;
• that AI output can be wrong, and is not medical advice.

Since 2 August 2026, the AI Act requires that people are told when they interact with an AI system, unless that is obvious. Label an AI coach or chat feature clearly, and mark text and images generated by AI as such.

Choose and configure AI providers

When you use a provider such as OpenAI, Anthropic, Google or Mistral through its API, it processes athletes' data on your behalf. Check the following for each provider:

• A data processing agreement is in place, and the provider is listed in your privacy policy.
• The provider does not use your data to train its own models. Most do not for API use by default, but check your contract and settings.
• How long the provider keeps requests, and whether zero data retention is available to you.
• Where data is processed, and which transfer safeguard applies outside the European Economic Area.
• Send only what the feature needs: metrics rather than names, email addresses or precise locations.

Consumer chat tools are outside these agreements and may use what is entered to train their models. Adopt a written rule that staff do not enter athletes' data into them.

Uses that need particular care

Medical claims

An AI feature that claims to detect illness, overtraining syndrome or heart conditions may be a medical device, and then also a high-risk AI system. Describe features in terms of fitness and training. See item 6 of the terms and conditions checklist.

Employers and insurers

Where an AI score is used by an employer, such as a professional club, or an insurer to make decisions about athletes, stricter rules apply, including on automated decision-making. Consent is rarely valid where there is an imbalance of power.

Emotion recognition

Inferring emotions from biometric data, such as heart rate, is prohibited in the workplace, which includes professional sport.

Minors

Use particular care with AI features for young athletes, and do not train models on their data without parental consent where required.

Legal references

Articles 6, 7, 9, 13, 22 and 35 GDPR; EDPB Guidelines 05/2020 on consent; EDPB Opinion 28/2024 on AI models; Articles 5 and 50 Regulation (EU) 2024/1689 (AI Act). Proposed amendments to the GDPR were under negotiation in October 2026. As proposed, they would not change the need for explicit consent for health data that is collected deliberately.

Working with a lawyer

A review is faster and less expensive when you arrive prepared. Bring the following:

• a list of your AI features, with the tier of each and the data sources it uses;
• the developer terms of each platform you connect to, with the version you accepted;
• your AI providers' data processing agreements and data retention settings;
• your consent screens and draft AI transparency statement.

Ask in particular for advice on the questions that require legal judgement: whether your aggregated or trained data is anonymous, how to handle withdrawal for models already trained, and whether an impact assessment is required.