1. Introduction

Wearable-generated health data refers to personal and physiological information collected by devices such as smartwatches, fitness trackers, continuous glucose monitors, smart rings, and connected medical devices. Such information may include heart rate, blood oxygen levels, sleep patterns, physical activity, body temperature, glucose readings, and location-linked health information.

Data ownership disputes arise when the wearer, device manufacturer, software platform, healthcare provider, insurer, employer, researcher, or another third party claims a right to access, control, use, commercialise, disclose, or retain that information.

For example, a person wearing a smartwatch may believe that their heart-rate history belongs exclusively to them. The manufacturer may store the readings on its servers, while a healthcare provider may incorporate some of them into a medical record. A researcher may then seek to use the information to develop an artificial intelligence model.

The central legal question is not simply who owns the data? It is who has which legal rights over the data, and what restrictions govern those rights?

There is no universal rule that every piece of wearable-generated health data is owned exclusively by either the wearer or the manufacturer. The answer depends on the jurisdiction, the nature of the information, contractual terms, applicable privacy legislation, intellectual property rights, and the circumstances in which the data was collected.

2. Meaning and nature of wearable data ownership

Wearable health data can involve several legally distinct interests.

The wearer's rights

Rights to privacy, access, correction, portability where available, and control over certain uses or disclosures of personal information.

The manufacturer's rights

Ownership of the physical device, software, firmware, and qualifying intellectual property, together with contractual rights that remain subject to applicable law.

The platform's rights and responsibilities

Rights to host, process, organise, or analyse information under applicable agreements and law, without necessarily acquiring unrestricted ownership of the underlying personal data.

The healthcare provider's interests

Rights and obligations concerning clinical records, medical decision-making, retention, confidentiality, and evidence, depending on the governing legal framework.

These interests may coexist. A company can own the smartwatch and its software without thereby acquiring an unlimited right to sell, disclose, or exploit the wearer's identifiable health information.

3. Principal legal issues

A. Ownership versus privacy rights

Ownership traditionally concerns the legal power to possess, control, transfer, or exclude others from property. Personal-data law often takes a different approach: it regulates processing, disclosure, retention, and access without declaring that personal information is property owned exclusively by one party.

Consequently, a user may have statutory rights over their health information even where the service provider stores and controls the underlying database.

B. Device-generated data versus derived data

A dispute may involve several data layers:

Raw data: Sensor readings, such as heart rate recorded at particular intervals.

Processed data: Calculated averages, activity summaries, or sleep estimates.

Inferred data: Predictions concerning stress, disease risk, fertility, or future health.

Aggregated data: Statistical information compiled from numerous users.

Database and software assets: The platform's original code, interface, and qualifying database structure.

The legal status of each layer can differ. In particular, an inference about an identifiable person's health may remain personal or sensitive information even if it was generated by an algorithm rather than directly measured by a sensor.

C. Consent and contractual restrictions

Manufacturers frequently use terms of service and privacy policies to specify how information may be collected, stored, shared, and used for analytics.

A contractual licence to process data does not automatically establish absolute ownership or override mandatory privacy protections. Consent must also satisfy the requirements of the applicable legal regime.

D. Commercial exploitation

Disputes can arise when companies use wearable information for targeted advertising, insurance risk assessments, employment monitoring, research, or AI training.

Important questions include whether the processing was disclosed, whether a lawful basis exists, whether the use exceeds the original purpose, and whether the information can reasonably be linked back to an individual.

E. Access, deletion, and portability

A wearer may seek to download historical readings, transfer them to a competing service, correct an inaccurate record, or delete their account.

The answer may depend on statutory rights, retention obligations, technical limitations, and the distinction between the user's personal information and the provider's protected software or database assets.

4. Important case laws

Direct judicial decisions establishing comprehensive ownership rules for smartwatch or fitness-tracker health data remain limited. The most useful authorities concern wearable-data discovery, digital privacy, third-party data storage, and informational self-determination.

Case 1: Bartis v. Biomet, Inc. (2021)

United States District Court, Eastern District of Missouri, 2021 WL 2092785 (May 24, 2021)

Facts: The plaintiff alleged serious mobility problems following hip replacement surgery. The defendants sought Fitbit records to test claims about the plaintiff's physical limitations.

Decision: The court ordered production of step-count data from the relevant period but permitted the plaintiff to redact heart-rate, sleep, and location information because those categories were not relevant to the litigation and raised privacy concerns.

CaseMine+1

Legal principle: Wearable data may be subject to compulsory disclosure in litigation, but the relevance of particular information and the wearer's privacy interests should be assessed separately.

Relevance to ownership disputes: The decision illustrates the difference between owning or controlling information and having an absolute right to prevent its disclosure. Even where a user can access their Fitbit data, a court may order production of relevant records.

Limitation: This was a discovery ruling, not a final determination of who legally owns Fitbit data.

Case 2: Hinostroza v. Denny's Inc. (2018)

United States District Court, District of Nevada, 2018 U.S. Dist. LEXIS 109602 (June 29, 2018)

Facts: In personal-injury litigation arising from an alleged restaurant fall, the defendant sought information from the plaintiff's fitness tracker.

Decision: The court required the plaintiff to respond to discovery concerning the wearable data and describe the search undertaken for responsive information.

Puerto Rico District Court

Legal principle: A litigant may have discovery obligations concerning relevant electronic information within their possession, custody, or control, subject to the applicable procedural rules.

Relevance: A manufacturer storing the records does not necessarily prevent the wearer from having legal control over them for discovery purposes. Conversely, access rights depend on the relevant facts and governing rules.

Limitation: The decision concerns discovery obligations, not proprietary ownership of the underlying database.

Case 3: Carpenter v. United States (2018)

585 U.S. 296 (2018), United States Supreme Court

Facts: Investigators obtained historical cell-site location records from wireless carriers, revealing the movements of the accused over an extended period.

Decision: The Supreme Court held that obtaining the historical location records at issue constituted a search under the Fourth Amendment and generally required a warrant supported by probable cause.

LII / Legal Information Institute+1

Legal principle: The fact that sensitive digital information is held by a third party does not automatically eliminate the individual's privacy protection.

Relevance: Wearable devices can create detailed records of routines, movements, sleep, and physiological activity. Carpenter offers an important analogy for arguments that continuous, intimate data collection deserves protection even when a commercial service stores the information.

Limitation: The judgment concerned government acquisition of historical cell-site location information. It did not establish that individuals own all data held by technology companies, and its constitutional rule does not automatically apply to private wearable-data disputes.

Case 4: United States v. Jones (2012)

565 U.S. 400 (2012), United States Supreme Court

Facts: Police attached a GPS tracking device to a vehicle and monitored its movements.

Decision: The Court held that the government's physical installation and use of the GPS device constituted a search under the Fourth Amendment. Separate concurring opinions also discussed the privacy implications of prolonged tracking.

Legal principle: Technological tracking can implicate constitutional protections against unreasonable searches.

Relevance: The case is relevant when wearable data is used for location monitoring or government surveillance. It helps distinguish privacy protection from property ownership: a person can have a legally protected privacy interest without necessarily owning every record generated by a tracking system.

Limitation: Jones was a government-surveillance case, not a dispute over commercial ownership of health records.

Case 5: Justice K.S. Puttaswamy (Retd.) v. Union of India (2017)

(2017) 10 SCC 1, Supreme Court of India

Facts: The Supreme Court considered whether privacy is protected as a fundamental right under the Constitution of India.

Decision: A nine-judge bench unanimously recognised privacy as a constitutionally protected fundamental right, grounded in the guarantees of life and personal liberty and other constitutional freedoms.

Legal principle: Privacy encompasses personal autonomy, dignity, and protection against unjustified interference with private life.

Relevance to wearable health data: Continuous collection of heart-rate readings, sleep patterns, and other physiological information may reveal intimate aspects of a person's life. Puttaswamy provides a strong constitutional foundation for challenging unjustified intrusions and excessive collection or use of personal information, particularly by state actors.

Limitation: The judgment did not declare all personal data to be property owned by the individual. The precise remedies and obligations depend on the relevant law and the nature of the defendant's conduct.

Case 6: District Registrar and Collector v. Canara Bank (2005)

(2005) 1 SCC 496, Supreme Court of India

Facts: The dispute concerned statutory access to private documents held by a bank and the limits of state intrusion into private records.

Decision: The Supreme Court examined the constitutional implications of access to private documents and recognised the significance of privacy in records held by third parties.

Legal principle: The fact that documents are held by an institution does not necessarily make them free from privacy-related constitutional constraints.

Relevance: By analogy, a wearable manufacturer or cloud platform holding a person's health records should not be treated as having unrestricted authority to expose those records to government authorities. The legality of access must be assessed under the relevant statutory and constitutional framework.

Limitation: This is an analogy concerning privacy and institutional custody, not a direct ruling on wearable technology or data ownership.

5. Statutory framework in India

A. Digital Personal Data Protection Act, 2023

India's Digital Personal Data Protection Act, 2023 establishes a framework for processing digital personal data and recognises both individual data-protection interests and lawful data-processing needs.

India Code+1

For wearable-generated health information, the principal issues include:

Identification: Heart-rate, activity, or glucose records may constitute digital personal data when they relate to an identifiable individual.

Lawful processing: The organisation processing the information must comply with the applicable statutory requirements once the relevant provisions are in force.

Purpose and transparency: Users need meaningful information about how data is processed, subject to the applicable statutory framework.

Security and accountability: Organisations handling the data must address risks of unauthorised access, misuse, and disclosure under applicable obligations.

Individual rights: The Act provides a framework for specified data-principal rights, subject to its scope, exceptions, and commencement provisions.

Important commencement qualification: As of 4 November 2026, the Act's substantive processing provisions are not all in force. The Government's November 2025 commencement notification schedules many central provisions for 18 months after publication, in May 2027. The Digital Personal Data Protection Rules, 2025 also have phased commencement dates. Accordingly, the provisions must not all be treated as already enforceable on the same date.

E-Gazette+2

The Act does not establish a blanket rule that all wearable-generated health data belongs exclusively to the wearer. Its relevance lies principally in regulating personal-data processing and establishing applicable rights and duties.

B. Information Technology Act, 2000 and SPDI Rules, 2011

The Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 have historically provided an important framework for certain forms of sensitive personal information handled by covered Indian body corporates.

The SPDI Rules expressly address information concerning physical, physiological, and mental health conditions, among other categories. Their application depends on the information, organisation, and relevant statutory conditions.

In a wearable-data dispute, these rules may be relevant to questions involving:

Consent for collection of covered sensitive personal information.

Disclosure and transfer of such information.

Privacy policies and security practices.

Compensation and liability under applicable provisions of Indian law.

Their interaction with the DPDP Act must be assessed in light of the Act's commencement schedule and any applicable amendments or savings provisions. It would be incorrect to assume that every provision of the older framework has already been displaced.

C. Constitutional privacy

The constitutional principles in Puttaswamy are particularly significant where the government collects wearable-generated health data or uses it for surveillance, public-benefit eligibility, law enforcement, or other state functions.

A constitutional challenge may examine legality, legitimate purpose, necessity, proportionality, and safeguards against abuse. The outcome depends on the particular government action and applicable law.

6. Comparative legal approaches

In the European Union, information revealing a person's health may qualify as special-category personal data under Article 9 of the GDPR. Its processing generally requires both an Article 6 lawful basis and an applicable Article 9 condition. The GDPR does not generally confer proprietary ownership of every personal-data record on the data subject.

In the United States, HIPAA may protect health information handled by covered entities and business associates, but ordinary consumer fitness-app information is not automatically protected by HIPAA. Other federal or state laws may apply depending on the circumstances.

These differences matter when wearable information is stored in one country, processed in another, and disclosed to a healthcare provider or insurer in a third.

7. Common types of ownership disputes

A. Wearer versus manufacturer

A smartwatch manufacturer claims that its terms of service permit it to retain and analyse all information generated by its device.

The wearer argues that the information concerns their body and should remain under their control.

Legal analysis: The dispute turns on the scope of the contractual licence, applicable data-protection law, the purposes of processing, and any rights to access, export, or erase the information. Ownership of the hardware does not itself establish unrestricted rights over the user's personal information.

B. Wearer versus health insurer

An insurer seeks historical activity records to assess an insurance application or a claim.

Legal analysis: The key issues include whether the disclosure is authorised, whether consent is valid where required, whether the insurer has a lawful basis for processing the data, and whether the request is permitted under applicable insurance and privacy legislation.

A general acceptance of a wearable's terms of service should not automatically be treated as authorisation for every subsequent disclosure to an insurer.

C. Wearer versus employer

An employer introduces wearable devices to monitor employee activity, sleep, stress indicators, or productivity.

Legal analysis: Relevant questions include whether participation is genuinely voluntary, whether the monitoring is necessary and proportionate, whether health information is being used to make employment decisions, and whether applicable workplace or discrimination laws restrict the use.

The employer's ownership of the device does not automatically give it unrestricted access to an employee's health information.

D. Wearer versus researcher or AI developer

A company wishes to use historical wearable readings to train an AI model that predicts disease risk.

Legal analysis: The researcher must consider the applicable lawful basis, consent or other permitted conditions, purpose limitations, safeguards for sensitive information, and the status of derived health inferences.

Removing names may reduce risk, but pseudonymised information remains personal data where an individual can still be identified. Even ostensibly anonymised datasets require an assessment of re-identification risk and any applicable legal obligations.

E. Wearer versus cloud service after account termination

A user deletes their account but discovers that the provider retains some historical readings.

Legal analysis: The outcome depends on deletion rights, contractual provisions, applicable retention obligations, backups, and any legitimate requirement to preserve records. Account deletion does not invariably require immediate destruction of every copy, but neither does cloud storage automatically justify indefinite retention.

8. Legal tests courts may apply

When a court or regulator considers a wearable-data dispute, the following framework can help organise the analysis.

Identify the information. Determine whether the disputed material is raw sensor output, a health inference, a medical record, a database, or software.

Identify the relevant parties. Establish who collected the data, who stores it, who determines its use, and who can access or disclose it.

Establish the legal basis. Examine statutes, contractual terms, licences, constitutional rights, and applicable intellectual property law.

Examine the purpose of processing. Determine whether the data is being used for the purpose originally disclosed or for a materially different purpose.

Assess necessity and proportionality. Particularly for surveillance, employment, insurance, or litigation, determine whether the proposed access is justified and appropriately limited.

Determine the appropriate remedy. Consider access, correction, portability, restricted disclosure, deletion where legally available, an injunction, compensation, or exclusion of improperly obtained evidence.

9. Evidentiary disputes involving wearable data

Ownership and admissibility are separate legal questions. A party may possess or control data without being able to establish that it is accurate or admissible in court.

For example, in a personal-injury action, a defendant may request step counts to challenge the claimant's assertion that they cannot walk long distances. The court may permit disclosure of step counts while protecting unrelated sleep or location records, as illustrated by Bartis v. Biomet, Inc.

The party seeking to rely on wearable evidence may need to establish:

Authenticity and the identity of the account or device.

Reliability of the sensor and the method used to calculate readings.

Integrity of the records and any relevant audit trail.

The meaning and limitations of the recorded measurements.

Compliance with applicable evidence, discovery, and privacy rules.

Wearable readings are not necessarily equivalent to a medical diagnosis. A smartwatch's estimate of sleep, stress, or oxygen saturation may have different evidentiary weight from a clinically validated measurement.

10. Remedies and dispute-resolution options

Depending on the jurisdiction and facts, a person affected by misuse of wearable-generated health data may consider:

The appropriate remedy depends on the applicable statute, whether the dispute is against a private organisation or the state, the nature of the alleged harm, and the procedural posture of the case.

11. Practical safeguards for resolving ownership disputes

Individuals should consider the following measures before using a wearable device or agreeing to share its records.

Review the privacy policy and terms of service, particularly provisions on analytics, third-party disclosure, research, and AI training.

Check whether historical readings can be downloaded in a usable format.

Distinguish optional sharing permissions from functions necessary to operate the device.

Review permissions granted to insurers, employers, healthcare providers, and connected applications.

Keep copies of relevant consent records, policy versions, and communications.

For organisations, document the purpose of collection, access controls, retention periods, security measures, and the legal basis for each intended use.

12. Conclusion

Data ownership disputes involving wearable-generated health data arise because several different legal interests overlap: the wearer's privacy and personal-data rights, the manufacturer's intellectual property, the platform's contractual interests, and the healthcare provider's duties concerning medical records.

The principal lesson from Bartis, Hinostroza, Carpenter, Jones, and Puttaswamy is that ownership, control, privacy, access, and disclosure are distinct legal questions. These cases provide useful principles, but none establishes a universal rule that the wearer exclusively owns every item of wearable-generated data.

For India, the analysis must also account for the phased commencement of the DPDP Act and Rules, the applicable provisions of the Information Technology Act and SPDI Rules, and constitutional privacy principles where relevant.

A useful next step is to examine this issue specifically under Indian law, including statutory provisions, available remedies, and a case-law-based framework for claims against wearable manufacturers, health insurers, and employers.