Oura Health Privacy Policy

Oura · Official agreement

Read the agreement

35 of 124 cards in Legal Rights & Agreement Rules

Legal Rights & Agreement Rules · Context

Policy title and stated date

The document is titled the Oura Health Privacy Policy and shows the date June 15, 2026 under the title. The source does not say whether that date is an effective date, a last-updated date or a publication date.

Supporting quotations

Health Privacy Policy
June 15, 2026

Not stated here

  • The source does not say what the date June 15, 2026 refers to.

Legal Rights & Agreement Rules · Context

Who the Policy covers: Oura companies, Sites and Services

The Policy applies to processing of personal data by Oura Inc, Oura Health Oy, Ouraring Inc. and subsidiaries (together, Oura) when you visit Oura's web properties (the Sites), or use the Oura Ring with the Oura App, Membership Hub or other Oura services (the Services). Those defined words are used throughout the Policy.

Supporting quotations

Oura Inc, Oura Health Oy, Ouraring Inc., and subsidiaries
when you visit our web properties
use the Oura Ring with the Oura App, Membership Hub or use other Oura services

Qualifications & exceptions

  • Later sections add notices for U.S. state residents and country-specific addenda.

Not stated here

  • The source does not list the subsidiaries or what the "other Oura services" are.

Legal Rights & Agreement Rules · Context

Lawful bases for processing: European and U.K. law, depends on purpose

This heading and introduction explain that data protection law in Europe requires a lawful basis for collecting and retaining personal information of residents of the European Economic Area and the U.K. Oura says its lawful bases depend on the particular processing purposes. The list of bases that follows begins with Contract; each basis is explained in the cards that follow.

Supporting quotations

Legal basis for processing
for collecting and retaining personal information from residents of the European Economic Area and the U.K.
Our lawful bases for processing your data depend on the particular processing purposes
Contract

Qualifications & exceptions

  • Stated for residents of the European Economic Area and the U.K.

Not stated here

  • The source does not say how, if at all, this section applies to other residents.

Legal Rights & Agreement Rules · Company practice

Legal basis: user contract for providing the Services

When Oura processes personal data to provide the Services, it says it relies on a user contract, which is formed when you create your account and accept this Policy and the Terms of Use. This is one of the lawful bases listed for residents of the European Economic Area and the U.K.

Supporting quotations

Legal basis for processing
Contract
we process personal data on the basis of a user contract, which is formed when you create your account and accept this Policy
Terms of Use

Qualifications & exceptions

  • Stated within the lawful-basis discussion for residents of the European Economic Area and the U.K.

Not stated here

  • The Terms of Use are linked but their text is not part of this source.

Legal Rights & Agreement Rules · Company practice

Legal basis: legitimate interests for marketing, customer service and improving the Services

Oura says it relies on its legitimate interests when it processes personal data to market its Services and Sites, provide customer service and improve its Services. When it relies on legitimate interests it says it weighs its own interests against your right to privacy, in compliance with applicable law.

Supporting quotations

Legitimate Interest
We process your personal data based on our legitimate interests when we process it for the purposes of marketing our Services and Sites, providing our customer service, and improving our Services
we carefully weigh our own interests against your right to privacy, in compliance with applicable law

Legal Rights & Agreement Rules · Company practice

Imported health records: Oura is controller and the Policy governs; disclosure is at your request

The Policy says imported health records come from a third-party source you direct to share them, unlike ring data generated by sensors you wear. Once those records reach Oura, Oura acts as controller of that data and this Policy governs its processing. When you authorize or direct an entity regulated by HIPAA to disclose your records to Oura, the disclosure is at your request rather than the entity's, and Oura is not a Business Associate of that entity for that sharing.

Supporting quotations

Once those records reach Oura, we act as the controller of that data, and this Policy governs our processing
When you authorize or direct an entity regulated by the Health Insurance and Portability and Accountability Act
the disclosure is at your request, not the entity
Oura is not a Business Associate of that entity for purposes of this sharing

Qualifications & exceptions

  • Applies when you authorize or direct a HIPAA-regulated entity to disclose your records to Oura.

Cross-references

Legal Rights & Agreement Rules · Restriction or exception

Research data: the ICF and study protocol govern if they conflict with the Policy

If the Privacy Policy and the ICF conflict about research data collected for a study, the ICF and study protocol govern that research data processing. The Policy continues to apply to personal data processed outside the scope of a specific research study.

Supporting quotations

To the extent there is a conflict between this Privacy Policy and the ICF with respect to research data collected in connection with a study, the terms of the ICF and study protocol will govern that research data processing
This Privacy Policy continues to apply to personal data processed outside the scope of a specific research study

Qualifications & exceptions

  • The ICF controls only research data collected in connection with a study.

Cross-references

Legal Rights & Agreement Rules · Context

Lawful bases for site visitors: European and U.K. law, depends on purpose

For online customers and site visitors, the Policy says that European and U.K. data protection law requires a lawful basis for collecting and retaining personal information from residents of the European Economic Area, and that Oura's lawful bases depend on the particular processing purposes.

Supporting quotations

Legal basis for processing
from residents of the European Economic Area
Our lawful bases for processing your data depend on the particular processing purposes

Qualifications & exceptions

  • Stated for residents of the European Economic Area and the U.K.

Legal Rights & Agreement Rules · Company practice

Site legal basis: user contract created when you place an order

When Oura processes personal data to handle and deliver your purchases, it relies on a user contract, which it says is created when you place your order.

Supporting quotations

Contract
When processing personal data to handle and deliver your purchases, we rely on the legal basis of a user contract, which is created when you place your order

Legal Rights & Agreement Rules · Company practice

Site legal basis: legitimate interest for customer service, marketing and developing the Services

Oura says it relies on its legitimate interest to run, maintain and develop its business and to create and maintain customer relationships when it processes personal data for customer service, marketing and developing the Services. It says it weighs its own interests against your right to privacy under applicable laws.

Supporting quotations

Legitimate Interest
When we process your personal data for customer service purposes, marketing, and developing our Services, we do it on the basis of our legitimate interest to run, maintain, and develop our business and to create and maintain customer relationships
we carefully weigh our own interests against your right to privacy under applicable laws

Qualifications & exceptions

  • Marketing appears both here (legitimate interest) and in the consent card for electronic direct marketing; the source does not say how the two bases divide marketing activities.

Legal Rights & Agreement Rules · Restriction or exception

Global policy with country-specific addenda that control where they differ

The Policy is a unified global privacy policy for people who use Oura Services and Sites worldwide. In some jurisdictions local law adds obligations or rights, and Oura publishes a country-specific addendum that supplements the Policy. If you live in a listed jurisdiction you should read both the Policy and the addendum. Where an addendum addresses a topic differently from the Policy, the addendum controls for members and users in that jurisdiction, and in all other respects the Policy applies. The source lists the Republic of Korea (South Korea).

Supporting quotations

COUNTRY-SPECIFIC ADDENDA
This Policy is a unified, global privacy policy that applies to those who use Oura Services and Sites worldwide
we publish a country-specific addendum that supplements this Policy
Where a specific addendum addresses a topic differently than this Policy, the addendum controls for members and users in that jurisdiction
Republic of Korea (South Korea)

Qualifications & exceptions

  • An addendum controls only for members and users in its jurisdiction and only on topics it addresses differently.

Not stated here

  • The Korea addendum is not part of this source, so its terms are unknown.

Legal Rights & Agreement Rules · Procedure

Residents of U.S. states with enhanced privacy requirements are pointed to a separate section

If you live in a U.S. state with enhanced privacy requirements, the Policy tells you to read the section titled U.S. States With Enhanced Privacy Requirements.

Supporting quotations

If you reside in a U.S. state with enhanced privacy requirements, please read the section titled

Cross-references

Legal Rights & Agreement Rules · Context

Notice for all U.S. consumers: applies to residents of states with enhanced privacy notice requirements

The U.S. notice supplements the Privacy Policy and applies only to visitors, users and others who live in U.S. states with enhanced privacy notice requirements, such as California, and who use Oura's Sites or Services.

Supporting quotations

U.S. STATES WITH ENHANCED PRIVACY REQUIREMENTS
NOTICE FOR ALL U.S. CONSUMERS
This notice supplements the information contained in Oura's Privacy Policy and applies solely to all visitors, users, and others who reside in states within the U.S. with enhanced privacy notice requirements, such as California

Qualifications & exceptions

  • Applies only to residents of U.S. states with enhanced privacy notice requirements.

Legal Rights & Agreement Rules · Company practice

HIPAA: Oura is generally not a Covered Entity for direct-to-consumer Services

Oura says it is generally not a Covered Entity under HIPAA for its direct-to-consumer Services. In some instances where Oura acts as a Business Associate under HIPAA, the U.S. state privacy rights in this section may not apply, and Oura may choose to offer self-serve tools to access and delete your data, subject to its HIPAA policies, the Covered Entity's practices and its Business Associate obligations.

Supporting quotations

Oura is generally not a Covered Entity under HIPAA for our direct-to-consumer Services
in some instances where Oura is acting as a Business Associate under HIPAA, the U.S. state privacy rights outlined in this section may not apply
Oura may choose to offer self-serve tools that enable you to access and delete your personal data from our Services

Qualifications & exceptions

  • Where Oura acts as a Business Associate, the U.S. state rights may not apply and any self-serve tools are at Oura's choice.

Not stated here

  • The source does not say when Oura acts as a Business Associate.

Legal Rights & Agreement Rules · Company practice

Patient-directed records leave HIPAA once with Oura and the U.S. state rights apply

When you direct a HIPAA Covered Entity or Business Associate to share your health records with Oura through a patient-directed disclosure or HIPAA Authorization, the records Oura receives no longer fall under HIPAA while in Oura's possession, and the rights described in this section apply.

Supporting quotations

When you direct a HIPAA Covered Entity or Business Associate to share your health records with Oura through a patient-directed disclosure or HIPAA Authorization
the records we receive no longer fall under HIPAA while they are in Oura

Qualifications & exceptions

  • Applies to records shared through a patient-directed disclosure or HIPAA Authorization.

Cross-references

Legal Rights & Agreement Rules · Procedure

U.S. notice: details on categories, purposes and sharing are in other sections of the Policy

For the categories of personal information collected, the purposes of processing and any sharing, the U.S. notice points to relevant sections of the Policy: device and application user categories and purposes, online store and website visitor categories and purposes, and the sharing of personal data.

Supporting quotations

Information about the categories of personal information we collect, the purposes for which your personal information is processed, and any sharing of your personal information can be found from relevant sections of this Policy
Device and Application User: categories of collected personal information and processing purposes
Online Store and Website Visitor: categories of collected personal information and processing purposes
Sharing of personal data

Legal Rights & Agreement Rules · User right or choice

U.S. state residents with enhanced rights: consumer rights

If you live in a state with enhanced rights over the personal information Oura may process, you have certain rights, set out in the cards that follow.

Supporting quotations

CONSUMER RIGHTS
If you are a resident of a state with enhanced rights related to the personal information Oura may process about you, you have certain rights

Qualifications & exceptions

  • Applies to residents of states with enhanced rights.

Legal Rights & Agreement Rules · Context

Washington residents: Consumer Health Data notice scope

This notice supplements the Policy and applies only to visitors, users and others who live in Washington State, for their Consumer Health Data as defined under the Washington My Health My Data Act (MHMD). Oura says it collects, uses, processes and shares Consumer Health Data as described elsewhere in the Policy.

Supporting quotations

CONSUMER HEALTH DATA PRIVACY NOTICE
applies solely to visitors, users, and others who reside in the state of Washington, with respect to your Consumer Health Data as defined under the Washington My Health My Data Act
Oura collects, uses, processes, and shares Consumer Health Data as described above in this Policy

Qualifications & exceptions

  • Applies only to Washington residents and their Consumer Health Data.

Legal Rights & Agreement Rules · Company commitment

Oura participates in the EU-US, UK Extension and Swiss-US Data Privacy Frameworks

Oura says it participates in the EU-US Data Privacy Framework, the UK Extension to it and the Swiss-US Data Privacy Framework (together the Data Privacy Frameworks) set by the US Department of Commerce, for personal data from the European Economic Area, the United Kingdom and Gibraltar, and Switzerland. It says it has certified that it adheres to the principles of the Data Privacy Frameworks.

Supporting quotations

Oura participates in the EU-US Data Privacy Framework, the UK Extension to the EU-US Data Privacy Framework, and the Swiss-US Data Privacy Framework
regarding the processing of personal data from the European Economic Area, the United Kingdom and Gibraltar, and Switzerland
Oura has further certified that we adhere to the principles of the Data Privacy Frameworks

Legal Rights & Agreement Rules · Restriction or exception

Data Privacy Frameworks principles govern if they conflict with the Policy

The Policy links to the Data Privacy Frameworks website and says that if there is any conflict between its terms and the Data Privacy Frameworks principles, the principles govern.

Supporting quotations

If there is any conflict between the terms in this Policy and the Data Privacy Frameworks principles, the principles shall govern

Cross-references

Legal Rights & Agreement Rules · Company commitment

Onward transfers under the Data Privacy Frameworks: Oura remains liable unless it proves it is not responsible

If Oura transfers personal information received under the Data Privacy Frameworks to a third party, the third party's processing must also comply with Oura's Data Privacy Frameworks obligations. Oura says it remains liable under the Data Privacy Frameworks for the third party's failure to do so, unless it proves it is not responsible for the event giving rise to the damage.

Supporting quotations

If Oura transfers personal information received under the Data Privacy Frameworks to a third-party
we will remain liable under the Data Privacy Frameworks for any failure to do so by the third-party, unless we prove we are not responsible for the event giving rise to the damage

Qualifications & exceptions

  • Applies to personal information received under the Data Privacy Frameworks.

Legal Rights & Agreement Rules · Company practice

Data Privacy Frameworks: FTC enforcement and possible disclosure to public authorities

Oura says it is subject to the investigatory and enforcement powers of the US Federal Trade Commission. It says that in certain situations it may be required to disclose personal information it processes under the Data Privacy Frameworks in response to lawful requests by public authorities, including to meet national security or law enforcement requirements.

Supporting quotations

Oura is subject to the investigatory and enforcement powers of the US Federal Trade Commission
Oura may be required to disclose the personal information we process under the Data Privacy Frameworks in response to lawful requests by public authorities, including to meet national security or law enforcement requirements

Qualifications & exceptions

  • The disclosure is stated as something Oura "may be required" to do in certain situations.

Legal Rights & Agreement Rules · Company commitment

Government requests: reviewed case by case; Oura may oppose and will notify where legally permissible

Oura says it reviews each law-enforcement and government request for personal data case by case and handles them in line with applicable law. It says it will oppose, seek to narrow or reject requests it considers overly broad, insufficiently supported or legally deficient, particularly where the data is sensitive. It will notify affected members where legally permissible. It says it is evaluating ways to give more visibility into these requests, such as a transparency report.

Supporting quotations

We review each law-enforcement and government request for personal data on a case-by-case basis
We will oppose, seek to narrow, or reject requests that we deem overly broad, insufficiently supported, or otherwise legally deficient, particularly where the requested data is sensitive
We will notify affected members of requests for their data where legally permissible
We are actively evaluating ways to provide greater visibility into how we handle these requests, like through a transparency report

Qualifications & exceptions

  • Notice to members is promised only "where legally permissible".
  • Opposing or narrowing requests depends on Oura's own view that a request is deficient.

Not stated here

  • The source does not say that a transparency report exists.

Legal Rights & Agreement Rules · User right or choice

Complaints: contact Oura first; you may then contact your local supervisory authority

Oura says it strives to address privacy concerns. If you contacted Oura and are still unhappy with its response, subject to applicable law you may contact your local supervisory authority, although Oura urges you to contact dataprotection@ouraring.com first so it can resolve the issue sooner.

Supporting quotations

If you have contacted Oura about your issue and are still unhappy with our response, subject to applicable law, you may contact your local supervisory authority regarding your issue
we urge you to first contact us at dataprotection@ouraring.com so that we can more quickly resolve your issue before escalating the issue

Legal Rights & Agreement Rules · User right or choice

Data Privacy Frameworks complaints: contact Oura, then EU, UK or Swiss authorities; binding arbitration available

For questions or complaints about its handling of personal information under the Data Privacy Frameworks, contact dataprotection@ouraring.com. For complaints it cannot resolve directly, Oura says it has chosen to cooperate with the relevant EU Data Protection Authority or panel (for EU individuals), the UK Information Commissioner (for UK individuals) and the Swiss Federal Data Protection and Information Commissioner (for Swiss individuals). It says that, as explained in the principles, binding arbitration is available for complaints not resolved by other means.

Supporting quotations

If you have a question or complaint about our handling of your personal information under the Data Privacy Frameworks, please contact us at dataprotection@ouraring.com
we have chosen to cooperate with the relevant EU Data Protection Authority, or a panel established by the European data protection authorities (for EU individuals), the UK Information Commissioner (for UK individuals), and the Swiss Federal Data Protection and Information Commissioner (for Swiss individuals)
binding arbitration is available to address complaints not resolved by other means

Qualifications & exceptions

  • Applies to complaints under the Data Privacy Frameworks, for EU, UK and Swiss individuals.

Not stated here

  • The Data Privacy Frameworks principles are referred to but their text is not part of this source.

Legal Rights & Agreement Rules · Procedure

U.S. residents: read the U.S. states section to learn about rights under state laws

If you live in a U.S. state with enhanced privacy requirements and want to know more about your rights under those laws, the Policy tells you to read the section titled U.S. States With Enhanced Privacy Requirements.

Supporting quotations

Please read the section in this Policy titled
if you are a resident of a U.S. state that provides enhanced privacy requirements and you would like to know more about your rights under those laws

Cross-references

Legal Rights & Agreement Rules · Context

Who controls your data: Ouraring Inc. for marketing, Oura Health Oy for everything else

Oura says Ouraring Inc. is the data controller of user personal data processed for marketing purposes, and Oura Health Oy is the controller for all other processing purposes. It gives contact details for Oura Health Oy in Oulu, Finland and Ouraring Inc. in San Francisco, California, with the Data Protection Officer contact dataprotection@ouraring.com for each.

Supporting quotations

Controller contact information
Ouraring Inc. is the data controller of user personal data processed for marketing purposes. The controller of personal data processed for all other processing purposes is Oura Health Oy
Oura Health Oy Address: Elektroniikkatie 10, 90590 Oulu Finland
Ouraring Inc. Address: 415 Kearny Street, San Francisco, CA 94108, United States

Qualifications & exceptions

  • Controller roles are stated for user personal data; other roles, such as Data Recipients and Research Sponsors, are described elsewhere.

Legal Rights & Agreement Rules · Restriction or exception

Changes to the Policy: Oura may update it at its sole discretion; continued use means acceptance

Oura reserves the right to update the Policy from time to time at its sole discretion. It says it strives to tell you about material changes by notifying you on its Site or by email or push notification. If you keep using Oura Sites or Services after a change, Oura says your continued use means you accept the change.

Supporting quotations

Changes to this privacy notice
We reserve the right to update this Policy from time to time at our sole discretion
We strive to let you know about any material changes by notifying you on our Site or by sending you an email or push notification
If you keep using Oura Sites or Services after a change to this Policy, your continued use means that you accept any such changes

Qualifications & exceptions

  • Notice of material changes is something Oura "strives" to give, not a stated guarantee.
  • Acceptance is stated to follow from continued use.

Not stated here

  • The source states no advance notice period and no way to reject a change other than stopping use.