When a user consents to share their Oura health and biometric data with a Data Recipient (employer, researcher, coach, doctor, or other entity) via the Oura Platform, that recipient becomes an independent data controller, and Oura's direct privacy obligations do not govern the recipient's subsequent processing of that data.
This analysis describes what Oura's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes that Oura's privacy obligations cease to directly govern user health data once it is shared with a Data Recipient, shifting data controller responsibility to the receiving entity. Compliance teams evaluating employer wellness deployments or research partnerships should assess whether the consent mechanism presented to users meets applicable standards for valid, freely given consent, particularly under GDPR Article 9 in employment contexts.
Interpretive note: The enforceability and validity of consent under GDPR Article 9 in employment contexts is subject to regulatory interpretation and may vary by EU member state.
The updated policy explicitly discloses that Oura uses artificial intelligence and machine learning in the service, including an AI assistant called Oura Advisor that provides personalized wellness guidance based on information you submit or that Oura collects. The revised terms state that Oura may use AI and algorithmic analysis to suggest partner services and may use personal data to develop or refine AI-powered health features. The policy establishes that you retain choice about whether to engage with these AI features or share personal data with partner services when suggestions are offered.
View change record →Removed language about Data Recipient's own privacy practices, the instruction to review their privacy policy, and the incomplete liability disclaimer statement, making the provision more concise but less informative about user obligations.
View full change record →Under this provision, once a user consents to share biometric and health data with a Data Recipient through Oura Platform, that recipient's handling of the data is governed by the recipient's own privacy practices rather than Oura's policy. Users should review the Data Recipient's privacy terms separately before providing consent to share their data.
How other platforms handle this
Where ZipRecruiter processes your Personal Data in the capacity of a service provider (data processor), and you seek access, or want to correct, amend, or delete your Personal Data...we will provide you with the data controller's contact information, so you can contact them directly.
We will also provide an individual opt-out choice, or opt-in for sensitive data, before we share your data with third parties other than our agents, or before we use it for a purpose other than which it was originally collected.
to request that your data be transferred to a third party (data portability)
"Once your data is shared to the Oura Platform, the Data Recipient becomes the controller of your personal data. The Data Recipient is responsible for its use and processing of your personal data in accordance with all applicable data protection and privacy laws.Excerpt from Oura's Privacy Policy
1) REGULATORY LANDSCAPE: This provision implicates GDPR Articles 4(7), 7, 9, and 26 regarding data controller designation, consent validity for special-category health data, and potential joint-controller arrangements.
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Search "[your state] attorney general consumer complaint" to find your state's direct complaint form
Ad personalization controls removed. Contact scanning added. Advertiser data partnerships quietly dropped. A timeline of every change.
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
This provision establishes that Oura's privacy obligations cease to directly govern user health data once it is shared with a Data Recipient, shifting data controller responsibility to the receiving entity. Compliance teams evaluating employer wellness deployments or research partnerships should assess whether the consent mechanism presented to users meets applicable standards for valid, freely given consent, particularly under GDPR Article …
Under this provision, once a user consents to share biometric and health data with a Data Recipient through Oura Platform, that recipient's handling of the data is governed by the recipient's own privacy practices rather than Oura's policy. Users should review the Data Recipient's privacy terms separately before providing consent to share their data.
ConductAtlas has identified this type of provision across 290 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Oura.