Oura

Is Oura safe?

Yes, for most people it is one of the better choices for wearable health data. The Oura app holds sleep stages, heart rate, temperature trends, cycle and pregnancy insights and, if you import them, medical records. Oura makes its money from the ring and a monthly membership, not from ads, and both store listings back that up: Apple's label lists nothing used to track you, and on Google Play Oura says it shares no data with other companies.

We score Oura 76/100, ahead of Garmin Connect at 70 and Fitbit at 66, and well ahead of WHOOP. The main gaps are a disclosure program that pays researchers nothing and an email-code login that is only as strong as your inbox.

What is the Oura and Palantir controversy?

In 2025 Oura announced a factory in Texas and described the US Department of Defense as its largest enterprise customer. Posts on Reddit and TikTok then claimed the military, and the data company Palantir, could see users' sleep and health data.

Oura's answer, on its blog on 29 August 2025 and in a video by chief executive Tom Hale, was that its government work runs on a separate, government-only enterprise platform. Your data reaches the Defense Department only if you are a service member enrolled in a health or performance program that uses Oura Ring and you agreed to share it. Oura said it will never sell or rent data, "including to the government". According to PEDESTRIAN.TV, Palantir provides a security layer for that enterprise platform only.

Oura's IPO filing of September 2026 confirms the DoD relationship and the security rules that come with it, such as NIST SP 800-171 controls for federal data. It gives no sign that consumer data flows to the government. The separation rests on Oura's word and its policy, not on an independent audit, but nothing we found contradicts it. If you do join a workplace or military programme, the organisation becomes responsible for the data it receives.

What data does Oura collect and use?

Apple's label is short for a health app: fitness data, precise location, email address and user ID linked to you for app functions, crash data for analytics, and product interaction not linked to you. Google Play adds that your email is used for marketing and that health data is collected for app functions and personalisation.

The June 2026 privacy policy is broader. Oura processes sensor data, notes and tags, AI chats and imported health records. It may use personal data to build and improve its own AI features, including Oura Advisor, though it says it does not sell data to train outside AI models. Its website uses cookies to build audiences for online ads, but the policy says sensitive data is never used for targeted ads. Health records you import from a US provider are no longer covered by HIPAA once Oura holds them.

On government requests, the policy says Oura reviews each one, will push back on requests it sees as too broad, and will tell affected members where it can. It says it is considering a transparency report but has not published one.

How secure is an Oura account?

Oura's trust center lists yearly SOC 2 audits, a HITRUST certification, penetration tests and red-team exercises. Data is encrypted between ring and phone with AES-128, in transit with TLS 1.2 or higher and at rest with AES-256. The IPO filing says no cyber incident has had a material impact so far, and we found no reported breach.

Login is passwordless: you get a one-time code by email instead of a password. That rules out password reuse, but it means anyone who controls your email can sign in, and there is no authenticator app or passkeyPasskeyA way to sign in without a password. Your device holds a key tied to one website or app and unlocks it with your fingerprint, face or PIN.More in the glossary option. Oura's "bug bounty" link leads to a vulnerability disclosure program on Intigriti whose reward table lists $0 for every severity, and its 2025 blog said it had no formal bug bounty.

How to use Oura safely

1. Secure the email address you use for Oura with a strong password and two-factor authenticationTwo-factor authenticationSigning in with a second proof of identity on top of your password, such as a code from an app, a security key or a passkey.More in the glossary, since it is the key to your account.
2. Turn on App Lock so the app asks for Face ID or Touch ID.
3. Accept enterprise or employer sharing invitations only if you know who receives the data and why.
4. Check which partner apps can read your data, and disconnect the ones you no longer use.
5. Use the in-app tool to delete data you no longer want, such as a pregnancy period, without closing the account.

How we scored it

The regulatory record (87) is Oura's strongest factor: it is clean, and a proposed class action in California counts only as context because it is an allegation. Transparency and control (78) comes next, with deletion by time period and opt-in sharing, and privacy (75) gains from a membership model with no ad tracking. Security (72) is the weakest factor, though still good, held back by email-only login and an unpaid disclosure program.