This analysis describes what Oura's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
Control over and legal responsibility for personal data shifts from Oura to the Data Recipient at the moment of sharing, which affects which entity the user must look to for data rights and protections.
The updated policy discloses that Oura Advisor, an AI assistant, processes text and information you submit to provide personalized wellness guidance. The policy now explicitly states that third-party integrations may include LLM providers, meaning your health data could be shared with language model services. The policy removed prior language stating Oura would notify users if it received government requests for data access, which may reduce transparency about law enforcement inquiries. You can disconnect third-party integrations at any time, but you should review each third party's privacy policy before authorizing a connection and exercise deletion rights directly with third parties if needed.
View change record →After your data is shared to the Oura Enterprise Platform, the Data Recipient — not Oura — controls and is responsible for your personal data.
How other platforms handle this
We may share your personal data with a third party for purposes other than processing on our behalf. We will obtain your consent to such disclosure as required by applicable laws.
If you authorize your third-party measurement partner(s) to send you TikTok European Data or TikTok Brazilian Data...you agree to the Controller to Controller Data Terms.
Google Cloud Platform ... Finland Japan Netherlands Norway United Kingdom United States Cloud infrastructure
"Once your data is shared to Oura Enterprise Platform, the Data Recipient becomes the controller of your personal data. The Data Recipient is responsible for its use and processing of your personal data...Excerpt from Oura's Privacy Policy
ConductAtlas detected a major restructuring of Meta’s privacy policy that removed detailed consumer rights disclosures and relocated them to separate documents.
Your genetic data may be transferred to a new owner as a business asset. Here is what the Terms of Service actually say and what you can do right now.
Get the weekly coverage letter
Companies change their terms without announcing it. We capture governance documents, compare each new version with the last, and publish what changed, with the source text behind it. One email a week on what we found and what we could not reach.
Control over and legal responsibility for personal data shifts from Oura to the Data Recipient at the moment of sharing, which affects which entity the user must look to for data rights and protections.
After your data is shared to the Oura Enterprise Platform, the Data Recipient — not Oura — controls and is responsible for your personal data.
ConductAtlas has identified this type of provision across 281 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Oura.