Oura vs Samsung

Oura collects a lot of sensitive health data to run the service, but they don't sell it, give you real control over it, and are clearer than most about what they do with it.

Samsung Australia collects an unusually wide sweep of data for a hardware company — IMEI numbers, MAC addresses, GPS location, voice commands sent to third-party servers, health metrics from Galaxy devices, contacts lists, browsing behaviour, and financial details. Data is shared with affiliates, business partners (including wireless carriers who can independently use it for promotions), and service providers, and is transferred to up to 16 countries including South Korea, China, and India. The policy acknowledges those countries may have weaker privacy protections than Australia, and users effectively waive the right to demand overseas recipients comply with Australian law just by using the services. Some controls are decent — a resettable Advertising ID, a 30-day access response window, and Samsung Pay that doesn't log transaction details — but retention periods are entirely vague, no security certifications are named, and there is no breach notification commitment.