These devices can spot issues early and support independence, yet many sit outside traditional health privacy rules. We explain the real risks, new EU protections, gaps in the US, and steps to stay in control.

Why this matters now

AI wearables are moving from step counters to tools that track heart rhythm, sleep and movement continuously. That can help spot problems earlier and support everyday function. It also creates intimate data trails. Attackers target health information because it is valuable, and recent US breaches affected very large numbers of people with high costs per incident. Older users face added risks when accessibility and usability are not built in, since confusing design can lead to unsafe defaults or oversharing.

What your wearable really knows

Even simple signals can reveal more than you expect. Patterns in gait, activity or sleep can allow AI to infer sensitive issues such as cognitive decline or depression risk. These inferences can go beyond what you thought you were sharing, raising questions about consent and whether that data is truly necessary. Treat your wearable data as medical grade, whatever the marketing label says.

What the laws actually cover

  • In the US, HIPAA protects data held by specific healthcare entities. Many consumer wearables fall outside it, even when they collect health-like biometrics, because coverage depends on who holds the data and whether the product makes medical claims.
  • In the EU and UK, GDPR treats health and biometric data as special category data. That means services must get explicit consent, build privacy by design and by default, and assess high risk processing.
  • The EU AI Act took effect in August 2024. AI used for medical purposes is classified as high risk, with phased compliance through 2027. It adds duties on data quality, transparency, human oversight and risk management that go beyond existing device rules.
  • Across regions, laws rarely address elderly-specific needs such as fluctuating decision-making capacity or clear boundaries for caregiver access.

If you travel or live across jurisdictions, your rights and a company’s obligations can change. In the EU and UK you can typically access, correct, delete or object to processing. In the US, protections are more fragmented, so product controls matter more.

Practical steps to take today

  • Ask up front: Who holds my data, where is it stored, and who can see it, including caregivers and third parties?
  • Prefer products that offer granular, plain-language consent, easy data export and deletion, and multi-factor authentication. On-device or privacy-preserving processing is a plus when available.
  • Set strong, unique passwords for accounts and enable multi-factor authentication.
  • Review app permissions. Turn off what you do not need, such as location or microphone. Recheck after updates, since defaults can change.
  • Limit sharing to the minimum useful data types. If fall alerts are the goal, you may not need continuous location history.
  • Secure the phone that manages your wearable with a passcode or biometric lock.

If you share data with caregivers or clinicians

Discuss access early and write it down. Use role-based permissions if offered, restrict sharing to what is necessary, and review regularly.

  • For cognitive changes, use elder-friendly consent aids such as plain-language summaries or audio prompts. Designate a trusted proxy and document boundaries.
  • When a clinician uses wearable data, ask whether any AI is guiding decisions, how high stakes recommendations are reviewed by a human, and how the service monitors algorithmic bias.

Crossing borders and changing rules

If you are in, or travelling within, the EU or UK, you generally have strong rights to access, correct, delete and object. Use them. In the US, where protections vary, rely more on device and app controls, careful sharing and strong authentication. In parts of Asia-Pacific, rules are evolving and cross-border transfers may be restricted or unevenly enforced, so check whether your data leaves the country and on what terms.

Red flags worth noticing

  • Vague or bundled consent that does not let you choose data types separately.
  • No option to export or delete your data.
  • No multi-factor authentication or weak default passwords.
  • Caregiver access that is all-or-nothing rather than role based.
  • Accessibility gaps that make safe choices hard to find.

Good tools exist, and new EU requirements are raising the bar for medical AI. Until protections catch up everywhere, informed choices and a few careful settings can keep the benefits while reducing the risks.

Find out more

Image: Photo: SHVETS production / Pexels