A wearable feels like a gadget: it counts your steps, buzzes when you get a text and tells you how you slept. It is also a sensor strapped to your body, collecting some of the most personal data you generate, around the clock. Heart rate, sleep stages, body temperature, activity, location and sometimes blood oxygen or electrocardiogram readings flow from your wrist to a company’s servers. That data can tell a story about your health, habits and whereabouts that you never intended to publish. This guide explains why wearable data matters, who may see it, what the law covers and how to take control.
1. What wearables collect
| Data | What it can reveal |
|---|---|
| Heart rate and variability | Fitness, stress, illness, medication effects |
| Sleep | Routines, insomnia, shift work, relationship status inferences |
| Activity and steps | Lifestyle, mobility, injuries |
| GPS routes | Home, work, gym and travel patterns |
| Body temperature and cycle data | Illness, ovulation, pregnancy |
| Blood oxygen and ECG | Heart and respiratory conditions |
| Notifications and messages | Contacts and communication habits |
| Payment and ID functions | Purchases and locations |
Individually, many readings seem trivial. Collected continuously, they build a detailed health and behavior profile. Our overview of what happens to your health data online explains how this data flows beyond the device.
2. Why the data is sensitive
- Health inference. Changes in resting heart rate or sleep can hint at illness, stress or pregnancy before you tell anyone.
- Location and routine. Activity maps reveal where you live and when you are away.
- Permanence. Years of data form a long-term record.
- Linking. Wearable data tied to an account is easily linked to your name, email and other profiles.
- Monetization. Some companies use data to personalize ads or share with partners.
3. Who can access it
- The device maker and app provider store the data on their servers.
- Service providers that process data on the company’s behalf.
- Third-party apps that you connect for coaching, nutrition or social features.
- Employers and insurers if you join wellness programs and consent to share.
- Researchers, when you opt in to studies.
- Advertisers and data brokers, depending on the company’s policies and your settings.
- Law enforcement, through legal process.
- Attackers, if a company or an account is breached.
The key point is that the wearable’s maker usually controls the data after it leaves your wrist.
4. What the law covers, and what it does not
Most people assume health data is protected by HIPAA. For wearables, that assumption is often wrong. HIPAA applies to healthcare providers, health plans and their business associates, as explained by the Department of Health and Human Services at hhs.gov. A consumer fitness brand is generally not one of these. Data you choose to share with your doctor may become part of your medical record, but the same data on the company’s servers is governed by its policies and other laws.
Other protections exist.
- The Federal Trade Commission polices deceptive and unfair data practices, and it enforces a rule requiring certain health apps and connected devices to notify people of breaches of unsecured health information. The FTC has brought actions against health-related apps that shared sensitive data without proper consent. See ftc.gov.
- State privacy laws in several states give residents the right to access, delete and opt out of the sale of personal data, and some treat health and biometric data as sensitive. California residents can learn about their rights at cppa.ca.gov.
- Sector rules apply in specific contexts, such as employer wellness programs.
The upshot is that protection is partial. Read the privacy policy and your region’s rights, and do not assume HIPAA-level safeguards.
Curious what’s already out there? Wiperts’ 100% Free Diagnosis shows which data brokers are listing your name, home address and phone number. Check your exposure free — it takes about a minute.
5. Real-world lessons
Several widely reported episodes show how wearable data can surprise people. Public fitness apps and activity heatmaps have revealed the locations of sensitive sites because users made their routes public. Health apps have faced regulatory scrutiny for sharing sensitive data with advertising partners. And the rise of cycle-tracking and pregnancy-related apps has led many users to ask who can access their records. You do not need to follow each case to draw the lesson: public by default is a risky setting, and sensitive data deserves extra care.
6. Step-by-step: lock down your wearable
Step 1: Review the privacy settings in the app
Open the app’s privacy or data-sharing section. Turn off public profiles, activity feeds, leaderboards and any option to share data with advertising or research partners that you do not want.
Step 2: Set privacy zones for location
Many apps let you hide the start and end of routes near your home or work. Set the zone radius large enough to mask your address. Make new activities private by default.
Step 3: Limit connected apps
Review the third-party apps that have access to your data and revoke those you do not use. Each connection is another place the data lives. See how to vet your apps.
Step 4: Secure the account
Use a strong, unique password and turn on two-factor authentication. A compromised account exposes years of history.
Step 5: Control phone permissions
On your phone, restrict the companion app’s access to contacts, location and photos. Set location to While Using unless background tracking is essential. See how to keep your location private and safe.
Step 6: Understand sharing with employers and insurers
If you join a wellness program, ask exactly what data is shared, who sees it and whether it affects premiums or benefits. Share the minimum, and consider whether the incentive is worth it.
Step 7: Delete data you no longer need
Use the app’s tools to delete old history or export and remove it. When you sell, give away or stop using a device, factory reset it and delete the account data.
Step 8: Use your rights
In states with privacy laws, request a copy of your data and ask for deletion. Keep a record of requests.
7. What your wearable has to do with data brokers
Wearable data itself may not be sold as raw heart rate. But the account details, purchase records and app usage tied to your wearable can feed marketing profiles that include inferred health interests. When such profiles are combined with public records, they appear in broker databases. Reducing your broker footprint limits where wearable-linked inferences can land. See removing medical records and health data from the internet and how to opt out of the most popular people-search sites.
8. A ten-minute wearable audit
Set a timer and do this once. Open the companion app and list every permission it holds: location, contacts, calendar, microphone, health records. Turn off anything the device does not need to function. Open the privacy or data-sharing page and switch off sharing for research, advertising and “product improvement” unless you want it. Review connected third-party apps and remove the ones you no longer use. Finally, check whether the account can export or delete your history, and note where that option lives so you can use it when you retire the device.
9. What to do when you sell or give away a device
Wearables carry a surprising amount of history. Before you pass one on, sign out of the account, perform a factory reset, remove the device from your account list and delete the stored history in the cloud. Unpairing from your phone alone usually does not erase the cloud copy. If the company offers a data-download tool, take a copy first if you want to keep your records.
10. Where regulators fit in
Health data from consumer wearables is often outside the federal health privacy rule because the company is not a doctor or insurer. The Department of Health and Human Services explains where that rule applies at hhs.gov/hipaa, and the FTC at ftc.gov has taken action against health apps that shared sensitive data without clear consent. Knowing which regime covers your device tells you whether to rely on law or on your own settings.
11. Three scenarios and what to do
Scenario 1: You run or cycle outdoors daily. Make activities private, set a privacy zone around your home, avoid sharing exact start times and vary routes occasionally.
Scenario 2: Your employer offers discounts for wearing a tracker. Ask what data is shared, whether it is aggregated, whether it affects insurance and how long it is kept. Decide whether the benefit justifies the exposure.
Scenario 3: You are selling your smartwatch. Unpair it, factory reset it, remove it from your account and delete stored history before handing it over.
12. What to expect: a realistic timeline
| Action | Typical time |
|---|---|
| Privacy settings review | 20 minutes |
| Privacy zones and defaults | 10 minutes |
| Connected-app cleanup | 15 minutes |
| Data deletion request | Days to weeks |
| Broker opt-outs | Days to four weeks per site |
13. Common mistakes
- Leaving activity maps public.
- Assuming HIPAA protects the data.
- Connecting every third-party app offered.
- Skipping two-factor authentication.
- Forgetting to wipe a device before selling it.
- Ignoring employer wellness program terms.
14. How Wiperts fits
Your wearable’s settings control one data stream. The profiles that data brokers publish about you, with your name, address, phone number and relatives, are another. Wiperts scans more than 100 data brokers and people-search sites, submits removal requests, removes your personal results from Google and Bing, blurs your home on maps and monitors around the clock.
See what is public about you with the free diagnosis.
100% Free Diagnosis: Check Your Exposure
Find out what data brokers have on you. Enter your details in the free scanner on the Wiperts homepage:
- First Name
- Last Name
- Select State
- Email Address
- Website
Scan Databases Now — no payment is needed to see your exposure report.
15. Key takeaways
- Wearables collect sensitive health, activity and location data around the clock.
- Most consumer wearable data is not covered by HIPAA.
- Set privacy zones, limit connections, secure the account and delete old data.
- Reduce broker profiles that tie your identity to inferred health interests.
Pick the Wiperts plan that fits your household
| Plan | Covers | One-time deep scrub | Then |
|---|---|---|---|
| Individual | 1 person | $89 | $14/month |
| Couples (most popular) | 2 people | $149 | $24/month |
| Family | Up to 4 people | $199 | $39/month |
Every plan includes removal of your name, date of birth, salary, home address and phone number from 100+ data brokers and people-search sites, Google and Bing search-result removal, home blurring on maps, and 24/7 monitoring that re-removes your data if it reappears. See plans and start your removal
16. Frequently Asked Questions
Is my smartwatch or fitness tracker data private?
Not automatically. Data is stored by the device maker and the app, and it may be shared with partners or used for advertising depending on settings and policy. Most consumer wearable data is not protected by HIPAA.
Does HIPAA cover wearable data?
Usually not. HIPAA applies to healthcare providers, health plans and their business associates. A consumer fitness brand is typically not covered, though it may fall under FTC rules and state privacy laws, and data shared with your doctor can become part of your medical record.
Can wearables reveal my location?
Yes. GPS-enabled wearables record routes, and public activity maps can show where you live, work and exercise. Set privacy zones and make activities private by default.
Who can buy or access my wearable data?
The company, its service providers and partners, and in some cases advertisers, researchers or insurers if you consent. Employers or insurers with wellness programs may receive data you agree to share.
What can wearable data reveal?
Sleep patterns, resting heart rate, stress, menstrual cycle, pregnancy, illness, exercise habits and daily routine. Over time it can suggest health conditions you never reported.
How can I use a wearable safely?
Review privacy settings, turn off public sharing, disable unnecessary permissions, use strong account security, limit third-party app connections and delete old data you no longer need.
Sources
Related Reading
- What Happens to Your Health Data Online?
- Removing Medical Records and Health Data From the Internet
- How to Keep Your Location Private and Safe
- Smartphones Constantly Send Personal Information: What to Know and Do
- How to Vet Your Apps Before They Vet You
- Internet of Things: A New Personal Information Pipeline
- Privacy Settings on iPhone and Android: What to Change Today
- What Can Your Digital Footprints Reveal About You?
Ready to erase your footprint?
Stop letting data brokers profit from your personal life. Start your removal today.
Start Removing