Sleep Scores Don’t Stay in Bed: What Your Smartwatch Shares Behind Your Back

Your smartwatch is a tiny, persistent biographer. It notices that your resting heart rate crept up after a stressful week. It records the nights you slept badly and the mornings you skipped a run. It may even flag an irregular rhythm or a dip in blood oxygen. None of that is inherently sinister. But in 2026, the wrist is one of the most intimate data-collection points most of us own — and the question worth asking is not just what the watch knows, but who else gets the memo.

The biographer on your wrist

Modern wearables collect more than step counts. Depending on the device, you might be generating a daily stream of heart-rate variability, sleep stages, workout intensity, menstrual cycle estimates, ECG readings, skin temperature and location traces. Fitness apps add another layer: routes, gym check-ins, weight logs and sometimes free-text notes about injuries or medication.

Individually, these are small signals. Stitched together, they can say quite a lot about your health, habits and daily routine. That is precisely why insurers, employers and analytics firms have an interest in aggregated wellness data — and why it is worth knowing where the pipework runs.

How health data actually leaves the wrist

It rarely travels in one neat, dramatic leak. More often it moves through a chain of connected services. Your watch syncs to a phone app. That app may connect to Apple Health or Google Health Connect. A fitness platform may pull in data from your watch and share it with a coaching service, a challenge leaderboard or a research programme. Some apps also use software development kits that send analytics or advertising identifiers to third parties.

That does not mean every app is selling your heartbeat to the highest bidder. It does mean that “connected” is a broad word. The useful question is: which services have been granted access, and what do their privacy settings actually say?

Insurers: consent, questionnaires and the aggregated grey zone

In the UK, health data is special category data under the UK GDPR. Processing it generally requires a specific legal condition — often explicit consent, or another route such as the insurance condition in the Data Protection Act 2018, which comes with safeguards and paperwork rather than acting as a free pass.

In practice, most life, health and travel insurers still rely heavily on questionnaires and medical evidence. They do not usually plug directly into your Apple Health account. But wearable data can enter the picture in subtler ways: through a rewards programme that offers points for activity, a wellbeing app branded by an insurer, or a third-party analytics provider used to price or assess risk.

If you join an activity-linked insurance scheme, read the terms closely. Ask whether the insurer receives individual-level data or only aggregated confirmation that you met a target. If an insurer asks about wearable data, ask why it needs it, what it will do with it and whether you can provide a different form of evidence. Answer truthfully — but do not assume the watch is automatically snitched on.

Employers and the wellbeing scheme

Workplace wellbeing programmes deserve a raised eyebrow. A free fitness challenge sounds harmless until the small print says data will be shared with HR or an occupational health provider. Consent in an employment context is rarely freely given, because saying no can feel awkward when your manager is enthusiastic.

You can ask for the programme’s privacy notice, the data protection impact assessment and a clear explanation of who sees what. If participation is genuinely voluntary, you should be able to take part without handing over granular health data. If it is not, that is a conversation for your union rep or the Information Commissioner’s Office.

Data brokers and the app economy

Data brokers rarely buy your watch directly. They buy or receive data from apps, loyalty schemes and analytics partners. Some of that may be inferred rather than measured: “frequent runner”, “likely to be dieting”, “active commuter”. Inferred data can still be personal data, and it can still be used to profile you.

Check the app’s privacy settings for switches labelled “share with partners”, “personalised ads” or “product research”. Look at the App Store or Google Play privacy labels, but treat them as a starting point rather than gospel. The real detail is usually in the privacy policy and the in-app settings.

Auditing your own handover

Start with the phone, not the watch. On iPhone, open Health, tap your profile picture and go to Privacy > Apps to see which services can read and write health data. On Android, check Health Connect and revoke access for anything you no longer use. Then open Fitbit, Garmin, Strava or whichever platform you use and inspect connected apps and third-party access.

Next, export your data. Most major services offer a download containing your activity, sleep and account details. It is a useful reality check: seeing a year of your own resting heart rate in a spreadsheet makes the scale of collection concrete. Finally, if you want out, use the app’s deletion route and ask for confirmation. Deleting the app from your phone does not necessarily delete the account.

Your UK data rights, in plain English

You can ask a company for a copy of your data using a subject access request. You can ask for inaccurate data to be corrected, for processing to be restricted, or for data to be erased where the rules allow. Where processing relies on consent, you can withdraw it. Where it relies on legitimate interests, you can object. If you are unhappy, you can complain to the Information Commissioner’s Office.

A practical request to an insurer or app maker might ask: what health or wearable data do you hold about me, where did it come from, who has it been shared with, and what logic do you use to assess me? You do not need to be a lawyer to ask. You just need to be specific.

A short watch-back checklist

• Revoke health-data access for apps you do not actively use.
• Check connected services inside Fitbit, Garmin, Strava and any insurer-branded wellness app.
• Read the insurance rewards terms for wording about individual data and third parties.
• Export your data once a year so you know what exists.
• Use subject access and deletion requests when you want the paper trail.
• Treat “wellbeing” schemes as data projects with a friendly logo.

Your watch can be a useful coach. It does not have to be an open ledger. A few minutes in the settings menu — and a couple of pointed emails — can go a long way towards keeping the biographer on your wrist, rather than on someone else’s risk file.