The journey of a reading
When a wearable records a heartbeat, a step or a night’s sleep, that information does not stay put. A typical path looks like this.
- On the device. Sensors collect raw signals and the device stores recent summaries in its own memory, often for days.
- On the phone. The device syncs by Bluetooth to a companion app, which keeps a longer history and draws the charts.
- In the company’s cloud. Most apps also upload data to the maker’s servers, so you can sign in on a new phone, view data on the web and keep a backup.
- With other services. If you connect the app to a coach, a health platform, an insurance scheme, a social feed or another app, some data may go there too.
Each step creates a copy. Deleting something from the watch does not necessarily delete it from the app or the account, so it helps to know which copy you are looking at.
What gets collected
The obvious items are heart rate, steps, workouts, sleep and calorie estimates. Depending on the device and your settings, there may be more.
- Location. Workout routes, and sometimes continuous location. Routes can reveal where you live and work. See the broader discussion of location tracking.
- Account details. Name, email address, date of birth, height, weight and sex, often needed to calibrate estimates.
- Device information. Model, software version, battery state and error logs, a kind of device telemetry that helps the company fix bugs.
- Usage patterns. Which features you use and when, and sometimes the contents of messages shown on a watch.
- Audio or images. Voice commands, and with some glasses, photos and video.
Some of it is more sensitive than it looks. Heart rate, sleep and activity patterns can hint at health conditions, pregnancy, stress or daily routines. In some places, health-related data gets stronger legal protection than ordinary data, but protections differ by country and by what kind of company holds it. A wellness app run by a technology company is often treated differently from a record held by a doctor or hospital.
Who may be able to see it
It depends on settings and the company’s terms, but the usual parties are:
- You, and anyone with access to your account or unlocked phone.
- The manufacturer and its service providers. Companies that host servers, analyze data or provide customer support may process it under contract.
- Services you connect. Third-party apps get the access you grant, and their handling is governed by their own policies.
- Friends and groups. Many fitness apps have social features, and some default to sharing activity with followers or showing public routes.
- Employers or insurers. Some workplace wellness or insurance programs invite people to share wearable data, often in exchange for discounts. Taking part is usually optional, but it is worth understanding exactly what is shared and how it may be used.
- Authorities. Companies may be required to hand over information under legal processes, the rules for which vary by place.
- Advertisers and data brokers. Practices differ. Some companies state they do not sell personal data, while others share de-identified or aggregated information. The way brokers trade information is covered in the article on data brokers, and the logic of profiling is explained in targeted advertising.
Why “anonymous” is not always anonymous
Companies sometimes say data is de-identified or aggregated. That can lower risk, but it is not a guarantee. Movement and location records are especially hard to anonymize, because a pattern of where someone sleeps and works can be distinctive. Researchers have shown on various occasions that supposedly anonymous location data can be linked back to individuals. This does not mean your data will be misused, only that “anonymized” should not be read as “impossible to trace.”
Security of the stored data
Even a well-intentioned company can be hacked. Data breaches have affected many types of services, and a leak of fitness or location data could reveal routines. Protecting the account is the most direct step you can take: use a unique password, ideally kept in a password manager, and turn on two-factor authentication if it is offered. Where available, passkey sign-in is another option.
Practical steps
- Read the privacy summary. Full privacy policies are long, but look for what is collected, who it is shared with, how long it is kept and how to delete it.
- Review app permissions. On the phone, check that the companion app only has the access it needs, for example location “while using” rather than “always”.
- Check social and sharing defaults. Make routes and profiles private unless you want them public. Hide start and end points near home if the app allows.
- Limit connections. Only link third-party apps you trust, and remove old ones.
- Look for export and delete tools. Many companies let you download your data and request deletion, though what is deleted and how fast varies.
- Think about what you really need. If you do not use continuous location or a feature that records audio, switch it off.
- Plan for the end of life. Before selling or recycling a device, unpair it, sign out and perform a factory reset.
None of this means wearables are unsafe to use. It means the data is valuable and long-lived, so a few minutes at setup is worth spending. Rules and company practices change, so revisiting settings occasionally is sensible.