Oura Data Report Card

Self-serve: any user can log in to the Membership Hub and export their raw biometric history — even without an active subscription — at no fee.

Export is a .csv of raw biometric data that meets GDPR portability requirements — machine-readable, but a single flat format (a separate developer API also exists).

Self-serve via the web Membership Hub, but asynchronous — you receive a reminder email to download the export from the Hub once it is ready.

Self-serve "Permanently delete your data" in the Membership Hub; the ring is factory-reset and you get email confirmation. Deletion is all-or-nothing — no way to delete specific records short of wiping the account.

"Oura does not sell or rent personal information"; it shares data only with service providers, for user-directed sharing (doctor/coach), and as aggregated or de-identified data for research.

Oura's own privacy policy states it "may collect and use personal data to develop, test, improve, and support Oura's own AI, machine learning, and large language model-powered features." It separately states "We do not sell personal data for the purpose of training third party Large Language Models" — but first-party training by default is what sets this score, not third-party restraint. Note: the published policy documents no opt-out for first-party training, and this cell was previously scored 2 on the strength of press coverage about on-device processing rather than the company's own published policy.