Oura Health Privacy Policy

Oura · Official agreement

124 cards.

ŌURA Health Privacy Policy

June 15, 2026

Oura's commitment to privacy

At ŌURA, protecting your personal data is a task we take seriously. Our products are designed to help you to track important aspects of your health like your daily habits, reproductive health, and the quality of your sleep – we understand that data does not get much more personal than this. That's why we firmly believe that you should be in charge when it comes to your personal data.

This Privacy Policy (“Policy”) is designed to provide you with the information you need to take control of your personal data, which is a fundamental aspect of empowering your health journey. Please take a moment to carefully review this Policy.

About this privacy policy

This Policy applies to processing of personal data by Oura Inc, Oura Health Oy, Ouraring Inc., and subsidiaries (collectively, "Oura") when you visit our web properties (“Sites”); use the Oura Ring with the Oura App, Membership Hub or use other Oura services (“Services”).

Why does Oura process your personal data?

The sections below explain the categories of personal data we collect and process, as well as the reasons we do so. You will also find information on our legal basis for processing your data, and our data sources.

Device & application users

Processing Purposes

When you use Oura Services, we collect and process your personal data for the following purposes:

  • To Provide Oura Services We process personal data when you use our Services, such as to provide you with personalized insights about your readiness, sleep, activity, and other inferences about your health status. Some features in our Services use artificial intelligence and machine learning (“AI”). For example, Oura Advisor is an AI assistant that, when you engage with the feature, provides personalized wellness guidance based on information you submit to Oura or direct our Services to collect. We also use AI and algorithmic analysis to provide you with suggestions to follow up with partner services. You get to decide whether you want to engage with or share any personal data with partner services when we do this.
  • To Provide Customer Service We process personal data to provide customer service and manage our customer communication. For example, if you contact our AI assistant with questions regarding your account, we may use the provided information to answer your questions, and for solving any issues you may have.
  • To Protect Your Privacy We may process personal data regarding your use of the Services to protect your privacy. This may involve the use of privacy enhancing technologies and other privacy-protective techniques. When information is aggregated or anonymized, it is no longer personal data.
  • To Improve Our Services We process personal data regarding your use of our Services to understand how you use our Services and how we can improve them. For example, we may process personal data to improve your user experience with our Services, including within the Oura App. We may also use personal data to develop or refine AI-powered features that provide you with new insights about your health. Where appropriate, we use privacy-protective measures, like pseudonymization, aggregation, or de-identification.
  • To Perform Analysis We may process personal data about human performance and wellbeing to benefit our users and improve the cutting-edge insights we provide with our Services. Some features of our Services may use third-party automated technology to provide a more personalized experience, and to give you comprehensive insights about your data. For example, our Services include intelligent features that may use the responses you provide to better personalize the Services. When feasible, we do this using data that has been processed in a manner to protect your privacy.
  • To Market Services We process personal data to provide marketing communications for Oura Services and partner opportunities. For example, as explained more fully in our Cookie Policy, we use cookies and similar technologies on our website to create audiences for online advertisement. We do not sell or share your personal data for cross-context behavioral advertising. You can opt out of direct marketing communications from Oura by unsubscribing within emails. You may see personalized opportunities surfaced within our Services to connect with partners who can support your health journey.
  • To Enable Third-party Integrations and Third-party Services We process personal data you provide to Oura to enable third party integrations, services, features, and offerings. For example, with your permission, our Services may integrate with third parties, including GoogleGoogle Health Connect and AppleApple HealthKit, LLM providers, or other partner experiences. Oura takes measures to help ensure third-party services protect your personal data, which means that Oura only processes your data with respect to third-party integrations when you choose to integrate them with our Services, or when you provide the necessary consents. We process the data we receive from these third-parties according to applicable terms, such as the Google Health Connect Permissions policy and Google Limited Use requirements, as well as relevant third-party developer license agreements, as we become aware of those policies and agreements. If you direct Oura to transfer your data to a third party, that third party’s own privacy practices and terms will govern what it does with your personal data. Please review the third party’s privacy policy before you authorize a connection. You can disconnect a third party integration at any time. Disconnecting prevents future access. Because we cannot recall data that a third party has already received, you should also exercise any deletion or withdrawal rights directly with the third party.
  • To Comply with Legal Obligations In certain cases, we must process certain data when it is required by applicable laws and regulations. Such legal obligations are related, for example, to accounting and tax requirements, legal claims, or other legal purposes.

Legal basis for processing

Data protection law in Europe requires a "lawful basis" for collecting and retaining personal information from residents of the European Economic Area and the U.K. Our lawful bases for processing your data depend on the particular processing purposes, including:

When processing personal data for the purpose of providing our Services, we process personal data on the basis of a user contract, which is formed when you create your account and accept this Policy and Terms of Use.

We process your sensitive personal data only with your consent. In some cases, you can provide your consent to us for processing your data through your actions, such as by adding sensitive personal data into your notes, or by adding health related tags in the Oura App.

We process your personal data based on our legitimate interests when we process it for the purposes of marketing our Services and Sites, providing our customer service, and improving our Services. When choosing to use your personal data on the basis of our legitimate interests, we carefully weigh our own interests against your right to privacy, in compliance with applicable law.

Oura must process certain information to comply with legal obligations which may vary in each country. For example, such obligations can relate to consumer protection or tax laws.

Processed data and data source

In most cases, Oura collects personal data directly from you, such as when you register for an account, tag your data in the Oura mobile or web app, or use your Oura Ring. We may also process personal data that is produced from the information you provide to us, and we may receive personal data about you from third parties, such as partners. Oura may also rely on trusted third-party processors to process data on our behalf, such as our cloud service providers.

Oura processes the following personal data categories when you use our Services:

Please note that some of the personal data we process, including any data concerning your health, is considered special or sensitive personal data. Under applicable law, such data is processed only if you have given your consent for processing. If you access or use any of Oura's location-based services, such as by enabling GPS-based activity tracking through our Services, Oura may process the approximate or precise location of your device while the service is active. This data may be obtained via your device's service provider network ID, GPS, and/or Wi-Fi data. Oura does not process such location data without first obtaining your consent. You may disable such location processing at any time using your device's location permission settings. If you choose to disable access to location data, please note that certain Services, features, or functionalities may no longer be accessible.

If you give your opt-in consent through our Services, you may share limited personal information like your current and past sleep and readiness scores with other Oura Members. The information you choose to share may be shared with other members in the circle(s) you join, and with any additional members who are added to those circles. You can make changes to what data you share with other members, including opting out of sharing any data.

Depending on your use of our Services, you may also choose to communicate with and react to other members’ information and scores. Please remember to always maintain a respectful and supportive environment when communicating with other members. Please see Oura’s Terms of Use for more information.

ŌURA ENTERPRISE PLATFORM

Oura Enterprise Platform is a service that allows you to share Services data with your doctor, coach, trainer, employer, researchers, and/or any other person or entity (“Data Recipient(s)”) with whom you choose to share your data after receiving an invitation to do so. The invitation you receive will notify you of the scope, type, and time period of your data that is requested to be shared with your consent. If you choose to participate in Oura Enterprise Platform, once you consent to sharing your personal data with the Data Recipient the relevant requested data that you sync to the Services will become available to your Data Recipient in Oura Enterprise Platform. The Oura Enterprise Platform provides Data Recipients with access to their team’s statistics at a glance and allows them to get a detailed look into the data you have chosen to share, such as heart rate, heart rate variability, activity level, and other data that you sync to the Services that fall within the scope that was requested in the invitation you received.

Once your data is shared to Oura Enterprise Platform, the Data Recipient becomes the controller of your personal data. The Data Recipient is responsible for its use and processing of your personal data in accordance with all applicable data protection and privacy laws. Your personal data may be used by the Data Recipient in accordance with its own privacy practices, so please review the Data Recipient’s privacy policy before accepting the invite and opting in to Oura Enterprise Platform. Oura is not responsible for the Data Recipient’s processing of your data or the security of any personal data that the Data Recipient has extracted from Oura Enterprise Platform.

Once you give consent to share your Oura data with the Data Recipient, the Data Recipient may get access to the following personal data, such as:

Account data as inserted by you:

Automatically collected and generated data:

Usage-related and technical data:

If you have questions or requests concerning your personal data after it has been transferred to Oura Enterprise Platform, such as how the Data Recipient uses your data, where it is transferred to, who can access it, retention policies, or your rights in relation to that data, please contact the Data Recipient that invited you to participate in Oura Enterprise Platform. Please see the privacy policy of the Data Recipient for contact details.

Your personal data is disclosed to the Data Recipient only if you give consent. You can withdraw your data sharing consent at any time via Membership Hub (https://cloud.ouraring.com/profile) or from the settings menu on the Services. You can stop the flow of data to the Data Recipient so that the Data Recipient cannot receive new data from you or through Oura Enterprise Platform. You can also choose to delete your data on Oura Enterprise Platform that was already shared with the Data Recipient. However, please note that withdrawing your consent from the service or changing any other consent settings do not affect the processing of data that the Data Recipient already extracted from Oura Enterprise Platform.

Oura uses aggregated Oura Enterprise Platform data for analytics, statistics, research and development purposes. Oura is the controller of such aggregated data, which may no longer qualify as personal data due to aggregation. For other data that Oura processes which are not at the direction of the Data Recipient, the rest of the terms in this Policy apply.

HEALTH RECORDS YOU IMPORT

Oura lets you bring your own health records into the Oura Services. When you choose to connect a healthcare provider, a health plan, or another source of your health information to Oura, you are directing that organization to share your electronic health records with Oura. You are in control of this connection: you choose which source of records to connect, what to import, and when to disconnect. Depending on the source you connect, records may include visit summaries, clinical notes, diagnoses, medications, allergies, immunizations, lab results, vital signs, and care plans. You can disconnect any source at any time from the settings menus available on our Services. Disconnecting stops new records from flowing to Oura. You can access, delete, or download your imported records as described in sections of this Policy covering data subject rights.

Imported health records differ from data we collect from Oura Ring. Data collected by your Oura Ring is generated by sensors you wear. Imported health records instead come from a third party source that you direct to share records with us. Once those records reach Oura, we act as the controller of that data, and this Policy governs our processing. When you authorize or direct an entity regulated by the Health Insurance and Portability and Accountability Act (“HIPAA”) to disclose your health records to Oura, the disclosure is at your request, not the entity’s. Oura is not a Business Associate of that entity for purposes of this sharing.

ŌURA RESEARCH APP

The Oura Research App is a separate application that enables individuals to participate in research studies conducted by or on behalf of Oura or an independent research sponsor (“Research Sponsor”). Participation in any research study is voluntary.

Before enrolling in a study, you will be required to review and sign an informed consent form (“ICF”) provided by the Research Sponsor. The ICF describes the purpose of the study, the categories of data that will be collected (including sensor and derived data, where applicable), how that data will be used and disclosed, the legal basis for processing (where applicable), the duration of the study, and your rights in relation to research data collected as part of the study.

If you enroll in a research study, the Research Sponsor acts as the controller (or equivalent legal role under applicable data protection laws) of research data collected for the study. Oura may act as a processor or service provider to the Research Sponsor in connection with the hosting, storage, or technical administration of the Oura Research App, unless otherwise described in the applicable ICF. Questions regarding the study protocol, use of research data, or the exercise of data protection rights relating to research data should be directed to the Research Sponsor as identified in the ICF.

Research studies may involve data blinding or other protocol-based restrictions. During a blinded period, you may not be able to access certain personal data, scores, or insights in the Oura Research App, even though your Oura Ring continues to collect sensor data. These limitations are implemented in accordance with the applicable study protocol and at the direction of the Research Sponsor. The ICF will describe whether and when access to such data will be restored, and any conditions that apply.

To the extent there is a conflict between this Privacy Policy and the ICF with respect to research data collected in connection with a study, the terms of the ICF and study protocol will govern that research data processing. This Privacy Policy continues to apply to personal data processed outside the scope of a specific research study.

ONLINE CUSTOMERS & SITE VISITORS

Processing purposes

If you visit Oura's Sites or complete orders on Oura's online store, we process personal data for the following purposes:

  • To Provide Oura Services We process personal data to power our offerings, which may include when you visit our Sites. This may include processing your data to enable Site performance. Some features in our Services use AI. For example, you are interacting with an AI-powered customer support chatbot when you interact with our virtual support agent, Finn.
  • To Complete and Deliver Your Orders We process personal data to process, handle, and deliver your purchases, and to facilitate your shopping.
  • To Provide Customer Service We process personal data to provide customer service and manage customer communication. For example, if you contact our virtual assistant with questions regarding our Sites or Services, we may use the provided information to answer your questions, and for solving any issues you may have.
  • To Protect Your Privacy We may process personal data regarding your use of our Services to protect your privacy. This may involve the use of privacy enhancing technologies and other privacy-protective techniques. When information is aggregated or anonymized, it is no longer personal data.
  • To Improve Our Sites We process personal data to analyze and improve our Sites. For example, we may process personal data to analyze Site performance, improve user experience, and optimize the Site’s content and layout. We may also use personal data to improve AI-powered features on our Sites, including our virtual support agent. When feasible, we will do this using data that has been processed to protect your privacy.
  • To Advertise and Market Services We process personal data to provide marketing communications about Oura Services and partner opportunities. As explained more fully in our Cookie Policy, we use cookies on our Site to measure the effectiveness of our marketing, understand how visitors interact with our Sites, and provide contextual advertising. We do not sell or share your personal data for cross-context behavioral advertising. You can always opt out of Oura direct marketing communications, though you may still see marketing messaging within the Oura App. In the event you receive Oura-branded advertising sent to you by one of our third-party partners, please review the third-party’s privacy policy for more information, and contact them with regard to any opt-out requests.
  • To Comply with Legal Obligations In certain cases, we must process certain personal data when it is required by applicable legislation. Such legal obligations are related, for example, to accounting and tax requirements, legal claims, or other legal purposes.

Legal basis for processing

Data protection law in Europe and the U.K. requires a "lawful basis" for collecting and retaining personal information from residents of the European Economic Area. Our lawful bases for processing your data depend on the particular processing purposes, including:

When processing personal data to handle and deliver your purchases, we rely on the legal basis of a user contract, which is created when you place your order.

We process your personal data for electronic direct marketing purposes if you have provided your consent for it.

When we process your personal data for customer service purposes, marketing, and developing our Services, we do it on the basis of our legitimate interest to run, maintain, and develop our business and to create and maintain customer relationships. When choosing to use your personal data on the basis of our legitimate interests, we carefully weigh our own interests against your right to privacy under applicable laws.

Oura must process certain information to comply with legal obligations which may vary in each country. For example, such obligations can relate to consumer protection or accounting legislation.

Processed data and data source

In most cases, Oura collects personal data directly from you, such as when you register for an account, tag your data in the Oura mobile or web app, or use your Oura Ring. We may also process personal data that is produced from the information you provide to us, and we may receive personal data about you from third parties, such as partners. Oura may also rely on trusted third-party processors to process data on our behalf, such as our cloud service providers.

Oura processes the following personal data categories when you use our Services:

SMS/TEXT MESSAGING

By providing your phone number, you agree to receiving text messages from Oura (such as shipping notifications or order updates). Message and data rates may apply. Message frequency will vary. You may opt out of receiving text messages at any time by replying STOP to any text message you receive from us. Oura does not share or sell text messaging opt-in consent data with any third party or affiliate for marketing or promotional purposes.

PAYMENTS

This section describes how we process payment information across Oura Sites and Services.

  • Payment information we process. Depending on the transaction, Oura and our payment processors may process your payment card number, expiration date, and security code; billing name and address; transaction amount, date, and merchant.
  • Payment processors and financial partners. Oura uses PCI-DSS-compliant payment processors, card networks, and for contactless payments, issuing banks and token service providers, to process transactions. These partners receive the minimum information needed to facilitate your transaction, and they are bound by their own privacy and security obligations.
  • PCI DSS. Oura maintains a payment environment designed to align with the Payment Card Industry Data Security Standard (PCI DSS). Our payment processors are PCI DSS-validated service providers.

COUNTRY-SPECIFIC ADDENDA

This Policy is a unified, global privacy policy that applies to those who use Oura Services and Sites worldwide. In some jurisdictions, local laws impose additional obligations or grant additional rights that go beyond what this Policy describes. For those jurisdictions, we publish a country-specific addendum that supplements this Policy.

If you reside in a jurisdiction listed below, please read both this Policy and the applicable addendum. Where a specific addendum addresses a topic differently than this Policy, the addendum controls for members and users in that jurisdiction. In all other respects, this Policy continues to apply.

If you reside in a U.S. state with enhanced privacy requirements, please read the section titled “U.S. States With Enhanced Privacy Requirements.”

U.S. STATES WITH ENHANCED PRIVACY REQUIREMENTS

NOTICE FOR ALL U.S. CONSUMERS

This notice supplements the information contained in Oura's Privacy Policy and applies solely to all visitors, users, and others who reside in states within the U.S. with enhanced privacy notice requirements, such as California ("customers" or "you"), and who access Oura's Sites or Services.

Oura is generally not a Covered Entity under HIPAA for our direct-to-consumer Services. Please be aware that in some instances where Oura is acting as a Business Associate under HIPAA, the U.S. state privacy rights outlined in this section may not apply. In those instances, subject to our HIPAA policies, the Covered Entity’s privacy practices, and our Business Associate obligations, Oura may choose to offer self-serve tools that enable you to access and delete your personal data from our Services.

When you direct a HIPAA Covered Entity or Business Associate to share your health records with Oura through a patient-directed disclosure or HIPAA Authorization, the records we receive no longer fall under HIPAA while they are in Oura’s possession, and the rights described in this section apply.

Collection, use, and sharing of information

When a customer interacts with Oura’s Sites or Services, Oura collects information that identifies, relates to, describes, references, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer, device, or household (“personal information” or “personal data”, and where applicable, “consumer health data”).

Information about the categories of personal information we collect, the purposes for which your personal information is processed, and any sharing of your personal information can be found from relevant sections of this Policy:

Sensitive personal information and consumer health data. Some of the personal information we process is classified as “sensitive personal information,” “sensitive data,” or “consumer health data” under applicable U.S. state law. This includes data about your health and measurements collected by Oura Services, health records you import to our Services, reproductive and sexual health information, diagnoses, or other legally or socially sensitive data. We process this information for the purposes described in this Policy, and not to infer characteristics about you outside those purposes. We do not use sensitive personal information for targeted advertising and we do not sell or share personal information for cross-context behavioral advertising.

No sale or targeted advertising. In the preceding twelve (12) months, Oura has not sold personal information to third parties, including data aggregators, as it is against our policies. We have collected and disclosed only the categories of personal information processed by Oura under this Policy as described in the Data Sharing and Transfers section.

Large Language Model Training. We may collect and use personal data to develop, test, improve, and support Oura’s own AI, machine learning, and large language model-powered features. We do not sell personal data for the purpose of training third party Large Language Models (“LLMs”).

Automated decision-making and profiling. Some features of our Services rely on AI-based analysis of your data. Our features are designed to provide general wellness information and not to make legal or similarly significant decisions about you.

CONSUMER RIGHTS

If you are a resident of a state with enhanced rights related to the personal information Oura may process about you, you have certain rights:

U.S. State laws may give you the right to request that we disclose the personal information we have collected about you over the past 12 months, which we only provide after we receive and validate your request. Once we receive and confirm your verifiable request, we will disclose to you:

You have the right to request correction of your personal information. After we receive and validate your request, we will correct your personal information, unless an exception applies. Please note that you can correct and update some of your basic information via the Oura App and via Membership Hub.

You have the right to request erasure of your personal information, subject to certain exceptions, such as when we have a legal obligation to retain the data in question. After we receive and validate your request, we will delete your personal information, as well as direct our service providers to delete your personal information unless an exception applies.

If you reside in a state that provides for enhanced privacy rights, you can request disclosure, access to, correction, and/or deletion of your personal data as described above by submitting a verifiable consumer request to us by:

Sending an e-mail to dataprotection@ouraring.com including the following information along with your request: your full name, company name (if applicable), address, e-mail address, and a phone number. We may request that you provide additional information if necessary to confirm your identity. This is for security purposes, and is required by law in some cases.

Only you, or your designated authorized agent as applicable, may make a verifiable consumer request related to your personal information. You may also make a verifiable consumer request on behalf of your minor child.

You have the right to make a free request up to two times in any 12-month period. We will respond to all validated requests within 45 days of receiving your request, unless we request an extension. In the event that we reasonably require an extension in order to respond to your request, we will notify you of any such extension within the initial 45-day period.

If we decide not to take action in response to your request, you may submit an appeal by sending an email to dataprotection@ouraring.com and mark your request as an “Appeal.” We will resolve your appeal within the time frames established by applicable law. If your appeal is denied, we will explain why. If you continue to dispute our decision or would like to file a complaint regarding our handling of your personal information, you may contact the regulator in your jurisdiction that handles privacy complaints, such as your state Attorney General.

Oura does not discriminate against users who request to exercise their privacy rights. Unless an exception applies, this includes our promise not to:

RESIDENTS OF WASHINGTON STATE – CONSUMER HEALTH DATA PRIVACY NOTICE

This notice supplements the information contained in this Policy and applies solely to visitors, users, and others who reside in the state of Washington, with respect to your Consumer Health Data as defined under the Washington My Health My Data Act (“MHMD”).

Oura collects, uses, processes, and shares Consumer Health Data as described above in this Policy.

If you are a Washington consumer, you have certain rights with respect to your Consumer Health Data. These rights include:

You may exercise any of the rights described above by submitting a request to us by emailing dataprotection@ouraring.com. Your request should include sufficient information for us to verify your identity and should specify the right you wish to exercise. We may request additional information if necessary, such as to confirm your identity as required for security purposes.

Data sharing and transfers

Personal data sharing

Oura does not sell or rent your personal information, and only shares your personal data with certain trusted service providers and partners so that we can provide and improve our services, to provide partner services and other offerings, and to operate our business. Whenever we share data with third-party service providers, we require that they use your information only for the purposes we've authorized, and for the limited reasons explained in this Policy. We also require these service providers to protect your personal information to at least the same standards that we do.

Like most companies, Oura uses service providers for purposes such as:

We use industry standard data protection measures to safeguard all international transfers of personal data through data protection agreements with our service providers. In certain limited cases, you may be asked for consent to share your Oura user personal data with a third-party partner of your choice, such as a medical provider or health care insurer that you select. If you choose to do this, you should carefully review the third-party consent language and privacy notices that are available to you from the third-party, which will control the use of your personal data.

LEGAL FRAMEWORKS FOR INTERNATIONAL TRANSFERS

Oura is a global company with servers around the world, and your personal data may at times be processed on servers located outside of the country where you live. Although data protection laws vary among countries, regardless of where your personal data is processed, we apply the same protections described in this Policy. We also comply with certain legal frameworks relating to the transfer of personal data, such as the frameworks described below.

Oura participates in the EU-US Data Privacy Framework, the UK Extension to the EU-US Data Privacy Framework, and the Swiss-US Data Privacy Framework (collectively, the “Data Privacy Frameworks”) as set forth by the US Department of Commerce regarding the processing of personal data from the European Economic Area, the United Kingdom and Gibraltar, and Switzerland. Oura has further certified that we adhere to the principles of the Data Privacy Frameworks.

Click https://www.dataprivacyframework.gov/ to learn more about the Data Privacy Frameworks. If there is any conflict between the terms in this Policy and the Data Privacy Frameworks principles, the principles shall govern.

If Oura transfers personal information received under the Data Privacy Frameworks to a third-party, the third-party’s processing of the personal data must also be in compliance with our Data Privacy Frameworks obligations, and we will remain liable under the Data Privacy Frameworks for any failure to do so by the third-party, unless we prove we are not responsible for the event giving rise to the damage.

Oura is subject to the investigatory and enforcement powers of the US Federal Trade Commission. In certain situations, Oura may be required to disclose the personal information we process under the Data Privacy Frameworks in response to lawful requests by public authorities, including to meet national security or law enforcement requirements.

Personal data disclosures

We also reserve the right to disclose personal data under certain specific circumstances, including:

We stand guard over your data, no matter who’s asking. We review each law-enforcement and government request for personal data on a case-by-case basis. We handle those requests in line with applicable law and our commitment to protecting our members’ privacy. We will oppose, seek to narrow, or reject requests that we deem overly broad, insufficiently supported, or otherwise legally deficient, particularly where the requested data is sensitive. We will notify affected members of requests for their data where legally permissible. We believe we must continually earn your trust through transparency and accountability. We are actively evaluating ways to provide greater visibility into how we handle these requests, like through a transparency report.

We believe our members’ right to privacy endures beyond their lifetime. Because we cannot know their wishes, we aim to protect our members’ personal data even when we receive posthumous access requests. However, if you are an heir or legal representative of a loved one who used our Services, we are here to help. You may contact us at dataprotection@ouraring.com to submit a request regarding their data. We will verify your identity, relationship to the deceased, and legal authority before processing your request. We will honor all applicable rights granted to you by the laws of the jurisdiction where the deceased member resided.

Safeguarding your data

Oura uses technical and organizational safeguards to keep your data safe and secure. When appropriate, these safeguards include measures such as anonymization or pseudonymization of personal data, strict access control, and the use of encryption to protect the data we process.

Our personnel receive adequate training to ensure personal data is processed only in accordance with our internal policies, consistent with our obligations under applicable law. We also limit access to your sensitive personal data to personnel that have specifically been granted such access.

Online services that we provide via our Site protect your personal data in-transit using encryption and other security measures. We also regularly test our service, systems, and other assets for possible security vulnerabilities.

We update our Services regularly to protect your personal data. We recommend that you make sure that you always have the latest app and firmware versions installed in order to maximize protection of your data.

Data Retention

The retention period for your personal data generally depends on the duration of your Oura account lifecycle. Your personal data will be deleted when it is no longer needed for the purpose for which it was originally collected, unless we have a legal obligation to retain data for a longer period of time. For example, your measurement data regarding your sleep, readiness, and activity is stored only so long as your Oura account is active.

Oura also has legal obligations to retain certain personal data for a specific period of time, such as for tax purposes. These required retention periods may include, for example, accounting and tax requirements, legal claims, or for any other legal purposes. Please note that obligatory retention periods for personal data vary based on the relevant law.

If you wish, you may request deletion of your Oura account by contacting dataprotection@ouraring.com or you can remove your account data from the Services within the Oura App or Membership Hub by following the instructions available on the Oura Help Center.

Use of cookies

We use cookies and various other technologies to collect and store analytics and other information when customers use our Site, as well as for personalization and advertising purposes. The cookies we use include both first-party and third-party cookies.

Cookies are small text files sent and saved on your device that allows us to identify visitors of our Site, facilitate the use of our Site, and to create aggregate information of our visitors. This helps us to improve our service and better serve our customers, and will not harm your device or files. We use cookies and similar technologies to tailor our Site and the information we provide in accordance with the individual interests of our customers. We also use cookies and similar technologies for integrating our social media accounts on our Site.

Please see our Cookie Policy for more information on Oura's use of cookies, and how you can set your cookie preferences.

Your rights as a data subject

Whenever Oura processes your personal data, you have certain rights that enable you to control how your personal data is being processed. This section provides you with information about each of those rights. If you wish to exercise your rights as a data subject, please contact dataprotection@ouraring.com.

You have the right to know what personal data is processed about you. You may contact us to request access to the personal data we have collected about you, and we will confirm whether we are processing your data, and provide you with information about the personal data we have collected and processed.

Please note that by using the Oura App, you can easily access the sleep, readiness, and activity data that we process about you. You can also access your data via Membership Hub at https://cloud.ouraring.com.

You have the right to request the deletion of your personal data in certain circumstances. We will comply with such requests unless we have a valid legal basis not to do so, or a legal obligation to preserve the data.

You have the right to request correction of any incorrect or incomplete personal data we have stored about you.

Please note that you can correct and update some of your basic information directly within our Services.

You have the right to request receipt of the personal data you have provided to us in a structured and commonly used format. The right to data portability only applies when we process your personal data for certain reasons, such as by contract or by your consent.

Please note that Membership Hub provides you with the ability to export your own data.

You have the right to object to or opt out of the processing of your personal data under certain circumstances. In the event that we do not have legitimate grounds to continue processing such personal data, we will no longer process your personal data after we have received and verified your objection. For example, under certain regulations you may have the right to object to any sale of your personal data profiling based on your personal data, or targeted advertising as those terms are defined under applicable law. However, Oura does not sell your data, profile, or engage in targeted advertising based on your personal data, and you always have the right to opt out of direct marketing at any time.

You have the right to request that we restrict processing some types of personal data under certain circumstances. For example, if you contest the accuracy of your data, you can make a restriction request that we do not process your data until Oura has verified the accuracy of your data.

If we have requested your consent in order to process your personal data, you have the right to withdraw your consent for such processing at any time where this right is provided by local law. It should be noted, however, that withdrawing your consent may lead to issues or restrictions on your ability to fully utilize Oura Services. Please note that you can always unsubscribe from receiving our newsletter and other marketing emails by using the ‘Unsubscribe' link provided in the emails you receive from us.

Oura strives to address your privacy concerns. If you have contacted Oura about your issue and are still unhappy with our response, subject to applicable law, you may contact your local supervisory authority regarding your issue. However, we urge you to first contact us at dataprotection@ouraring.com so that we can more quickly resolve your issue before escalating the issue.

If you have a question or complaint about our handling of your personal information under the Data Privacy Frameworks, please contact us at dataprotection@ouraring.com. If you have complaints related to the Data Privacy Frameworks that Oura cannot resolve directly, we have chosen to cooperate with the relevant EU Data Protection Authority, or a panel established by the European data protection authorities (for EU individuals), the UK Information Commissioner (for UK individuals), and the Swiss Federal Data Protection and Information Commissioner (for Swiss individuals). As further explained in the Data Privacy Frameworks principles, binding arbitration is available to address complaints not resolved by other means.

Please read the section in this Policy titled “U.S. STATES WITH ENHANCED PRIVACY REQUIREMENTS” if you are a resident of a U.S. state that provides enhanced privacy requirements and you would like to know more about your rights under those laws.

Controller contact information

Ouraring Inc. is the data controller of user personal data processed for marketing purposes. The controller of personal data processed for all other processing purposes is Oura Health Oy. Please find our contact details below:

Oura Health Oy Address: Elektroniikkatie 10, 90590 Oulu Finland Data Protection Officer: dataprotection@ouraring.com

Ouraring Inc. Address: 415 Kearny Street, San Francisco, CA 94108, United States Data Protection Officer: dataprotection@ouraring.com

Changes to this privacy notice

We reserve the right to update this Policy from time to time at our sole discretion. We strive to let you know about any material changes by notifying you on our Site or by sending you an email or push notification. If you keep using Oura Sites or Services after a change to this Policy, your continued use means that you accept any such changes.