Reader-supported: we may earn a commission from links on this page. As an Amazon Associate we earn from qualifying purchases.
Quick answer: Oura says it does not sell your data, and its privacy policy backs that up: no data sales, no targeted ads based on your health data, and sharing with apps like Apple Health or Strava only if you switch it on. But “we don’t sell your data” isn’t the same as “nobody else can ever see it.” Your ring data lives on Oura’s cloud servers, it isn’t end-to-end encrypted, US health privacy law (HIPAA) usually doesn’t cover it, and Oura can still use grouped, anonymized data and respond to legal requests. Oura says no consumer data goes to Palantir. Below, we explain what Oura collects, what its promise does and doesn’t cover, and the settings to change in five minutes.
Table of Contents
What Data Does the Oura Ring Collect?
The ring is small, but it collects a lot. Based on Mozilla’s 2026 privacy review and Oura’s privacy policy, your Oura account can hold:
- Body signals from the ring: sleep stages and duration, heart rate and heart rate variability, blood oxygen, skin temperature, breathing rate, activity and movement.
- Cycle data, if you opt in: menstrual cycle tracking and hormonal birth control use.
- Profile details you must give at setup: age, height and biological sex.
- Location, only with your consent: Oura says it processes your phone’s location when you use location-based features such as GPS workout tracking, and only after you allow it.
- Extras you choose to add: in the US, you can import medical records (visit summaries, diagnoses, medications, lab results), and you can chat with Oura Advisor, its AI feature.
All of this is stored on Oura’s cloud servers. Mozilla points out that there is no way to use the ring without that cloud connection, so your most personal health data always sits on servers you don’t control.
Does Oura Sell Your Data?
No, according to Oura’s own documents. Its privacy policy says that “Oura does not sell your data, profile, or engage in targeted advertising based on your personal data,” and that in the past 12 months it “has not sold personal information to third parties, including data aggregators.” The policy also says Oura does not sell personal data to train other companies’ AI models.
Sharing with other apps is opt-in. Mozilla confirmed that all third-party integrations, such as Apple Health and Strava, are off by default, and you have to connect them yourself. Oura’s Trust Center lists yearly SOC 2 audits, a HITRUST certification and outside penetration testing.
That is a better starting point than many apps. Our Fitbit Air review covers how a wearable owned by an advertising company handles the same kind of data.
Choosing between Oura and Whoop? We read Whoop’s policy too: see does Whoop sell your data, including the ad-tracking cookies it admits to and the lawsuit over its app.
What “We Don’t Sell Your Data” Doesn’t Cover
“No selling” is a real promise, but it’s narrower than it sounds. Here’s what still happens, according to Oura’s own policy and help pages:
| What happens | What it means for you |
|---|---|
| Grouped and anonymized data | Oura’s policy says that once data is “aggregated or anonymized, it is no longer personal data.” Oura uses grouped data for things like average Sleep Scores across thousands of members, and the “no selling” promise is about personal data. |
| Legal requests | The policy says Oura “may be required to disclose” personal data “in response to lawful requests by public authorities, including to meet national security or law enforcement requirements.” |
| Oura’s own AI | Oura’s help center says it “may use data to improve our own AI-powered features,” such as Oura Advisor, while not sharing or selling it. |
| Research and work programs | If you join a research study, the study sponsor controls the research data. If you share data with a doctor, coach or employer through Oura’s enterprise platform, they control their copy and their own rules apply. |
| Apps you already connected | Once your data reaches Apple Health, Google Fit or Strava, Oura says it can’t delete it there. You have to remove it in each app. |
| Oura’s website | The policy says Oura’s website (not the ring app) uses cookies to measure marketing and “create audiences for online advertisement.” |
| Encryption | Oura encrypts data in transit (TLS 1.2+) and at rest (AES-256). Mozilla notes this isn’t end-to-end encryption, so you are trusting Oura’s internal access controls. |
Oura, Palantir and the Department of Defense, Explained
In late summer 2025, many Oura users on Reddit and TikTok said they would ditch their rings after hearing that Oura was working with Palantir, the data analytics company. Here is what the public record shows:
| Date | What happened |
|---|---|
| Since 2019 | Oura says it has worked with the US defense sector, deploying “tens of thousands of rings” across the armed services. |
| August 27, 2025 | Oura announced new manufacturing in Fort Worth, Texas, to support the Department of Defense, which it called its largest enterprise customer. The announcement said its enterprise platform would use “Palantir FedStart’s IL5-ready hosting environment,” a secure government cloud. |
| September 2025 | After the backlash, Oura told Cosmopolitan UK that “we will never sell data” and that only US service members enrolled in a DoD program who consent would have their data shared with that program. It said Palantir’s security layer is “entirely separate from Oura’s consumer platform.” |
| June 2026 | An Oura spokesperson told Mozilla that Oura “is not operational on FedStart today, and no Oura data—consumer or commercial—currently interacts with Palantir systems.” |
Our take: we found no evidence that regular members’ data went to Palantir or the government. But these are Oura’s own statements, and we found no independent audit of them. If the company’s defense work bothers you, that’s a fair reason to choose another wearable, even though your data isn’t part of it.
Does HIPAA Protect Your Oura Data?
Usually not. HIPAA, the US health privacy law, covers doctors, hospitals, health plans and the companies working for them. A ring you buy yourself isn’t one of those. The FTC puts it plainly: “a lot of health-related information doesn’t fall within HIPAA.”
- When HIPAA can apply: Oura’s policy says it acts as a HIPAA “business associate” only in some cases, such as when it works on behalf of a healthcare provider.
- What covers you instead: the FTC’s Health Breach Notification Rule applies to health apps and devices outside HIPAA. It makes companies tell you about breaches, but it isn’t a full privacy law.
- State laws: some US states give extra rights over “consumer health data,” and Oura’s policy lists rights to know, access and delete it.
- Outside the US: Oura is a Finnish company, and Mozilla notes it is subject to Europe’s GDPR, which gives stronger rights.
The 5-Minute Oura Privacy Checklist
These steps come from Oura’s help center. Menu names may change slightly between app versions.
- Turn on App Lock. Menu › Settings › Security & Privacy › App Lock. It asks for Face ID, a fingerprint or your passcode before the app opens, and it’s off by default.
- Check your connected apps. Open App Integrations and disconnect anything you don’t use. Data already shared stays with that app until you delete it there.
- Limit location. Location is only needed for GPS workout tracking. You can turn it off in your phone’s settings, though some features will stop working.
- Think before joining studies. Oura Labs, research studies and partner programs each have their own rules. Read the consent form first.
- Download a copy of your data. Mozilla says Oura lets you export your data as CSV files, and you can file a data request to see everything Oura holds, including fields the app doesn’t show.
- Delete what you don’t want kept. Settings › Security & Privacy › Manage data › Delete data removes health data for a date range ending today. It also erases your Oura Advisor chat history, and your ring resets while deletion runs.
- Leaving for good? Settings › Delete account and all data. Canceling your membership alone does not delete your data.
Is the Oura Ring Safe to Use?
From a privacy point of view, Oura is one of the more careful wearable companies on paper: no data sales, opt-in sharing, independent security audits and real delete tools. Mozilla still gave it only 6 out of 10, mainly because the ring can’t work without Oura’s cloud, the data isn’t end-to-end encrypted, and you need a paid membership to get much use from it.
So the honest answer is: it’s reasonably safe if you’re comfortable with a company storing your health data in the cloud and you change the settings above. If you track sensitive things like your cycle, think about what you really need to log. (This guide covers privacy and data security. We haven’t researched questions about the ring’s Bluetooth signal or physical safety here.)
If you’ve weighed the trade-offs and still want one, the current model is the Oura Ring 5, which replaced the Ring 4 in 2026. Pick your finish and size on the product page, and size before you buy, because ring sizes don’t always match regular jewelry sizes. Remember that most features need a paid Oura membership, so check the current price of both the ring and the membership.
Don’t want to pay a monthly membership? We compared rings that charge no fee, and what their privacy policies say, in our guide to the best Oura Ring alternatives without a subscription.
Want to go deeper? Our Wearable Scam Bible looks at the gap between what fitness trackers promise and what the evidence shows, and at what happens to the health data your device collects once it leaves your wrist. See the ebook →
Worried about who else has your details? Data brokers sell names, addresses and phone numbers, and our guide shows how to remove yourself from data brokers.
Frequently Asked Questions
Does Oura sell your data?
Oura says it doesn’t. Its privacy policy states that Oura does not sell your data or use it for targeted advertising, and that it has not sold personal information in the past 12 months. Sharing with apps like Apple Health or Strava only happens if you turn it on.
Does Oura share data with Palantir or the US government?
Oura says no consumer data goes to Palantir. Palantir’s FedStart was a secure hosting option for Oura’s Department of Defense work, and Oura told Mozilla in 2026 that no Oura data currently interacts with Palantir systems. Oura says only service members enrolled in a DoD program who consent have their data shared with that program. These are Oura’s statements; we found no independent audit.
Is the Oura Ring HIPAA compliant?
For most people, HIPAA doesn’t apply. HIPAA covers doctors, health plans and their business partners, not a wearable you buy yourself. Oura’s policy says it acts as a HIPAA business associate only in some cases, such as when it works with a healthcare provider. The FTC’s Health Breach Notification Rule covers health apps outside HIPAA, but it is about breach notices, not full privacy protection.
Can I use the Oura Ring without the cloud or a subscription?
Not really. Mozilla’s review found the ring only works through Oura’s app and cloud, and without a membership you get a very basic set of features. Your data is still uploaded to Oura’s servers either way.
How do I delete my Oura data?
In the Oura App, go to Settings, then Security & Privacy, then Manage data, and tap Delete data to remove health data for a date range. To delete everything, go to Settings and choose Delete account and all data. Canceling your membership alone does not delete your data.
Sources
- Oura: Privacy Policy, checked October 13, 2026
- Oura Member Care: How Oura Protects Your Data (updated October 5, 2026)
- Oura: Trust Center
- Mozilla Foundation: Oura Ring Privacy Review (June 2, 2026)
- Oura: Establishes U.S. Manufacturing to Support Growing U.S. Defense Business (August 27, 2025)
- Cosmopolitan UK: Oura ring sparks major privacy concerns (September 5, 2025)
- FTC: Updated Health Breach Notification Rule (April 26, 2024)
