Colorado Privacy Act Health Data Rules for Wellness Apps: What You Need to Know to Stay Compliant

Applicability of the Colorado Privacy Act

Who is covered

The Colorado Privacy Act (CPA) applies to “controllers” that determine the purposes and means of processing personal data about Colorado residents, and to “processors” that handle personal data on a controller’s behalf. If your wellness app targets people in Colorado or does business in the state, the CPA likely reaches you.

Personal data processing thresholds

• Processing personal data of 100,000 or more Colorado consumers in a calendar year; or
• Processing personal data of 25,000 or more Colorado consumers and deriving revenue or a discount from the “sale” of personal data (monetary or other valuable consideration).

Many direct-to-consumer wellness apps—such as fitness trackers, meditation tools, menstrual or fertility trackers, nutrition and sleep apps—can meet these thresholds quickly, especially when using advertising technology or cross-device analytics.

Scope nuances for wellness apps

• Nonprofits are generally in scope under the CPA, so nonprofit wellness programs should assess applicability.
• “Consumer” excludes individuals acting in an employment or B2B context, so employee wellness data collected solely for HR administration typically falls outside the CPA’s consumer scope.
• De-identified and publicly available information are not subject to the CPA, but you must maintain safeguards and commitments to keep data de-identified.

Definition of Sensitive Data

What counts as sensitive under the CPA

For wellness apps, sensitive data most commonly includes personal data revealing a physical or mental health condition or diagnosis, genetic data, and biometric identifiers used to uniquely identify a person (for example, facial geometry or certain voiceprints). Personal data from a known child is also sensitive.

Health data and inferences

Information you collect directly—heart rate, menstrual cycle details, medication logs—or that you infer about someone’s health (such as pregnancy likelihood, stress level, or potential sleep disorder) should be treated as sensitive if it can be linked or reasonably linkable to an individual and retained beyond transient processing. Plan to apply sensitive data safeguards and obtain consent for sensitive information before processing.

Exemptions Under the CPA

• HIPAA exemptions: Protected Health Information (PHI) handled by HIPAA covered entities or business associates is generally exempt when processed in accordance with HIPAA. However, non-PHI consumer data held by the same organization—such as data from a direct-to-consumer wellness app—may still be subject to the CPA.
• Other sectoral laws: Certain data governed by laws like FERPA (student records), GLBA (financial institutions), or FCRA may be exempt when processed under those regimes.
• Employment/B2B context: Personal data collected and used solely in an employment or commercial (B2B) context is outside the CPA’s consumer scope.
• De-identified/public data: De-identified and publicly available information are excluded, provided you uphold de-identification commitments.

Key Compliance Obligations for Wellness Apps

Be transparent

Publish a clear, accessible privacy notice that describes categories of personal data (including any sensitive data), purposes, retention approach, categories of personal data shared, categories of third parties, and how consumers can exercise their rights. If you profile users or use targeted advertising, explain what you do and why.

Honor consumer privacy rights

Build in mechanisms for consumers to exercise core consumer privacy rights: access, correction, deletion, data portability, and opt out of targeted advertising, the sale of personal data, and certain profiling with significant effects. Provide a straightforward appeals process if you decline a request. Verify identities proportionately and respond within statutory timelines.

Respect opt-outs and universal signals

If you engage in targeted advertising or sell personal data, offer easy opt-out choices and honor recognized universal opt-out signals sent by consumers’ browsers or devices. Ensure your advertising SDKs and analytics tags do the same.

Manage processors and SDKs

Use written processor contracts that specify instructions, confidentiality, security, subprocessor controls, audit support, and deletion/return of data. Vet third-party SDKs for data flows that could be deemed a sale or targeted advertising and for any collection of sensitive data without consent.

Practice data minimization and purpose limitation

Collect only what you need for stated purposes, keep it no longer than necessary, and avoid repurposing data in ways that are incompatible with your initial disclosures without first obtaining fresh consent when required—this is the essence of data minimization.

Implement reasonable security practices

Adopt security appropriate to the volume and sensitivity of data, including encryption in transit and at rest, strong authentication, role-based access controls, secure key management, vulnerability management, and incident response processes. Document and test these safeguards regularly.

Sensitive data safeguards

For health and other sensitive data, layer additional controls: stricter access, audit logging, tighter retention, and enhanced user consent and withdrawal options. Avoid using sensitive data for targeted advertising or sale.

Data Protection Assessments

Conduct Data Protection Assessments (DPA) for processing that presents a heightened risk of harm, including processing sensitive data, targeted advertising, selling personal data, and certain profiling activities. Complete the assessment before launching or materially changing such processing, and update it periodically.

What to include in your assessment

• Description of processing, data categories (highlighting sensitive data), systems, and vendors involved.
• Assessment of benefits to consumers and your business versus potential risks to consumer privacy.
• Risk mitigation measures, including reasonable security practices and sensitive data safeguards.
• Evaluation of alternatives that reduce risk while achieving business goals.
• How you enable consumer privacy rights and respect opt-outs and universal signals.

Keep your DPA on file and be prepared to provide it to regulators upon request.

Consent Requirements for Sensitive Data

The CPA requires opt-in consent before processing sensitive data. Consent must be a clear, affirmative, freely given, specific, informed, and unambiguous indication of the consumer’s wishes. No pre-checked boxes, nudging, or bundling with unrelated terms.

Designing consent for wellness apps

• Present granular choices for each sensitive purpose (for example, “track menstrual cycle,” “share activity data with friends,” “use heart-rate data for personalized coaching”).
• Provide concise, layered explanations of what you collect, why, retention timeframes, and with whom it will be shared.
• Offer an easy, always-available way to withdraw consent in-app, and stop processing upon withdrawal (except where retention is legally required).
• Treat sensitive data inferences—such as pregnancy likelihood or stress state—as sensitive when linkable or retained beyond transient processing.
• For known children, obtain verifiable parental consent and avoid targeted advertising and sale of personal data.

Best Practices for Wellness Apps

• Map data flows end to end, distinguishing personal, sensitive, de-identified, and aggregated data, and documenting lawful bases and retention.
• Reduce risk at the source: collect the least data needed, disable unnecessary device permissions, and prefer on-device processing where feasible.
• Build a consent journey that is brief, plain-language, purpose-specific, and revisit consent when you materially change processing.
• Operationalize consumer privacy rights directly in the app: request center, status tracking, verification, and an accessible appeals path.
• Implement privacy-by-design guardrails for engineers, including SDK intake reviews, “sale/targeted advertising” impact checks, and profiling reviews.
• Adopt a defensible retention schedule; auto-delete stale sensitive data and backups; keep only what ongoing features truly require.
• Continuously test reasonable security practices with secure development, code review, pen testing, encryption, key rotation, monitoring, and incident response drills.
• Train teams handling health data on sensitive data safeguards, consent for sensitive information, and data handling procedures.

Bottom line: if your wellness app processes Colorado consumers’ health-related data, assume the CPA applies, treat health and health inferences as sensitive, obtain valid consent, honor consumer privacy rights, complete Data Protection Assessments for high-risk processing, and maintain strong security and minimization throughout the product lifecycle.

FAQs

Which wellness apps are subject to the Colorado Privacy Act?

Any app that targets Colorado residents and meets the personal data processing thresholds—processing data about 100,000 consumers in a year, or 25,000 when deriving revenue or a discount from selling personal data—can be subject to the CPA. This includes fitness, sleep, nutrition, meditation, reproductive health, and similar wellness apps, whether subscription-based or ad-supported.

What types of health data are considered sensitive under the CPA?

Personal data revealing a physical or mental health condition or diagnosis, genetic data, biometric identifiers used to uniquely identify someone, and personal data from a known child are sensitive. Inferences tied to a person—such as predicted pregnancy, stress, or potential sleep disorder—should also be treated as sensitive when retained or linkable.

How does HIPAA affect CPA compliance for wellness apps?

HIPAA exemptions generally cover PHI handled by covered entities or business associates when processed under HIPAA. But most direct-to-consumer wellness app data is not PHI. That means HIPAA exemptions may not apply, and the CPA’s requirements—including consent for sensitive information, consumer privacy rights, and reasonable security practices—still govern your app’s data.

What are the key consent requirements under the CPA?

You must obtain explicit, opt-in consent before processing sensitive data. Consent must be specific to each purpose, informed, freely given, and unambiguous. Avoid pre-ticked boxes and dark patterns, provide a persistent way to withdraw consent in-app, and stop sensitive data processing when consent is withdrawn. For known children, verifiable parental consent is required.