Oura says it will only process your sensitive health data, such as reproductive health signals or medical tags, if you have given consent, and it treats certain in-app actions like adding health tags as a form of consent.
This analysis describes what Oura's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
The policy treats behavioral actions within the app, such as adding a health-related tag, as a form of consent to sensitive data processing, which may not constitute the explicit, informed consent required under GDPR Article 9 for special category health data depending on how these actions are presented to users.
Interpretive note: Whether behavioral in-app actions satisfy GDPR Article 9 explicit consent requirements for special category health data depends on regulatory interpretation and how prominently consent disclosures are presented at the point of the triggering action.
The updated policy explicitly discloses that Oura uses artificial intelligence and machine learning in the service, including an AI assistant called Oura Advisor that provides personalized wellness guidance based on information you submit or that Oura collects. The revised terms state that Oura may use AI and algorithmic analysis to suggest partner services and may use personal data to develop or refine AI-powered health features. The policy establishes that you retain choice about whether to engage with these AI features or share personal data with partner services when suggestions are offered.
View change record →Logging health information or adding tags in the Oura App may be treated as consent to processing sensitive health data, so users should be aware that routine app interactions could have consent implications for their most personal health information.
How other platforms handle this
We will only collect, use and disclose your personal data with your consent, unless otherwise permitted or required by law. Your consent may be given expressly or implied, depending on the circumstances and the sensitivity of the information involved.
You may give us your Identity Data, Contact Data, Financial Data, Profile Data, and other information by filling in forms or by corresponding with us by post, phone, e-mail or otherwise.
telemetry information collected includes: (i) microservice settings, (ii) usage data and (iii) hardware environment.
"Please note that some of the personal data we process, including any data concerning your health, is considered special or sensitive personal data. Under applicable law, such data is processed only if you have given your consent for processing. We process your sensitive personal data only with your consent. In some cases, you can provide your consent to us for processing your data through your actions, such as by adding sensitive personal data into your notes, or by adding health related tags in the Oura App.Excerpt from Oura's Privacy Policy
REGULATORY LANDSCAPE: This provision directly implicates GDPR Article 9, which requires explicit consent for processing special categories of data including health data.
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Netflix updated its Privacy Statement on April 18, 2026, disclosing voice recording collection and expanded household ad profiling for the first time.
Google's Privacy Policy covers Search, Gmail, YouTube, Maps, and every site running Google Analytics. Here is what it actually authorizes.
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
The policy treats behavioral actions within the app, such as adding a health-related tag, as a form of consent to sensitive data processing, which may not constitute the explicit, informed consent required under GDPR Article 9 for special category health data depending on how these actions are presented to users.
Logging health information or adding tags in the Oura App may be treated as consent to processing sensitive health data, so users should be aware that routine app interactions could have consent implications for their most personal health information.
ConductAtlas has identified this type of provision across 296 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Oura.