Recommended Free Tools
Protecting health data in a wearable app takes more than changing a phone setting: review what the app can access and share, secure its account, keep the app and device updated, and understand the service’s own retention and deletion rules. In the United States, a health app is not automatically covered by HIPAA; coverage depends on the organizations and roles involved.
Start by checking what the app can access
Open the app’s privacy and sharing settings and review the health categories it can read or write, connected accounts, and any access it has to share information with other apps or people. Turn off access that is not needed for features you use. Check again after connecting a new wearable, health service, or account.
As an Amazon Associate I earn from qualifying purchases.
On Android, Health Connect provides a place to review and revoke connected-app permissions. Follow Google’s instructions in Manage connected apps in Health Connect; the exact options depend on the apps and data categories involved.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteRevoking permission prevents future access through that connection, but it does not necessarily remove information the app already copied to its own servers. For that, check the app’s deletion process.
#1 Best Overall
- What You Get - A 12-month membership, WHOOP 5.0 device, a SuperKnit band, and a waterproof* Wireless PowerPack. Choose from a range of band and accessory combinations, and add a waterproof Wireless PowerPack for on-the-go charging.
- HSA/FSA Eligible - All 12-month WHOOP memberships and battery packs qualify for HSA/FSA reimbursement.
- Screenless, Distraction-Free - No screen, no buzzing notifications. WHOOP focuses entirely on your health and performance, with up to 14+ day battery life so you can wear it around the clock.
- Healthspan with Pace of Aging - Understand how your daily habits shape long-term health. Healthspan measures your WHOOP Age and Pace of Aging so you can take science-backed action to slow biological aging and extend your prime years.
- 24/7 Health Insights - WHOOP monitors your heart rate every second of every day, delivering personalized Sleep, Strain, Recovery, VO2 max, Menstrual Cycle, and Heart Rate insights along with a Real-time Stress Monitor that pinpoints your stressors and shows how your body responds in the moment, so you can make better decisions about training, rest, and daily performance.
Secure the account and keep its software current
- Use a unique, strong password for the health-app account. Reusing a password exposes the account if another service suffers a breach.
- Turn on multi-factor authentication (MFA) if the app or its sign-in provider offers it. A hardware security key is an option only when that account supports it; no single sign-in measure prevents every kind of data exposure.
- Install updates for the wearable, phone operating system, and companion app. Updates can address security vulnerabilities, so avoid leaving supported devices and apps out of date.
The FTC’s Mobile Health App Developers: FTC Best Practices, published in December 2022, recommends practices including appropriate authentication, security updates, encryption, and limiting data collection and access. These are useful standards for evaluating a service, not a guarantee that every app follows them.
Read the privacy notice for the data lifecycle
Look for clear answers to these questions in the privacy policy and in-app notices:
Rank #2
- Simple & Screen-Free Design – Easy to use and ultra-lightweight, comfortable for all-day wear without the distraction of a screen
- Powerful Health Monitoring – Accurately tracks heart rate, blood pressure, blood oxygen, HRV, sleep quality, and stress levels to help you better understand your body
- 100+ Sports Modes – Supports a wide range of fitness activities with precise tracking, making it your reliable companion for workouts and daily movement
- Ultra-Long Battery Life – Just 2 hours of charging powers up to 47 days of standby, so you can focus on your goals without constant recharging
- No Subscription Required – Enjoy all features with the free app, fast syncing, and easy Bluetooth connection—no hidden costs
- What health and device information is collected, and why is each item needed?
- Which companies or other parties receive it, and can sharing be turned off?
- How long is information retained, and what happens when you close the account?
- How can you export or delete records, including information already uploaded?
Deleting the app from your phone or disconnecting it from a platform may not delete records held by the service. If you want records erased, look for a separate account or data-deletion request and follow the provider’s stated process. The FTC advises health-app developers to explain collection, use, sharing, and user choices clearly; its guidance also emphasizes minimizing data collected and retained.
HIPAA does not automatically cover a wearable health app
HIPAA applies to covered entities and their business associates, not to every company that handles medical or wearable data. An app’s role and its relationship with a healthcare provider, health plan, or another covered organization matter. HHS provides scenarios to help assess when a mobile-app developer may be acting as a business associate in Resources for Mobile Health Apps Developers.
Rank #3
- What You Get - A 12-month membership, WHOOP MG device, a SuperKnit Luxe band, and a waterproof* Wireless PowerPack. Choose from a range of band and accessory combinations, and add a waterproof Wireless PowerPack for on-the-go charging.
- HSA/FSA Eligible - All 12-month WHOOP memberships and battery packs qualify for HSA/FSA reimbursement.
- Screenless, Distraction-Free - No screen, no buzzing notifications. WHOOP focuses entirely on your health and performance, with up to 14+ day battery life so you can wear it around the clock.
- Heart Screener with On-Demand ECG - Take an ECG reading from your wrist in seconds to check for signs of atrial fibrillation. Heart Screener gives you a medical-grade view of your heart rhythm whenever you need it.
- 24/7 Health Insights - WHOOP monitors your heart rate every second of every day, delivering personalized Sleep, Strain, Recovery, VO2 max, Menstrual Cycle, and Heart Rate insights along with a Real-time Stress Monitor that pinpoints your stressors and shows how your body responds in the moment, so you can make better decisions about training, rest, and daily performance.
If an app advertises itself as “HIPAA compliant,” ask what that claim means for your use: Is the app supplied by a provider or plan, and what role does the app company play? A privacy promise and legal coverage are separate questions. FTC guidance says companies must be truthful about privacy and security claims, while applicable legal obligations depend on the service and its circumstances. HHS discusses consumer-health information and relevant protections in Collecting, Using, or Sharing Consumer Health Information?
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Some apps outside HIPAA may still have FTC obligations
The FTC’s Health Breach Notification Rule applies to certain personal health record (PHR) vendors, PHR-related entities, and service providers. A PHR is an electronic record of identifiable health information that can draw from multiple sources and is managed, shared, and controlled by or primarily for an individual. FTC guidance says an app that collects consumer information and can sync with a fitness tracker is probably a PHR vendor. Read the FTC’s Complying with FTC’s Health Breach Notification Rule for the scope and examples.
Rank #4
- Google Fitbit Air is the unbelievably comfortable, exceptionally smart way to transform your health[1]; and Google Health brings together effortless tracking and adaptive coaching to help make the most of your everyday[2]
- Unlock more with Google Health Premium: With a premium membership, get personalized coaching that’s built with Gemini and adapts to your life[2]; get a 3-month trial at no cost to you[5] (Google Health Premium subscription sold separately)
- Comfortable fit - One Size Tracker (130-210 mm): The lightweight, micro-adjustable fit sits comfortably and quietly, so you can wear Google Fitbit Air through work, play, and sleep; advanced sensors and new algorithms power more accurate, precise health tracking, 24/7[1]
- Designed for every occasion: With no screen to distract you or disrupt your style, your tracker moves seamlessly from bracelet to workout band to sleep band, and you can change looks in seconds – just press the pebble in, click, and go
- Long battery life: Google Fitbit Air’s battery lasts up to a week, and fast charging gets you one day of battery life in just five minutes[6,7]
Amendments to the Rule clarified its application to health apps and similar technologies and took effect July 29, 2024. Depending on the entity and incident, the Rule can require notice to affected consumers and the FTC, and in some cases the media, after a breach involving unsecured identifying health information. The FTC explains the rule’s basics in Health Breach Notification Rule: The Basics for Business.
These are U.S. federal rules. State privacy laws and laws in other countries may add requirements; the rules applicable to a particular app depend on the service, organizations involved, and location.
Use these checks when choosing or reviewing an app
Compare services on the factors that affect how much control you have and who handles your records:
- Which health data the app collects, and whether each category is necessary for its features.
- Whether you can control platform permissions separately from the app’s sharing settings.
- Whether third-party sharing is explained and optional.
- Which account-security options are available, including MFA.
- Whether retention, export, and deletion controls are clearly described.
- Whether the app and wearable receive security updates and remain supported.
- Who operates the service and whether a provider or health plan is involved.
These checks can help you assess privacy and security practices, but no permission setting or security feature can guarantee that sensitive records will never be exposed.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
