The US medical records privacy law doesn't apply to many kinds of medical data including the data collected by exercise trackers.

This is a problem because of exercise trackers that contain proprietary software and are designed to send the user's personal data to a company site. Such products are essentially unethical, and people should not be surprised when the proprietary software turns out to be malware.

The US medical records privacy law (HIPAA) is totally inadequate when it comes to government access to your records.