Is My Health App Safe? Is Oura safe?
Scorecard updated 2026-04-13
| Category | Smart ring — continuous heart rate, HRV, temperature, sleep, activity |
|---|---|
| Company | Ōura Health Oy (Finland) / Oura Ring Inc. (US) |
| Approx. users | 2.5M+ rings sold |
| HIPAA covered? | No — consumer product. A separate enterprise/clinical programme may be. |
| GDPR applies? | Yes. Finland-headquartered; EU-wide GDPR baseline. |
| Sensor data resolution | Minute-level (some signals higher) — effectively continuous. |
1. What data does Oura collect?
Continuous heart rate, heart rate variability, skin temperature, blood oxygen (on supported rings), accelerometer-derived activity and sleep stages, menstrual cycle information (where the user opts in), and user-entered tags like workouts, stress, and illness. Also: device identifiers, app usage, and account information.
This is by some distance the largest continuous biometric dataset of any app we review. Even where each individual signal seems benign, the combination is uniquely identifying and extremely informative about health state.
2. Who does Oura share data with?
Oura's policy discloses use of cloud infrastructure providers, analytics, and — most notably — "research partners." Historically Oura has collaborated on published research projects (COVID-19 detection, fertility, sleep) with universities and public-health bodies. Some of these programmes are opt-in; the general "aggregated and de-identified research" clause is broader.
Oura does not run a traditional advertising-SDK stack inside the app, which materially distinguishes it from Flo and Balance. Monetisation is hardware plus subscription, not data resale.
3. What does the privacy policy actually say?
Oura's policy is among the clearer in this category: separate sections for account data, sensor data, and research data; plain-language summaries at the top; specific named processors. The weakest point is the breadth of the "aggregated and de-identified" carve-out, which — per standard re-identification research — is not as protective as it sounds for high-dimensional biometric data.
4. HIPAA status
The consumer Oura Ring is not HIPAA-covered. Oura also runs enterprise and clinical programmes (e.g. with the US Department of Defense, health systems) that may involve Business Associate Agreements — but that is the enterprise product, not the consumer ring on your finger.
5. GDPR status
Oura is Finland-headquartered, so EU GDPR applies as the baseline. Data-subject access and erasure mechanisms are provided. Transfers to the US for cloud processing rely on Standard Contractual Clauses and the EU-US Data Privacy Framework.
6. Security posture
Oura publishes a security overview, runs a bug bounty programme, and uses standard cloud security controls. We are not aware of a public breach. Security is a genuine strength relative to the category; the concerns here are about data handling policy, not defensive posture.
7. Deletion & retention
Account deletion is available and removes identifiable data, with the standard caveats for backups and legal retention. Oura has stated that anonymised research contributions, once contributed, remain in research datasets after account deletion — this is consistent with GDPR's research provisions but is worth knowing before opting in.
Grade rationale
- Collection scope: very broad by necessity of the product — minute-level continuous biometrics.
- Third-party sharing: no advertising SDKs, but research-partner scope is broad.
- Regulatory: GDPR-native is a meaningful plus.
- Policy clarity: well above category average.
- Security: strong. Public bug bounty, no known breaches.
- Deletion: workable; research contributions persist post-deletion by design.
Weighted score ≈ 72 → C (high). On the border of B; collection volume holds it back.
What would move this to a B
- Narrower, per-study opt-in for research rather than a general aggregated-research clause.
- Explicit commitment against training third-party AI models on Oura user data.
- Specific retention windows for minute-level biometrics.
Sources: Oura Health privacy policy and security overview; GDPR regulatory framework; public research publications involving Oura data. This page is editorial analysis, not legal advice.