This analysis describes what Oura's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
The updated policy discloses that Oura Advisor, an AI assistant, processes text and information you submit to provide personalized wellness guidance. The policy now explicitly states that third-party integrations may include LLM providers, meaning your health data could be shared with language model services. The policy removed prior language stating Oura would notify users if it received government requests for data access, which may reduce transparency about law enforcement inquiries. You can disconnect third-party integrations at any time, but you should review each third party's privacy policy before authorizing a connection and exercise deletion rights directly with third parties if needed.
View change record →How other platforms handle this
You have the right to access, correct, delete, or object to the processing of your personal data. You also have the right to data portability and to file complaints with the NPC.
If you choose to exercise any of the privacy rights described above, you will not receive discriminatory treatment from us.
Keep other people's personal information private and don't create content that poses privacy or security risks to any person.
"When you direct a HIPAA Covered Entity or Business Associate to share your health records with Oura through a patient-directed disclosure or HIPAA Authorization, the records we receive no longer fall under HIPAA while they are in Oura's possession...Excerpt from Oura's Privacy Policy
Ad personalization controls removed. Contact scanning added. Advertiser data partnerships quietly dropped. A timeline of every change.
Get the weekly coverage letter
Companies change their terms without announcing it. We capture governance documents, compare each new version with the last, and publish what changed, with the source text behind it. One email a week on what we found and what we could not reach.
The clause states: “When you direct a HIPAA Covered Entity or Business Associate to share your health records with Oura through a patient-directed disclosure or HIPAA Authorization, the records we receive no longer fall under HIPAA while they are in Oura's possession...”
ConductAtlas has identified this type of provision across 277 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Oura.