Oura Privacy Policy

This document is Oura Health's privacy policy (dated April 20, 2026), governing the collection, processing, and sharing of personal data by Oura Health Oy and Ouraring Inc. across the Oura Ring hardware, Oura App, Oura on the Web, and associated services; the policy invokes contract, consent, legitimate interest, and legal obligation as its stated lawful bases under GDPR and UK data protection law. The agreement states that Oura collects and processes a broad range of data categories including contact information, user-provided profile data, device identifiers and location data, physiological measurements (heart rate, temperature, respiration, movement), calculated health and sleep metrics, and user-generated notes and tags; the terms authorize use of this data for service delivery, customer service, product improvement, analysis, marketing, third-party integrations, and legal compliance. The policy discloses that when users participate in the Oura Platform feature, once consent is given to share data with a Data Recipient (employer, researcher, coach, or other entity), that Data Recipient becomes an independent data controller, meaning Oura's obligations do not extend to that recipient's subsequent processing; the policy also states that Oura does not sell personal data but authorizes sharing with advertising and analytics partners through cookie-based tracking under a separate Cookie Policy. The policy engages GDPR, UK GDPR, CCPA/CPRA, and state-level US privacy frameworks; EU and California residents are granted explicit rights including access, correction, deletion, portability, objection, and opt-out of data sale or sharing, while the scope of health data protections under HIPAA depends on whether Oura qualifies as a covered entity or business associate in a given context, which the document does not address. Material compliance considerations include the employer/researcher data-controller transfer via Oura Platform, the reliance on legitimate interest for marketing and service improvement involving sensitive health-adjacent data, and the adequacy of consent mechanisms for special-category health data across multiple jurisdictions.