No malicious code, exploits, probing or unauthorized access
You may not use the Services to introduce or run malicious code such as viruses or worms; exploit or try to exploit security vulnerabilities (for example injection attacks, buffer overflows or session hijacking); probe, scan or test the vulnerability of any Oura system or network or breach security or authentication measures without express authorization; or access or try to access any non-public area of the Services, any Oura account other than your own, or Oura’s or its service providers’ systems, except as the Agreement expressly allows.
Supporting quotations
(iv) use the Services to introduce, execute, or attempt to execute malicious code, including but not limited to viruses, worms, Trojan horses, or any other harmful software; (v) engage in activities that exploit or attempt to exploit the Services through security vulnerabilities, including but not limited to injection attacks (e.g., SQL injection, command injection, script injection), buffer overflows, or session hijacking; (vi) attempt to probe, scan, or test the vulnerability of any ŌURA system or network or to breach security or authentication measures without express authorization;
(viii) access or attempt to access any non-public area of the Services, any ŌURA account other than your own, or any ŌURA computer system, server, network, or the technical delivery systems of ŌURA’s service providers, except as expressly authorized under this Agreement;
Qualifications & exceptions
Probing and testing are allowed only with express authorization
Account access is limited to your own account
Security & Safeguards · Restriction or exception
Automated access limits and no circumventing access controls
You may not use bots, scrapers, crawlers or other automated systems to access the Services in a way that sends more requests to Oura’s servers than a human could reasonably produce in the same period, unless Oura expressly permits it. You also may not circumvent, bypass, disable, degrade or interfere with access controls, usage limits, security features, authentication measures, subscription restrictions, technological protection measures or other technical or contractual restrictions, including by using multiple accounts, credentials, devices, IP addresses or automated tools to avoid or exceed them.
Supporting quotations
(vii) use automated systems or software (including bots, scrapers, or crawlers) to access the Services in a manner that sends more request messages to ŌURA servers than a human can reasonably produce in the same period, unless expressly permitted by ŌURA;
(ix) circumvent, bypass, disable, degrade, or otherwise interfere with any access controls, usage limits, security features, authentication measures, subscription restrictions, technological protection measures, or other technical or contractual restrictions that ŌURA applies to the Services, including by using multiple accounts, Credentials, devices, IP addresses, automated tools, or other methods to avoid or exceed those restrictions.
Qualifications & exceptions
Automated access is restricted by request volume relative to a human, not banned outright
Exception: expressly permitted by Oura
Not stated here
The text does not say whether wearer-authorized third-party apps or data-export tools count as permitted automated access
Security & Safeguards · Restriction or exception
Credentials are personal; report breaches; Oura can disable them
Usernames, passwords and other security information (Credentials) must be kept confidential and not disclosed to anyone. Your account and Credentials are personal to you, and you agree not to give anyone else access to the Services using them. You must notify Oura immediately of unauthorized access to your account or use of your Credentials or any other security breach. Oura may disable any username, password, credentials file or other identifier at any time, whether you chose it or Oura provided it.
Supporting quotations
you must treat such information as confidential, and must not disclose your Credentials to any other person or entity. You acknowledge that your account and Credentials are personal to you, and further agree not to provide any other person with access to the Services or portions of the Services using your username, password, or other security information.
You shall notify ŌURA immediately of any unauthorized access to your account or the unauthorized use of your Credentials or any other breach of security. ŌURA has the right to disable any username, password, credentials file, or other identifier at any time, whether chosen by you or provided by ŌURA.
Qualifications & exceptions
Notification duty is “immediately”
Oura’s disabling right is “at any time”
Not stated here
No reason or notice requirement is stated for Oura disabling a credential in this passage