Provision record
Oura · Oura Privacy Policy · View original document ↗

HIPAA-directed records fall under state privacy rights once at Oura

High severity Explicitdocumentlanguage Common · 295 of 352 platforms
Get alerted the next time Oura changes these terms. Follow Oura →
Share 𝕏 Share in Share 🔒 PDF
Monitor governance changes for Oura Monitor emails you the same day this changes. The archive stays free.
Follow Oura →

Get the weekly research letter

Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.

This analysis describes what Oura's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology

Recent Activity

This document changed recently

Medium Jun 16, 2026

The updated policy explicitly discloses that Oura uses artificial intelligence and machine learning in the service, including an AI assistant called Oura Advisor that provides personalized wellness guidance based on information you submit or that Oura collects. The revised terms state that Oura may use AI and algorithmic analysis to suggest partner services and may use personal data to develop or refine AI-powered health features. The policy establishes that you retain choice about whether to engage with these AI features or share personal data with partner services when suggestions are offered.

View change record →

How other platforms handle this

Skillshare Medium

You may make a verifiable consumer request related to your personal information twice per 12-month period.

Discord Medium

When you exercise any of your applicable legal rights to access, amend, or delete your personal information, we may request additional information from you for the purpose of confirming your identity.

GitHub Medium

We share your information with service providers for legitimate business operations, such as data storage and hosting.

See all platforms with this clause type →

Monitoring

Oura has changed this document before.

Receive same-day alerts, structured change summaries, and monitoring for up to 20 platforms.

Follow Oura → Or create a free account →
▸ View Original Clause Language DOCUMENT RECORD
"
When you direct a HIPAA Covered Entity or Business Associate to share your health records with Oura through a patient-directed disclosure or HIPAA Authorization, the records we receive no longer fall under HIPAA while they are in Oura's possession...

Excerpt from Oura's Privacy Policy

Applicable regulations

BIPA
Illinois, USA
CCPA/CPRA
California, USA
Connecticut Data Privacy Act Amendments
US-CT
FTC Act Section 5
United States Federal
GDPR
European Union
HIPAA
United States Federal
Indiana Consumer Data Protection Act
US-IN
Kentucky Consumer Data Protection Act
US-KY
Universal Opt-Out Mechanism Expansion 2026
US

Provision details

Document information
Document
Oura Privacy Policy
Entity
Oura
Document last updated
May 5, 2026
Tracking information
First tracked
May 21, 2026
Last verified
May 21, 2026
Record ID
CA-P-058607
Document ID
CA-D-00738
Evidence Provenance
Source URL
Wayback Machine
Content hash (SHA-256)
514ec3016898763de73b01fe706554ea621767348f074f34d2927787939080da
Analysis generated
May 21, 2026 00:26 UTC
Methodology
Evidence
✓ Snapshot stored   ✓ Hash verified
Citation Record
Entity: Oura
Document: Oura Privacy Policy
Record ID: CA-P-058607
Captured: 2026-05-21 00:26:39 UTC
SHA-256: 514ec3016898763d…
URL: https://conductatlas.com/platform/oura/oura-privacy-policy/provision/CA-P-058607/hipaa-directed-records-fall-under-state-privacy-rights-once-at-oura/
Accessed: July 25, 2026
Permanent archival reference. Stable identifier suitable for legal filings, compliance documentation, and research citation.
Classification
Severity
High
Categories

Other risks in this policy

Related Analysis

Governance intelligence across arbitration, AI governance, data rights, indemnification, and retention

Provision-level monitoring, governance timelines, and regulatory mapping built from archived source documents and historical version tracking.

Frequently Asked Questions

What does Oura's HIPAA-directed records fall under state privacy rights once at Oura clause do?

The clause states: “When you direct a HIPAA Covered Entity or Business Associate to share your health records with Oura through a patient-directed disclosure or HIPAA Authorization, the records we receive no longer fall under HIPAA while they are in Oura's possession...”

How many platforms have this type of clause?

ConductAtlas has identified this type of provision across 295 platforms. See the full comparison.

Is ConductAtlas affiliated with Oura?

No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Oura.