Mi Fitness

Is Mi Fitness safe?

For tracking steps, sleep and workouts, yes, with some caveats about how much Xiaomi learns about your phone and where it keeps it. Mi Fitness is Xiaomi's companion app for its own bands and watches, including Redmi watches, with more than 50 million installs on Google Play. Neither store label shows ad tracking, and Xiaomi pays security researchers through a public bug bounty.

The weaker points are collection and control. The privacy policy asks for more phone identifiers than a fitness app needs, several features hand data to partners, and the deletion process is vague. A European privacy group has also asked Greece's data protection authority to rule on whether Mi Fitness data goes to China.

We score Mi Fitness 64/100, below Huawei Health at 68 and Garmin Connect at 70, but above Strava at 59.

What Mi Fitness collects

When you pair a band or watch, the policy says Xiaomi collects your Xiaomi ID along with your phone's IMSI, MAC address, MEID, Android ID, hardware serial number and SIM card identifier. Those are stable identifiers that follow a phone and a SIM, not just an app install.

Health data is what you would expect from a modern watch: steps, heart rate, blood oxygen, sleep stages, stress and, where the device supports it, blood pressure, blood glucose and menstrual cycle. An optional medical ID can hold your blood type, allergies, chronic conditions and medication.

Apple's label links health, location, payment details, email, phone number, photos, audio and a device ID to you, and says the device ID is used for analytics. Nothing is listed as used to track you across other companies' apps.

Who else gets your data

The policy names several partners. Outdoor workout routes are drawn by a third-party SDK, which the policy links to Google, and it receives your location. Watches with Amazon Alexa send their device ID to Amazon. On some models, an "AI Zone" sends your voice prompts and the watch's MAC address to an outside AI provider. A motion-sensing workout partner gets your nickname, gender, heart rate and calories if you use its courses. You can also choose to sync with Strava, Google Fit, Suunto, Health Connect or Apple Health.

The Mi Fitness policy names Xiaomi data centres in India, the Netherlands, Russia and Singapore, and says data may also reach service providers and partners in other countries. In the EU, UK and Switzerland, Xiaomi Technology Netherlands is responsible for your data.

The complaint about transfers to China

In January 2025, the privacy group noyb filed GDPRGDPRThe EU's General Data Protection Regulation, which sets rules on how organisations collect and use personal data and allows large fines.More in the glossary complaints against six Chinese companies, including Xiaomi. The Xiaomi case was brought in Greece for a woman who synced a Redmi Watch 2 Lite with Mi Fitness. noyb argues that sending Europeans' data to China is unlawful because Chinese authorities can demand access, and points to Xiaomi's own transparency reports showing large numbers of data requests from Chinese authorities. The complainant had asked Xiaomi where her data went and, according to noyb, got no proper answer. We found no decision by October 2026, so this is an allegation, not a finding.

Xiaomi's wider record adds context but does not lower this score. In 2021 Lithuania's cyber security centre reported that a Xiaomi phone could censor terms such as "Free Tibet" and sent encrypted usage data to a server in Singapore, according to the BBC. Xiaomi said its devices do not censor communications. That report was about a phone, not this app.

How to use Mi Fitness safely

1. Turn on 2-step verification for your Xiaomi account, so a new login needs approval on one of your devices.
2. Turn off the User Experience Improvement Program under Profile, then About this app, and on the watch under Settings, Security, Permissions and privacy if it has the setting.
3. Leave AI Zone and voice assistants off unless you use them, since they send voice and device data to partners.
4. Fill in the medical ID only with what a paramedic needs.
5. Before selling or giving away a band or watch, unpair it and remove it from your Xiaomi account.

How we scored it

The regulatory record (86) and scams and harmful content (78) are the strongest factors: there is little contact with strangers and no fine naming the app. Privacy (52) is the weakest, because of the broad device identifiers and data sent to partners, and transparency and control (58) suffers from vague retention and deletion rules. Security (64) benefits from Xiaomi's paid bug bounty.