Using wearables in compliance with the GDPR: from legal basis to analysis

Anyone using wearables in a clinic, in rehabilitation, in workplace health management or in studies is processing sensitive data. The question of wearables and the GDPR is therefore not a formality: it decides whether a project is allowed to start at all. This guide takes you through the legal basics, shows where the data actually flows, and compares the ways of bringing wearable data into a data foundation of your own in a controlled manner.

Is wearable data health data under the GDPR?

Under Art. 4(15) GDPR, data concerning health is personal data relating to the physical or mental health of a person which reveals information about their health status. It is one of the special categories of personal data under Art. 9 GDPR. Processing it is prohibited in principle unless one of the exceptions in Art. 9(2) applies.

For wearables, this means that most of the readings that matter in professional applications fall into this category.

• Clearly health data: heart rate, heart rate variability (HRV), ECG signals, oxygen saturation, skin temperature, sleep stages and sleep quality
• Depending on the purpose: steps, active minutes, training volume or calories burned. As soon as these values are used to assess a person’s health, capacity or recovery, they must also be treated as health data.
• Always personal data: even without a name, a data set is personal data as long as it can be linked to a person via an identifier, an account or a device. Pseudonymised data remains personal data.

In addition to Art. 9, you always need a legal basis under Art. 6 GDPR. In practice, the two are assessed together.

Legal bases: consent, treatment, research

Which legal basis applies depends on the purpose. The same smartwatch can run on a different basis in rehabilitation, in workplace health management and in a study. The table below shows the typical assignments by area of use.

Area of use	Typical legal basis under Art. 9(2) GDPR	What to look out for
Clinic and rehabilitation	point (h) (healthcare and treatment), supplemented by national law; point (a) (consent) for additional purposes	Professional secrecy, purpose limitation to the treatment, transfer to the HIS and patient record
Workplace health management	point (a) (explicit consent)	Voluntariness despite the dependent relationship, works council, only aggregated analysis for the employer
Studies and research	point (a) (consent following study information) or point (j) (research purposes) with safeguards under Art. 89	Study protocol, ethics approval, pseudonymisation, retention periods
Elite sport	point (a) (explicit consent), and point (h) where sports medicine care is provided	Voluntariness towards the federation and coaching team, rights per role

Consent must meet the requirements of Art. 7 GDPR: informed, freely given, for a specific purpose, demonstrable and revocable at any time. As the controller, you bear the burden of proof. In the Datico^® Life Hub, a Double Opt-In records each consent with its time and scope, consent can be withdrawn at any time, and the granting, confirmation and withdrawal are also logged in the Audit Trail.

Where wearable data flows: manufacturer cloud, third country, data processing

The legal basis is only half the answer. For data protection with wearables, the route the data takes matters just as much. With consumer wearables, the standard route looks like this:

1. The wearable measures and stores the data on the device.
2. The manufacturer’s app pulls the data to the smartphone via Bluetooth.
3. The app transfers it to the manufacturer’s cloud. For this, every person needs their own account with the manufacturer.
4. Only from there does the data reach your own system via a manufacturer interface.

This leads to three points to check.

The manufacturer’s role

If the person in your care creates an account with the manufacturer themselves, a separate contractual relationship arises between them and the manufacturer. The manufacturer then often processes the data under its own terms of use and privacy policy. Check what role the manufacturer plays in your project and which data it uses for its own purposes.

Third-country transfers

If the manufacturer or its cloud provider is based outside the EU, the rules of Chapter V GDPR (Art. 44 et seq.) apply. A transfer is then only permitted on the basis of an adequacy decision, standard contractual clauses or another safeguard. For the USA, the EU-U.S. Data Privacy Framework may be an option, provided the recipient is certified under it. This has to be checked and documented case by case.

Data processing on your behalf

Every service provider that stores or processes the data on your behalf needs a contract under Art. 28 GDPR. This applies to the platform you use for analysis as well as to its hosting. Datico^® concludes such a data processing agreement with every customer. The data is held in a separate database for each customer on servers in Germany, with no transfer to third countries. Find out more under Trust and security.

Three routes to GDPR-compliant wearable data

Datico^® Wearable Connect connects wearables to the Datico^® Life Hub in three manufacturer-independent ways. Which route fits depends above all on whether the manufacturer cloud is acceptable in the data flow.

	Wearable Connect Cloud	Wearable Connect Bluetooth	File import
Data route	Device, manufacturer app, manufacturer cloud, via API into the Datico® Life Hub	Device via Bluetooth directly to the Datico® Life App, encrypted into the Datico® Life Hub	Device outputs a file that is imported into the Datico® Life Hub
Manufacturer cloud involved	Yes	No	Depends on where the file is created
Account with the manufacturer	Usually for every person	Not required	Depends on the device
Timeliness	Synchronisation with the manufacturer platform	Real time or delayed, also usable offline	After the import
Strength	Uses existing devices and accounts, hardly any effort for participants	Full control over the data flow, no third party in the way	Also connects devices without an interface
Typical use	Prevention, sport, workplace health management with existing devices	Studies with strict regulatory requirements, clinics, safety-critical environments	Historical data, specialist devices

On all three routes, the data ends up in the same structured data foundation, accurately assigned to person and time. The difference lies in how it gets there.

On the cloud route, the manufacturer cloud remains part of the chain. Datico^® adds controlled processing in the Datico^® Life Hub but does not replace the review of the manufacturer’s terms. On the Bluetooth route via the Datico^® Life App, the manufacturer cloud is taken out entirely. The app runs on iOS and Android, automatically assigns the readings to the right profile and transmits them encrypted. For studies, pseudonymisation according to the study protocol is possible.

The Compatible systems overview shows which devices are connected via which route. Polar, for example, is connected both via Polar Flow and via Bluetooth through the Datico^® Life App.

Wearables in companies: data protection in workplace health management

Workplace health management is subject to the strictest standards, because employees are dependent on their employer. For wearables in a company, settle these points before the first device is handed out:

• Voluntariness: participation must not lead to disadvantages or come with hidden incentives that put people under pressure. In Germany, Section 26 of the German Federal Data Protection Act (BDSG) governs employee data protection and sets out criteria for when consent in an employment relationship can be considered voluntary.
• Works council: wearables are technical equipment capable of recording behaviour or performance. Under Section 87(1) No. 6 of the German Works Constitution Act (BetrVG), the works council has a right of co-determination. A works agreement creates clarity for all sides.
• Separate views: the employer receives only aggregated analyses of groups, no individual values. Individual values are seen only by those who provide professional care to the person.
• External service provider: the workplace health programme is often run by an external provider that processes the individual data. This makes it easier to keep the data separate from the employer.

Technically, you implement this separation through permissions. With Roles & Rights in the Datico^® Life Hub, you define who may use which function and see which people and data, down to attribute level. The same rules apply to access via interfaces.

Wearables in studies and research

In studies, the study protocol comes on top of the GDPR questions. For data protection with wearables in studies, these are the main points to clarify:

• Information and consent: participants must understand which data the wearable records, for how long, and who analyses it.
• Ethics approval: the ethics committee also reviews data management. A clear data flow without unnecessary third parties makes the review easier.
• Pseudonymisation: study data is kept separate from identity data. Only authorised persons hold the key.
• Data quality: sampling rate, gaps in recording and assignment to study time points determine whether the data can be analysed.

One example is the MEXT project at the Universität der Bundeswehr München. There, an app developed by Datico^® on the basis of Wearable Connect Bluetooth records data from several Polar wearables around the clock in high resolution, as the data foundation for seizure research. Questionnaires at fixed study time points are added with Smart Forms, which run in the same app. Find out more about research under Datico^® Life Participant.

Wearables in clinics and rehabilitation

In clinics and rehabilitation, it is rarely about the wearable alone. It becomes interesting when the data between two appointments complements what is measured in therapy: recovery, sleep, activity in everyday life. To achieve this, wearable data has to come together with device data, assessments and questionnaires in a single history.

From a data protection perspective, purpose limitation is key here. Data collected for treatment may not simply be used for other purposes. If you want to use wearable data later for quality assurance or research as well, record this from the outset in the consent and in the record of processing activities.

Datico^® sees itself as data-driven decision support: the data gives the professional a better basis, and the professional makes the decision. The professional also controls which results the patient sees in the Datico^® Life App. Sensitive findings can be held back, for example until the next consultation. Read more about clinical use under Datico^® Life Patient.

From readings to decisions

A clean data flow is the prerequisite, but not yet a benefit. Wearable data only becomes valuable once it is classified and condensed:

• Classify: with Reference Sets, every reading is automatically assigned to an evaluation zone, matched for instance to sex and age group.
• Condense: with Index Management, you combine wearable data, diagnostic values and questionnaire results into a score, such as a recovery index. It is recalculated as soon as new data is available.
• Display: approved results appear for the professional in the Health & Performance Workplace and for the person in their care in the Datico^® Life App.

This also has a data protection side: the more condensed the data, the fewer individual values need to go to people without a professional care role. An index is often enough for management and reporting, while the raw data stays with the specialists.

Checklist: introducing wearables in compliance with the GDPR

These points should be clarified and documented before you start.

1. Define the purpose: what is each piece of data needed for? Collect only what is necessary for it.
2. Determine the legal basis: Art. 6 and Art. 9(2) GDPR, matched to the area of use and agreed with the data protection officer.
3. Choose the device and route: is a manufacturer cloud acceptable? If not, choose a device with a Bluetooth connection and no cloud requirement.
4. Check third countries: where are the manufacturer, cloud and platform based? Document the basis for every transfer outside the EU.
5. Conclude contracts: a data processing agreement under Art. 28 GDPR with every service provider processing data on your behalf.
6. Carry out a data protection impact assessment: under Art. 35 GDPR, where a high risk is likely.
7. Design the consent: clear wording, separated by purpose, demonstrable and revocable.
8. Define roles and rights: who sees individual values, and who sees only aggregated data?
9. Draw up a deletion concept: retention periods for raw data, analyses and records of consent.
10. Clarify co-determination: involve the works council within the company.
11. Plan the analysis: which metrics, references and reports do you need, and who sees them?

If you would like to go through these points for your project, talk to us in a personal initial consultation. The joint webinar by Polar and Datico^® shows what the two routes look like in practice with Polar wearables. You will find the recording and the next session on 20 January 2027 under Webinars.