Your heart rate, sleep and HRV history is personal data, and in many places the law lets you ask the company that holds it for a copy within a fixed time, usually free. In the EU, that copy must hold all the personal data the company processes, not a summary. What a company keeps once you stop paying is a different matter: that is set by its own terms, and some delete unused accounts after two or three years.
This guide sets out what the main services say happens to your data, what the law gives you in each region, how to ask for a copy, and how to keep what you receive. We read each company’s Terms, privacy policy and help pages, and the legal texts, on 22 October 2026. It is general information about the law, not legal advice.
Who holds your wearable data
Your data passes through up to three places:
- The wearable. A ring or band stores readings until your phone collects them. RingConn says the Gen 3 “stores up to 10 days of data without syncing” (RingConn Support).
- Your phone. Some apps keep data there. Apple Health stores it on the iPhone and, if you use iCloud, end-to-end encrypted, so Apple does not have the keys (Apple Support, iCloud data security).
- The company’s servers. Many services upload your readings and work out the scores on their side. WHOOP’s help centre ties all three steps to the membership: “Once your membership has ended, WHOOP will no longer collect, upload, or analyze your biometric data” (WHOOP Support).
Data-protection law does not settle who owns this data. It gives you rights over it instead: to see it and get a copy (GDPR Article 15), to have it deleted (Article 17), and to take the data you provided to another service (Article 20). Some companies go further in their own words. Ultrahuman’s privacy policy says “You own your data and control our usage of your data”, and Samsung’s US policy says “Your personal information belongs to you.”
What happens to your data when you stop paying
After you stop paying
From each company’s own documents, 22 and 24 October 2026
-
WHOOP Membership needed for full use of the app
- Past data, without paying
- Its documents disagree. Help centre: yes. Terms: your content is no longer available “through the Services”, and you can ask for a copy.
- Export, without paying
- Not stated. WHOOP does not say whether the in-app export works after the membership ends.
- Deletion clock
- Not stated. No period stated. The Terms let WHOOP delete your content “from our live databases” when the agreement ends.
- Ask for a copy
- privacy.whoop.com · privacy@whoop.com
-
Oura Membership needed for full use of the app
- Past data, without paying
- In part. Only the three daily scores: Readiness, Activity and Sleep.
- Export, without paying
- Yes. CSV from the Membership Hub, “even without a membership”. The API needs one.
- Deletion clock
- Not stated. Kept while the account is active; no period for unused accounts.
- Ask for a copy
- dataprotection@ouraring.com
-
Garmin Connect Optional subscription
- Past data, without paying
- Yes. The app needs no subscription. At the launch of Connect+, Garmin said all existing features and data “will remain free”.
- Export, without paying
- Yes. The whole account as a ZIP, from the Account Management Center.
- Deletion clock
- Yes. Deleted after 2 years with no account activity. Wearing the watch does not count.
- Ask for a copy
- privacy@garmin.com · euprivacy@garmin.com
-
Google Health (Fitbit) Optional subscription
- Past data, without paying
- Not stated. Google Health Premium is optional. Coach data is kept when it ends; Google does not say what else changes.
- Export, without paying
- Yes. Google Takeout, with Google Health selected.
- Deletion clock
- Yes. Fitbit logins not moved to Google: Google set 15 July 2026 for deletions to begin. A Google account unused for 2 years may be deleted.
- Ask for a copy
- support.google.com/policies/troubleshooter/7575787
-
Samsung Health No subscription
- Past data, without paying
- Yes. No Samsung Health subscription.
- Export, without paying
- Yes. Download personal data, in the app. Samsung does not list the files.
- Deletion clock
- Yes. A Samsung account unused for 24 months may be deleted with its data, after an e-mail.
- Ask for a copy
- samsung.com/request-desk
-
Apple Health No subscription
- Past data, without paying
- Yes. No subscription. Health data is kept on the iPhone.
- Export, without paying
- Yes. Export All Health Data, as XML, on the iPhone.
- Deletion clock
- Yes. An iCloud account inactive for 1 year may be closed, after 30 days’ notice.
- Ask for a copy
- privacy.apple.com
-
Withings Optional subscription
- Past data, without paying
- Yes. Withings+ is optional, and devices “continue to function normally” without it. Withings says you always have direct access to your data, whatever your subscription.
- Export, without paying
- Yes. A CSV archive by e-mail, from the app.
- Deletion clock
- Its documents disagree. EU terms: deleted after 3 years with no login, no device use and no click on a Withings e-mail. US terms: may be deactivated after 5 years without a login. Privacy policy: 10 years.
- Ask for a copy
- privacy@withings.com
-
Welltory Optional subscription
- Past data, without paying
- In part. Free plan: the last 30 days. Older data is deleted unless you export it first.
- Export, without paying
- Yes. An archive from the web app, with the same login.
- Deletion clock
- Yes. Deleted after 3 years of inactivity.
- Ask for a copy
- support@welltory.com
-
Polar Flow Optional subscription
- Past data, without paying
- Yes. Polar Flow is free. The Fitness Program subscription only adds a training programme.
- Export, without paying
- Yes. Download your data, at account.polar.com, without the sleep and activity Polar derives. Sessions and RR intervals from the Flow website.
- Deletion clock
- Not stated. Kept while the Flow account is active; no period for unused accounts.
- Ask for a copy
- privacy@polar.com
-
Ultrahuman Optional subscription
- Past data, without paying
- Yes. The ring needs no subscription: “lifelong access to the ring and your data”. PowerPlugs and Ultrahuman Max are optional.
- Export, without paying
- In part. No download button. A personal API token reads your own daily metrics, for programmers; on an iPhone, Apple Health keeps a copy.
- Deletion clock
- Not stated. No period for unused accounts. Your data may be deleted if you close the account.
- Ask for a copy
- legal@ultrahuman.com
Ten cards, one per service, each with four facts: whether you can still see past data without paying, whether the export still works without paying, whether the company states when an unused account is deleted, and where to ask for a copy. Each fact starts with its answer in words.
WHOOP: the help centre and the Terms say different things
WHOOP has no free tier: its Terms say you need an active membership to use the service, and once the membership ends the strap’s data is no longer uploaded. On past data, WHOOP’s own documents disagree:
- The help centre article, dated 22 October 2026, answers “Can I still see my past data after canceling?” with “Yes, you will be able to view your past data, but new data will not be recorded after cancellation.”
- The Terms of Use, dated 3 August 2026, say that when the membership ends your content “will no longer be available to you through the Services but you can request a copy of your data”. They also say that when the agreement ends WHOOP “may delete Your Content associated therewith from our live databases”, and that it “has no obligation to store any of Your Content.”
WHOOP does not say whether its in-app export works after the membership ends, so export before it does. What happens to my WHOOP data if I cancel? gives the steps.
Oura: three scores, but the export still works
Without a membership, Oura says, “you’ll only be able to see your three daily Oura scores (Readiness, Activity, and Sleep)”, plus battery, profile and settings. Your data is not deleted when you cancel, and “Even without a membership, you can export all of your Oura data in CSV format through the Membership Hub.” The API needs a membership (Oura Member Care). Oura’s privacy policy keeps measurement data “only so long as your Oura account is active”. More in what happens to my Oura data if I cancel?
One page per service
Each of these pages sets out what one service says happens to your data when you cancel or stop using it:
- What happens to my WHOOP data if I cancel?
- What happens to my Oura data if I cancel?
- What happens to my Garmin data if I stop using it?
- What happens to my Fitbit data if I cancel?
- What happens to my Samsung Health data if I stop?
- What happens to my Withings data if I cancel?
- What happens to my Welltory data if I cancel?
- What happens to my Polar data if I stop using Flow?
- What happens to my Ultrahuman data if I cancel?
Deletion clocks on unused accounts
Several companies delete accounts that go unused, or reserve the right to, and “unused” may not mean what you expect:
- Garmin: “If there is no activity on your Garmin account across all our sites and services for at least 2 years, your account will be deleted.” Logins, uploads from a device, purchases, engagement with Garmin’s marketing e-mails and community interactions count as activity; Garmin lists “Use of a device” among what does not. A watch worn every day but never synced does not keep the account alive. Garmin e-mails several warnings first, and “Data cannot be restored after it is deleted” (Garmin Support).
- Samsung: “Accounts that have not been used in 24 months will be classified as inactive.” After an e-mail, the account “and all or some of its associated data may be deleted” (Samsung Support).
- Welltory: “After three years of inactivity, your personal data will be deleted.” On the free plan, history is limited to the past 30 days, and older data is deleted unless you export it first (Welltory).
- Withings: its documents give three periods. Its EU terms say “WITHINGS deletes any inactive Account”: one with no login, no login from its devices and no click on a Withings e-mail for more than three years, after a 90-day notice. Its US terms say “WITHINGS may deactivate an Account if the User has not logged in for a period of five (5) years.” Its privacy policy counts 10 years of the same kind of silence before an account is inactive and deleted. All three were live on 24 October 2026; plan for the shortest that could apply to you.
- Apple: the iCloud terms let Apple close an account inactive for one year, after 30 days’ notice by e-mail, and delete its data “after a period of time” that they do not state.
- Google: Google “reserves the right to delete an inactive Google Account and its activity and data” after at least two years without activity across Google (Google Account Help).
When the service itself closes
Shutdowns have happened, with fixed dates and short windows:
- Fitbit logins moved to Google accounts. “After May 19, 2026, you can no longer access Fitbit with your Fitbit account.” For accounts not moved, Google set 15 July 2026 as the day it would begin processing data deletions (Google Health Help).
- Microsoft Health Dashboard, the service behind the Microsoft Band: “All data in the Microsoft Health Dashboard will be deleted on 5/31/2019.” Band owners could keep using the band without its web features (Microsoft Support).
- Suunto Movescount closed after 10 January 2022. Afterwards, “you will not be able to use Movescount or import your training history from it” (Suunto).
- Endomondo was retired on 31 December 2020. Transfers to MapMyRun were allowed until 15 February 2021, and data not deleted by its owner was to be deleted after 31 March 2021 (Endomondo Support, archived).
- Polar’s polarpersonaltrainer.com closed on 31 December 2019: “If you didn’t transfer your data in time, unfortunately it is now deleted and cannot be restored” (Polar, Privacy FAQ).
Each closure came with a date and a window to download, after which the data was deleted or could no longer be moved.
Your rights, by region
EU and EEA: the GDPR
The GDPR applies to any company that offers goods or services to people in the EU, wherever it is based and whether or not you pay (Article 3(2)). Health data is a special category (Article 9).
- A copy of your data (Article 15). You can get confirmation that the company processes your data, a copy of it, and information: the purposes, the recipients, how long it will be kept, and where the data came from if not from you. If you ask electronically, the copy comes “in a commonly used electronic form” unless you ask otherwise. You can ask for the names of the recipients, not just their type, unless they cannot be identified (Court of Justice, C-154/21).
- Free, and no reason needed. The first copy is free, and the company cannot ask why you want it (Court of Justice, C-307/22). It may refuse or charge only for requests that are “manifestly unfounded or excessive”, which it has to show (Article 12(5)). Even a first request can be excessive, the Court has held, but only exceptionally: the company must prove it was made with an abusive intention, such as to manufacture a claim for compensation (C-526/24). If it has reasonable doubts it may ask you to confirm who you are (Article 12(6)).
- One month. The company must answer “without undue delay and in any event within one month of receipt of the request”. It can extend by two further months “where necessary, taking into account the complexity and number of the requests”, but must tell you within the first month and say why (Article 12(3)).
- A portable copy (Article 20). For data you provided, you can get it “in a structured, commonly used and machine-readable format” and have it sent to another service. It applies when processing rests on your consent or a contract and is automated.
- A complaint (Article 77) to the supervisory authority where you live, work or where the problem happened. The EU data protection board lists each country’s authority (EDPB).
United Kingdom
The UK GDPR keeps the same rights, and an organisation “must respond without undue delay, and within one month” (ICO). The Data (Use and Access) Act 2025 changed three things:
- You are entitled to what the company finds through “a reasonable and proportionate search”, a rule treated as in force from 1 January 2024 (section 78).
- Since 5 February 2026, if the company reasonably needs more information to identify what your request covers and asks you for it, the one-month clock stops until you reply (section 76, in force from that date under the Commencement Regulations 2026). The ICO’s guidance adds: “You cannot force someone to narrow the scope of their request.”
- Since 19 June 2026, you have a right to complain to the company itself, which must acknowledge the complaint within 30 days (section 103). You can still complain to the ICO, which recommends raising a concern with the company first in most cases.
California
The California Consumer Privacy Act covers for-profit businesses that do business in California and meet one of three thresholds: annual revenue over $25 million (adjusted for inflation), buying, selling or sharing the personal information of 100,000 or more consumers or households, or making half or more of their revenue from selling or sharing it (Civil Code §1798.140).
- You can ask for “the specific pieces of personal information” the business collected about you (§1798.110), and inferences drawn about you are personal information too (§1798.140(v)).
- The business has 45 days, extendable once by another 45 when reasonably necessary, if it tells you within the first 45. The answer is free, and machine-readable “to the extent technically feasible” (§1798.130).
- By default it covers the last 12 months. You can ask for data back to 1 January 2022; a business that says this is impossible or disproportionate must explain why in detail (CCPA Regulations §7024(h)).
- A business need not answer more than twice in 12 months (§1798.130(b)).
Complaints go to the California Privacy Protection Agency or the Attorney General. Other US states have their own laws: Garmin, for example, says residents of “any U.S. state with a comprehensive privacy law” can ask for access, correction, deletion or a portable copy (Garmin).
Brazil, Japan, South Korea and Russia
| Place and law | What you can ask for | Deadline | If they do not answer |
|---|---|---|---|
| Brazil, LGPD | Access, free (Art. 18). A full electronic copy for processing based on consent or a contract, on terms set by the ANPD (Art. 19 §3) | A simplified answer at once; a clear and complete declaration within 15 days of the request (Art. 19) | A petition to the ANPD, the data authority |
| Japan, APPI | Disclosure of your data, including in electronic form (Art. 33). A reasonable fee is allowed (Art. 38) | “Without delay”; no number of days | The Personal Information Protection Commission’s inquiry line |
| South Korea, PIPA | To view your data (Art. 35). A right to have data sent on (Art. 35-2) applies for now only to designated handlers, such as some health bodies, mobile operators and energy suppliers, and not to data the company derived | 10 days (Enforcement Decree Art. 41); the company may postpone for a justified reason, with notice (Art. 35) | A report to the Personal Information Protection Commission (Art. 62) |
| Russia, 152-FZ | Information on the processing, including the data itself (Art. 14). We found no right to an electronic copy or to portability | 10 working days, plus up to 5 with a reasoned notice (Art. 20) | The authorised data-protection body, or a court (Art. 17) |
The Russian text is a consolidated copy published by ConsultantPlus, as the official portal could not be reached. In Korea, from 20 February 2027 the right to have data sent to you also covers large companies, by revenue and number of users (Enforcement Decree Art. 42-2).
On the chart below, a month is drawn as 30 days, and Russia’s working days as five to a week with public holidays left out, so 10 working days show as 14 calendar days and 15 as 21.
A bar chart of response deadlines in calendar days, one bar per place, from 0 to 90 days. EU and EEA (GDPR): 1 month, up to 3 where necessary for complex or numerous requests. United Kingdom (UK GDPR): 1 month, up to 3 where necessary for complex or numerous requests. California (CCPA): 45 days, up to 90 when reasonably necessary, with notice. Brazil (LGPD): 15 days for the complete declaration. South Korea (PIPA): 10 days; may be postponed with a stated reason. Russia (152-FZ): 10 working days, up to 15 with a reasoned notice. Japan (APPI): “Without delay”: no number of days.
A copy means all of your data, not the app’s summary
If an app shows you heart rate minute by minute, going back years, and the app gets it from the company’s servers, the company holds that data and processes it. Our reading is that under the GDPR the copy you ask for should then hold it at that level of detail, not daily averages. Three sources support this reading:
- The Court of Justice. A copy is “the faithful reproduction or transcription of an original”, so “a purely general description of the data” does not count. “The copy must therefore contain all the personal data undergoing processing” (C-487/21, paragraphs 21 and 32), and it must “reproduce those data fully and faithfully” (paragraph 39). Personal data includes “all information resulting from the processing” (paragraph 26); by the same logic, that covers the scores worked out from your readings.
- Health data in summary form. In a case about medical records, the Court said that giving “a simple summary or a compilation of those data … in an aggregated form” could create the risk of “some relevant data being omitted or incorrectly reproduced” (C-307/22, paragraph 78).
- The European Data Protection Board. Access “cannot be understood as granting only a summary of the data” (Guidelines 01/2022, paragraph 23). It includes raw data from connected devices and “results of a health assessment” (paragraph 97). And “the use of self-service tools should never limit the scope of personal data received” (paragraph 138): an export button does not replace a full copy.
Oura’s own developer documentation shows why this matters. It says the night’s average heart rate is “based on 30-second samples”, while “the app shows the average of aggregated 5-minute heart rate samples” (Oura API). The company works from finer data than the app shows, and on this reading a full copy should include whatever of it Oura still holds. Oura does not say how long it keeps 30-second data.
Three places, from top to bottom: on the wearable, on your phone and on the company’s servers. The servers hold three layers, each drawn with fewer ticks than the one before. For each layer, three routes are marked: the export button, a copy under Article 15 and a portable copy under Article 20. On the wearable, Readings waiting to sync: A ring or band keeps data until the phone collects it: up to 10 days on a RingConn Gen 3. No company holds it yet. Export button: Does not reach it. Copy: Does not reach it. Portable copy: Does not reach it. On your phone, Data kept only on the phone: Apple Health keeps its data on the iPhone, and end-to-end encrypted in iCloud. Export it from the phone: a company can copy only what it holds. Export button: Reaches it. Copy: Depends. Portable copy: Depends. On the company’s servers, Fine samples: What the company works from. Oura’s API describes sleep heart rate “based on 30-second samples”. Export button: Depends. Copy: Reaches it. Portable copy: Reaches it. On the company’s servers, What the app shows: Values worked out from the samples. Oura says its app shows “aggregated 5-minute” heart rate. Export button: Depends. Copy: Reaches it. Portable copy: Depends. On the company’s servers, Scores: A number a day worked out by the company: Readiness, Recovery, a sleep score. Export button: Depends. Copy: Reaches it. Portable copy: Does not reach it.
Where the argument stops
- No wearable case yet. C-487/21 was about a credit agency and C-307/22 about a dentist. Applying them to a ring or a watch is an argument by analogy, not a ruling, and a company or an authority may see it differently.
- Only data the company still holds. A company does not have to provide data it no longer has, for example after its retention period. It must not delete data to avoid a request (EDPB, paragraphs 37 and 39).
- Only data the company processes. If the detail lives only on your phone, as with Apple Health, there is nothing on the company’s side to copy. Export it from the phone instead.
- Large requests. Where a company holds a large amount of data about you, it may ask you to specify the information or processing your request is about before it delivers (GDPR Recital 63). The EDPB names companies that “collect data regarding frequent activities of the data subject over a prolonged time period” (paragraph 35). Naming the data and dates in your request avoids that round trip.
- Format. Article 15 asks for a commonly used electronic form; the EDPB accepts that even a PDF can do for access (paragraph 156). A machine-readable file is an Article 20 right, and it covers data you provided, such as “the heartbeat tracked by a wearable device”, but not scores the company infers. For that data, where no format is in common use in the industry, the Article 29 Working Party asked for open formats such as XML, JSON and CSV “at the best possible level of granularity” (WP242).
- Trade secrets. A company may protect its algorithm, but “the result of those considerations should not be a refusal to provide all information” (GDPR Recital 63).
- Outside the EU. The UK limits the search to what is reasonable and proportionate. California covers “specific pieces of personal information” over 12 months by default, and a business need not answer more than twice in 12 months.
How to ask for a copy
Write to the address in the company’s privacy policy (the figure above lists them for ten services), or use its privacy form, and keep a dated copy of what you send. The data request letter builder on this site puts these points into a letter.
Then:
- Note the deadline. One month in the EU and the UK; 45 days in California. Count from the day the company receives the request, or in the UK from the day it has what it needs to confirm your identity.
- Answer identity checks promptly. A company may ask you to confirm who you are, and the clock may wait for it.
- Check what arrives against your list. If data types or dates are missing, write back and name them.
- If there is no answer after the deadline, send a reminder that quotes your first request and its date. Then, in the EU, complain to your data protection authority; in the UK, to the company and then the ICO, as the ICO recommends; in California, to the California Privacy Protection Agency or the Attorney General.
What you receive and how to open it
Most companies send a ZIP archive, by e-mail link or in their privacy portal. Download it before the link expires: WHOOP’s export links expire after 7 days (WHOOP Support).
- CSV: a table that opens in any spreadsheet. Check the units: Oura gives durations in seconds.
- JSON: structured text, readable in a text editor or a browser.
- FIT: Garmin’s binary format for activities and daily wellness files. Garmin’s FIT SDK tools include FitCSVTool, “a command line tool used to convert binary FIT files to readable text files” (Garmin Developers). The tools come under Garmin’s FIT Protocol License.
- XML: Apple Health’s export. Its main file,
export.xml, can be very large.
How to export your HRV data explains what each platform’s export holds, and the RR converter turns a file with beat-to-beat intervals into a plain list in your browser, without uploading it.
How to store an archive so it stays usable
- Keep the original untouched. Save the archive exactly as it arrived, named by date and service, such as
2026-10-22_whoop_export.zip, and work only on copies. - Record a checksum next to it, for example with
shasum -a 256 2026-10-22_whoop_export.zip > 2026-10-22_whoop_export.zip.sha256, and check it now and then. A checksum shows whether a file has changed (NDSA, fixity guidance). - Keep a working copy in open formats. Unzip it, convert FIT files to CSV, and keep CSV, JSON and XML as delivered.
- Use one dated folder per export:
| Folder or file | What goes in it |
|---|---|
health-data/whoop/2026-10-22/ | One export, by service and date |
original/ | The archive as delivered, and its .sha256 file |
extracted/ | The unzipped and converted files |
README.txt | What the files are |
- Write a README in each folder: the device and app version, the units, which HRV measure the numbers are (WHOOP’s is RMSSD RMSSD Root mean square of successive differences: an HRV metric built from how much each heartbeat interval differs from the next, in milliseconds. It mainly reflects vagal activity. More about RMSSD , Apple’s is SDNN SDNN The standard deviation of all NN intervals in a recording, in milliseconds. It measures overall variability, and its value depends strongly on how long the recording lasts. More about SDNN ) and the time zone (WHOOP Support, Apple Health). Values from different services cannot be compared without that note.
- Back up three copies: “Keep 3 copies of any important file: 1 primary and 2 backups”, on two kinds of storage, with one copy away from home (US-CERT, Data Backup Options).
- Encrypt the backups. These files are health data.
- Export on a schedule, every few months, not only when you leave. Deletion clocks, shutdowns and expiring links leave you with only the copies you already made.
This page is general information about data-protection law, not legal advice.