According to the GDPR health data is a special category that needs extra care and heart rate falls in that category:

"Information derived from the testing or examination of a body part or bodily substance"