Smart ring data privacy: what to check before you hand over your sleep data

What we can and can't tell you

Straight answer first: we have not yet compiled Oura's, RingConn's, Samsung's, Ultrahuman's or Circular's privacy policies clause by clause. So this page doesn't tell you which brand sells, shares or keeps what. An answer to “does Oura sell your data” is only as good as the policy text it quotes, and we'd rather send you to the text than paraphrase it from memory. When we've read and dated each policy, the changelog on this page will say so.

What we can confirm, from the brands' own fee and feature pages, is narrower but real: who has to pay to see their own data, which features need a specific account or phone, what one brand says about storing data on the ring, and which purchase routes put a third party in the loop. Everything below is sourced, and everything we don't know is labeled as such.

Can you see your own data without paying?

Privacy isn't only about who else sees your data. It's also about whether you can. For the buyer this site is written for, that's the first test, and it's one we can answer from each brand's published fee policy.

A paywall on your own data is a control issue whatever the privacy policy says. Stop paying, and you lose the view of your data (Oura) or the analysis of it (WHOOP). On a no-fee ring, what you see doesn't depend on a payment going through each month. That's why data ownership is its own line in our scoring rubric, and why our no-subscription hub exists. The full fee policies are in do smart rings require a subscription?

Five clauses to read in any privacy policy

Open the brand's privacy policy (it's usually linked in the website footer and in the app's settings) and use your browser's find function for these words. Each clause answers one question you should be able to answer before you buy.

1. Sale and sharing. Search “sell,” “sale” and “share.” Look for a plain statement about whether personal or health data is sold, and read how the company defines “sharing” and with whom: advertising partners, analytics providers, affiliates. The definition matters as much as the promise.
2. De-identified and aggregated data. Search “de-identified,” “aggregate” and “research.” Policies often treat data with your name removed differently from personal data. Check whether that data can be sold, shared with research partners or used to build products, and whether you can opt out.
3. Retention and deletion. Search “retain,” “delete” and “account deletion.” You want to know how long data is kept after you stop using the ring, and whether deleting your account deletes your health history or only your login.
4. Export. Search “export,” “download” and “access your data.” The policy or the help center should say whether you can download your history and in what form. If export sits behind a paid plan, count that as part of the fee.
5. Business transfers. Search “merger,” “acquisition” and “transfer.” This clause says what happens to your data if the company is sold or merged. A ring outlives many purchase decisions; the policy that applies in three years may belong to a different owner.

Also read the app's permission requests during setup. They show which phone data the app wants beyond the ring's own readings, such as location or contacts, and you can decline the ones it doesn't need to track your sleep.

Accounts, phones and where the data sits

Every ring we cover pairs with a phone app, and the app is where your readings are processed and shown. Two sourced details are worth knowing:

• Samsung ties some features to its account. Samsung says Energy Score insights “require compatible Samsung Galaxy AI phone, Samsung Health app and Samsung account.” The ring needs Android 11 or newer and doesn't work with iPhone.
• Ultrahuman says Ring PRO buffers data on the hardware. Its Ring PRO page lists “up to 250 days of on-ring storage and up to a year of on-PRO Charger storage” (Ultrahuman). That's a buffer for time away from your phone, not a statement about whether data stays off Ultrahuman's servers.

For the other brands, we didn't find account or cloud-storage terms on the product pages we checked. Check at setup: does the app require an account before it shows anything, and does it still work if you decline optional features? If the answer matters to you, email the brand's support before you buy. A written reply is worth more than a marketing page.

HSA checkouts and other third parties

Paying with HSA or FSA money can put a third party in the loop. RingConn and Ultrahuman route HSA/FSA purchases through Flex, and Flex says “A licensed clinician will determine your eligibility during a chat-based telehealth consultation,” and that “you must have a medical condition that warrants the product” (Flex). That means describing a health condition to a company other than the ring maker. It's how a letter of medical necessity works, and it may be worth it for the tax saving, but it is a disclosure, and Flex's own privacy terms govern it. Our HSA/FSA guide explains the process step by step.

Partner apps are the other route out. Oura's Ring 5 page, for example, promotes Natural Cycles, a separate birth control app. Whenever you connect a ring's app to another app or health platform, the data you send there is covered by that company's policy, not the ring maker's. Connect only what you'll use.

What US state privacy laws may add

Some US states have passed consumer privacy laws, and a few have laws aimed specifically at consumer health data. Depending on where you live, those laws may give you rights such as seeing, deleting or limiting the sale of your personal data. We're not lawyers, and which rules apply to you depends on your state. The practical step is the same everywhere: find the policy's section on “your privacy rights” or your state, which is where companies list the rights they honor and how to use them.

One related point from the brands themselves: rings are sold as wellness products. RingConn says Gen 3 is “not a medical device,” and Circular says its ring “is not a diagnostic device.” Don't assume your ring data is handled like a record at your doctor's office. Read what the policy actually says.

Picking a ring with data access in mind

Until we've compiled the policies, we rank on the one privacy-adjacent criterion we can source: whether you can see all of your own data without paying. On that test, three rings stand out, each for a different reason.

Circular Ring 2 passes the same test (every core feature is included, with some future features via paid Circular Coins); we picked Ultrahuman over it because Ultrahuman's statement is specifically about data access. Oura doesn't pass without the membership. For a full ranking on cost, evidence and battery, see the best smart rings without a subscription, our RingConn Gen 2 review and the smart ring comparison chart.

A 15-minute privacy check before you buy

1. Read the fee policy. If seeing your own data needs a plan, you're renting access to it.
2. Run the five searches in the brand's privacy policy: sell and share, de-identified, retention and deletion, export, business transfers.
3. Check the help center for export. Look for how, what format and whether it costs anything.
4. Ask support two questions in writing: “Can I export my full history without a paid plan?” and “If I delete my account, is my health data deleted too?”
5. At setup, decline permissions the app doesn't need for sleep and heart data.
6. If you're paying with HSA or FSA through Flex, read Flex's privacy terms as well as the ring maker's.

Privacy mistakes ring buyers make

• Treating “no subscription” as a privacy guarantee. A no-fee ring keeps your data visible to you. It says nothing about what the company does with it; only the policy does.
• Forgetting that a paywall is also a lock-in. Years of sleep history behind a membership make it harder to leave. Check export before the history builds up.
• Connecting every app on day one. Each connection sends data somewhere with its own policy.
• Relying on a summary instead of the policy. Including ours. Policies change; the dated text on the brand's site is what counts.