The policy states that health data, including physiological measurements and health-related notes and tags, is classified as special-category personal data and is processed only on the basis of user consent; consent may be provided through in-app actions such as adding health tags or notes rather than solely through an explicit consent dialogue.
This analysis describes what Oura's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes that behavioral in-app actions (adding notes or health tags) may constitute consent for processing special-category health data. Compliance teams should evaluate whether this mechanism satisfies GDPR Article 9's requirement for explicit consent and whether users are adequately informed that these actions constitute a consent signal.
Interpretive note: Whether behavioral in-app actions satisfy GDPR Article 9 explicit consent requirements is subject to regulatory interpretation and may vary by EU supervisory authority.
The updated policy explicitly discloses that Oura uses artificial intelligence and machine learning in the service, including an AI assistant called Oura Advisor that provides personalized wellness guidance based on information you submit or that Oura collects. The revised terms state that Oura may use AI and algorithmic analysis to suggest partner services and may use personal data to develop or refine AI-powered health features. The policy establishes that you retain choice about whether to engage with these AI features or share personal data with partner services when suggestions are offered.
View change record →Removed the redundant statement 'We process your sensitive personal data only with your consent' and completed the truncated sentence with 'in the Oura App' instead of the incomplete 'in'.
View full change record →Under this clause, adding health-related notes or tags within the Oura App constitutes consent for Oura to process those entries as sensitive personal data. Users can withdraw consent and request deletion of sensitive data by contacting privacy@ouraring.com.
How other platforms handle this
We will only collect, use and disclose your personal data with your consent, unless otherwise permitted or required by law. Your consent may be given expressly or implied, depending on the circumstances and the sensitivity of the information involved.
You may give us your Identity Data, Contact Data, Financial Data, Profile Data, and other information by filling in forms or by corresponding with us by post, phone, e-mail or otherwise.
telemetry information collected includes: (i) microservice settings, (ii) usage data and (iii) hardware environment.
"Please note that some of the personal data we process, including any data concerning your health, is considered special or sensitive personal data. Under applicable law, such data is processed only if you have given your consent for processing. In some cases, you can provide your consent to us for processing your data through your actions, such as by adding sensitive personal data into your notes, or by adding health related tags in the Oura App.Excerpt from Oura's Privacy Policy
1) REGULATORY LANDSCAPE: This provision directly implicates GDPR Article 9 (processing of special categories of personal data) and the explicit consent requirement under Article 9(2)(a).
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Netflix updated its Privacy Statement on April 18, 2026, disclosing voice recording collection and expanded household ad profiling for the first time.
Google's Privacy Policy covers Search, Gmail, YouTube, Maps, and every site running Google Analytics. Here is what it actually authorizes.
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
This provision establishes that behavioral in-app actions (adding notes or health tags) may constitute consent for processing special-category health data. Compliance teams should evaluate whether this mechanism satisfies GDPR Article 9's requirement for explicit consent and whether users are adequately informed that these actions constitute a consent signal.
Under this clause, adding health-related notes or tags within the Oura App constitutes consent for Oura to process those entries as sensitive personal data. Users can withdraw consent and request deletion of sensitive data by contacting privacy@ouraring.com.
ConductAtlas has identified this type of provision across 296 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Oura.