Track 1 platform and get the weekly governance digest. No credit card required.
This page describes what the document states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability may vary by jurisdiction. Methodology
This is Oura's privacy policy, which explains how the company collects and uses the detailed health and biometric data captured by your Oura Ring, including sleep stages, heart rate, body temperature, reproductive health signals, and location. The most important thing to understand is that if you connect your Oura data to the Oura Platform and share it with an employer, coach, doctor, or researcher, that third party becomes the independent controller of your sensitive health data and Oura takes no responsibility for what they do with it. Before accepting any Oura Platform invitation from an employer or organization, carefully review that organization's own privacy policy, as your biometric and health data will fall outside Oura's protections once shared.
This policy governs the collection, processing, and sharing of personal data by Oura Health Oy and Ouraring Inc. in connection with the Oura Ring, Oura App, Oura on the Web, and related services, with stated legal bases including contract, consent, legitimate interest, and legal obligation under GDPR and equivalent frameworks. The agreement states that Oura processes a broad range of sensitive health data including heart rate, temperature, respiration, sleep phases, reproductive health indicators, and location data, and that users who join the Oura Platform consent to sharing this data with third-party Data Recipients who then become independent data controllers responsible for their own processing. A notable provision establishes that once data is shared to the Oura Platform, Oura explicitly disclaims responsibility for the Data Recipient's processing or security of that data, which creates a meaningful accountability gap for users who share highly sensitive biometric and health data with employers, coaches, or researchers. The policy engages GDPR and UK GDPR for EEA and UK residents, CCPA and CPRA for California residents, and the policy's handling of biometric and health data may require evaluation under HIPAA in contexts where Oura services are used within covered entity or business associate relationships, though Oura does not assert HIPAA applicability. State-level biometric privacy laws including Illinois BIPA and Washington My Health MY Data Act may also be implicated depending on the nature of data collected and user location, creating jurisdictionally variable compliance exposure.
Institutional analysis available with Professional
Regulatory exposure by statute, material risk assessment, vendor due diligence action items, and enforcement precedent. Available on Professional.
Start Professional free trialMonitoring
Oura has updated this document before.
Watcher includes same-day alerts, structured change summaries, and monitoring for up to 10 platforms.
Professional Governance Intelligence
Need provision-level monitoring and regulatory mapping?
Professional includes governance timelines, compliance memos, audit-ready analysis, and full provision tracking.
Start Professional free trialCross-platform context
See how other platforms handle Cross-Border Data Transfers and similar clauses.
Compare across platforms →Governance Monitoring
Structured alerts for policy changes, governance events, and provision updates across 318+ platforms.