Wearable biometric telemetry: technical tear-down and data supply chain

01 — The Instagram Post and That Unpleasant Feeling

I'm scrolling Instagram. Sponsored: Oura ring. ‘Monitor your sleep, heart rate, stress, temperature.’ Nice claim. Nice to scroll past, by the way.

Then a non-sponsored post — an Italian creator — gives a clean, accurate summary: biometric data collected continuously, device not certified as a medical device, possible Palantir collaboration. The ‘Palantir’ part trips the conditioned reflex of an ex-threat-intel consultant: ‘okay, how true is this?’

I search. I find the Snopes fact-check. ‘The rumor that Oura ring shares health data with Palantir is an exaggeration.’ I calm down for two seconds. Then I read the rest. [1]

I open Oura's tech documentation. It's public, anyone can read it. I figure it'll take an hour. It becomes three days. Here we are.

01.5 — Eight Years Ago, in a Store, I Saw a Ring (and Thought: We're Gonna Fall for This)

Insider disclaimer: I've been interested in this topic since before it went mainstream. In 2018 — eight years ago, for those counting — I first saw a smart ring on someone's wrist (well, finger). It was a Token Ring, from a New York startup founded in 2016 by Melanie and Steve Shapiro, ex blockchain crypto-people who pivoted to wearable hardware. Pre-sale July 2017 ($249 brushed silver, $299 rose gold or black rhodium). First shipments December 2017.

Token Ring specs, year 2017, for the historical record:

• NFC + Bluetooth + secure element certified EAL5+ (same standard as EMV banking smart cards).
• Capacitive fingerprint sensor on the inner ring band — continuous authentication, authenticated when worn, dropped on optical removal-sensor trigger.
• Launch partners: Mastercard, Visa, Microsoft (Windows Hello), HID Global (enterprise access control), FitPay, FIDO Alliance. Tap-to-pay in 15 million stores.
• Stated use case: replace wallet, house keys, corporate badges and passwords. No health biometric sensors — only identity and payment.

Note the ideological difference vs Oura: Token had a single biometric sensor (the fingerprint) and existed to identify you, not measure you. It was an ‘authenticator’, not a ‘health tracker’. Token never scaled in consumer (finger-fitting issues, high price for perceived return), and in 2023 it officially pivoted to the enterprise/SOC2 market with the TokenCore rebrand — today it sells biometric rings to banks, hospitals and critical infrastructure as anti-ransomware MFA. Nearly 200 organizations on the waitlist at relaunch.

02 — Anatomy of a Ring

Before we talk about Palantir, let's look at what we're actually putting on our finger. The Oura Ring 4 (the current model, late-2024 launch) is a small biomedical computer disguised as jewelry.

2.1 — The Hardware Stack

┌─────────────────────────────────────┐
│   OURA RING 4 — Internal Topology   │
├─────────────────────────────────────┤
│  [PPG IR×8] [PPG R×4] [PPG G×6]     │  ← 18 optical paths
│       │         │         │         │
│       └─────────┴─────────┘         │
│              │                      │
│           [SoC + DSP]               │  ← onboard signal proc.
│              │                      │
│       ┌──────┼──────┐               │
│       │      │      │               │
│  [NTC sens] [Accel] [BLE 5.0]       │  ← skin temp, motion, radio
│   ±0.1°C    3-axis   GATT           │
│              │                      │
│           [Battery]                 │  ← 7-day claim
└─────────────────────────────────────┘

In order of forensic interest:

• Multi-wavelength PPG — photoplethysmography. Eighteen optical paths in the Ring 4: red and infrared LEDs for SpO2, green and infrared LEDs for HR and HRV. Infrared penetrates deeper than the standard green light used by Apple/Fitbit. Sampling 250 Hz — 250 measurements per second. For reference: a stock Apple Watch samples far less often in continuous monitoring.
• NTC (Negative Temperature Coefficient) — skin-contact thermometer. 0.1 °C resolution. Continuous, not spot-check. This is the sensor that enabled UCSF's TemPredict study in 2020.
• 3D accelerometer — measures motion, restlessness, and feeds the sleep-stage classifier. It's also, just out of curiosity, a sensor that lets you infer steps, activity type, posture, and — with a bit of work — recognize specific motion patterns. Just throwing that out there.
• BLE 5.0 + GATT — the protocol. Community has already reversed it: there's a GitHub repo (ringverse/protocol) documenting characteristic UUIDs and the request/notification flow. Nothing proprietary enough to stay a mystery longer than six months after Ring 4 launched.

2.2 — The Software Stack

The ring does onboard preprocessing (local DSP), then syncs over BLE with the phone app. The app compresses and ships the data to the Oura cloud. From there, if you opted in, data can flow to third parties (Apple Health, Google Fit, Strava, partners of their ‘Personal Health Data Platform’).

The public API lives at https://api.ouraring.com/v2. OAuth2 Bearer token in Authorization: Bearer .... TLS 1.2+ in transit, AES-256 at rest. Modern standard, nothing scandalous crypto-wise. What's interesting is the granularity of what comes out:

# Example real call to the Oura v2 API
# (sample from official docs + community Python SDK)

GET /v2/usercollection/sleep?start_date=2026-05-20&end_date=2026-05-23
Host: api.ouraring.com
Authorization: Bearer eyJhbGciOiJSUzI1NiIs...

Response:
{
  "data": [
    {
      "id": "8f9a...4e",
      "day": "2026-05-22",
      "bedtime_start": "2026-05-22T23:14:00+02:00",
      "bedtime_end":   "2026-05-23T07:02:00+02:00",
      "average_heart_rate": 54.3,
      "average_hrv": 47,
      "average_breath": 14.2,
      "temperature_deviation": -0.18,
      "temperature_trend_deviation": 0.04,
      "deep_sleep_duration": 4980,   // 83 min
      "rem_sleep_duration": 5760,    // 96 min
      "light_sleep_duration": 14820, // 247 min
      "sleep_score_delta": 2,
      "readiness_score_delta": -3,
      "heart_rate": { /* time-series 5-min granularity */ },
      "hrv":        { /* time-series RMSSD per epoch */ },
      "movement_30_sec": "11211223211..."   // encoding per epoch
    }
  ],
  "next_token": null
}

Translation: for every night you sleep wearing the ring, there's a JSON record nearly a kilobyte long describing your autonomic nervous system at 30-second resolution. HRV is effectively a proxy for parasympathetic tone. Skin temperature is a proxy for hormonal and inflammatory cycles. Sleep-time respiration can reveal apnea, anxiety, various syndromes. Movement is your physical presence/absence in the home at 30-second resolution.

And this is just the ‘sleep’ endpoint. Living alongside it:

The last one is the most interesting for profilers. Users tag voluntarily. ‘Took a Xanax yesterday.’ ‘Period day 3.’ ‘Had sex.’ ‘Drank.’ ‘On vacation.’ They do it because the app politely asks them to, in order to ‘correlate with your score’. And those tags live in the same database as the physiological metrics, indexable, exportable, statistically derivable.

03 — The Palantir Case: True, False, and «True But Not How You Think»

Let's cut to the chase. Three publicly verifiable facts:

3.1 — Oura + DoD

Since 2019 Oura has held a contract with the U.S. Department of Defense. Initially a study program. It grew. In August 2025 Oura opened a ‘made in Texas’ manufacturing facility to ‘better serve DoD needs’. Source: official Oura blog, press release. [2]

3.2 — Oura + Palantir (the subtle truth)

Oura uses Palantir's ‘FedStart’. FedStart is a PaaS that lets software vendors operate in a DoD-pre-accredited environment at ‘Impact Level 5’ (IL5), a tier required to handle national security data. It is — literally — Palantir-as-a-Compliance-Layer. Without FedStart, Oura would have taken years to get the same accreditation. [3]

In other words: the Palantir deal is a ‘I need your security lift’ deal, not a ‘I'm selling you my users' data’ deal. Snopes is right on this specific point. Oura even said — September 2025, responding to the backlash — that they ‘haven't yet started sharing data with the DoD through Palantir’. Note the ‘haven't yet’. That's the tense of a company that intends to start, not of one that has denied the possibility.

3.3 — What Palantir Does the Rest of the Day

This is the part Snopes' ‘technically true’ fact-check completely ignores. Let's look at the other 95% of Palantir's 2025 business:

• ICE — ImmigrationOS: $30M contract, April 2025, prototype by September 2025, runs through September 2027. The platform aggregates data from the IRS, Social Security, passport databases, and automatic license plate readers to build profiles of deportation targets. Declared functions: ‘identification and apprehension’, ‘near real-time visibility on self-deportations’, ‘deportation logistics’. Translation: algorithmic optimization of the expulsion of human beings. [4]
• IDF — strategic partnership January 12, 2024: three months into the Gaza offensive, Palantir and the Israeli military announce a deal ‘in support of war-related missions’. The company holds its first board meeting of the year in Tel Aviv. Deployed tech: Lavender — an AI database that assigns each Palestinian a 1-100 ‘threat score’ by crossing phone metadata, social media, movement patterns, satellite data. Error margin admitted by the military itself: ~10%. Number of subjects flagged as ‘potential militants’ in early phases: more than 37,000. [5]
• Lebanon, September 2024: Israel also relied on Palantir during the exploding-pagers-and-radios attack. Confirmation comes from multiple sources, including Business and Human Rights Centre.
• Open letter from 13 former Palantir employees, May 2025: titled «The Scouring of the Shire» (yes, Tolkien). They warn the ‘original ethical guardrails — designed to prevent discrimination, disinformation, and abuses of power — are being dismantled’. Translation: the engineers stopped believing the company's narrative. When your engineers send you open letters with Tolkien references, it's time to worry.

3.4 — The IDF Triad: Lavender, Gospel, Where's Daddy?

Lavender doesn't work alone. In Italy this is barely discussed, but the IDF system is a three-piece architecture documented by Yuval Abraham's investigation for +972 Magazine and Local Call (April 2024), based on six sources inside Israeli intelligence:

The flow: Lavender produces names, Where's Daddy? geolocates them in real time, Gospel picks the moment and the building. Error rate admitted by the IDF itself: 10% — one in ten flagged is a false positive. Across 37,000 targets in the first six weeks after October 7, the arithmetic is simple. Important technical note: Palantir explicitly stated that ‘the Israeli systems are independent of its technology and existed before the 2024 partnership’. Technically true. What the 2024 partnership brought is the data integration layer — the same thing Palantir sells to the DoD, to ICE, and now to Oura. They don't run the stack, but they hold it together.

3.5 — The 8VC Ecosystem: What the Italian Press Isn't Telling You

Here we enter the piece that — to the best of my research — has had zero coverage on any of the major Italian tech outlets. The ‘Palantir + Oura’ line is a spin-off of a far larger ecosystem, informally known as the defense-tech belt:

• Joe Lonsdale — Palantir co-founder in 2003, founder of 8VC (venture fund, ~$6B AUM). 8VC was among the first investors in Anduril Industries (defense AI / drone autonomy, founded by Palmer Luckey, ex-Oculus, post-firing from Meta). Anduril in 2025 is valued at ~$28B.
• TITAN — next-gen battle system developed by Palantir + Anduril + Northrop Grumman. The stack that integrates sensors, AI targeting, and command-and-control. Same model as FedStart, different scale.
• Kinetica — Israeli VC fund launched 2025, raised $150M. Joe Lonsdale on the advisory board. Mandate: fund Israeli defense-tech startups on the Anduril model. Berkeley Political Review titled its February 2026 analysis ‘Lavender AI, Palantir, and the Israelification of Homeland Security’.
• Microsoft Azure — in 2025 international press (Decoder, Guardian) reveals Azure hosted parts of the military targeting in Gaza. Microsoft fires its Israel chief. The stack is never ‘just’ one vendor's.

Translation: the Oura/Palantir deal isn't a bizarre exception of a wellness startup that sold itself to the Pentagon. It's a coherent piece of a larger infrastructure in which consumer wellness, defense AI, identity management, and immigration enforcement share the same capital pool, the same founders, the same compliance platforms, and — increasingly — the same clouds. Snopes is right about the bytes. About the ecosystem, it's blind.

04 — What Oura's Data Is Actually Worth

OK, there's an ethical-political problem. But maybe the device is clinically exceptional and so it's worth it? Let's see. The two most serious independent validations are:

4.0 — Prequel: Mike Snyder, Stanford 2017 (the Real Antecedent)

When the press talks about TemPredict as ‘the moment wearables predicted COVID’, it forgets an interesting historical detail. Three years before UCSF's TemPredict, Michael Snyder, chair of Stanford's Department of Genetics, published (January 2017) a PLOS Biology paper showing that anomalous heart rate and skin temperature variations from a smartwatch could anticipate infection diagnosis by days. Snyder himself self-diagnosed Lyme disease wearing seven biosensors simultaneously (only nerds and apocalypse survivors do this, apparently).

UCSF's TemPredict in 2020 is therefore not a scientific revolution signed by Oura: it's the application of an already-documented public hypothesis to specific hardware. I'm pointing this out because in Italy the story often gets told as ‘the ring that sensed something no one had ever seen’. False: Snyder saw it with a Fitbit, and before him decades of infectious disease epidemiology saw it.

4.1 — The Tokyo Study (96 participants, 421,045 epochs)

Published 2024, Sleep Medicine (Elsevier). Compares Oura Ring Gen3 with OSSA 2.0 (Oura Sleep Staging Algorithm 2.0) against multi-night ambulatory polysomnography. PSG is the clinical gold standard.

Sounds great, right? ‘94% sensitivity’ for sleep detection. Fine. But the 73% specificity is the real problem: it means 27% of the time you're actually awake, the ring thinks you're asleep. Practical translation: the score you see in the morning is padding your sleep. If you spent 40 minutes lying still staring at the ceiling thinking about your mortgage, the ring counts it as light sleep — because PPG says ‘low HR, body still’ and the accelerometer is silent.

The study also notes a systematic REM underestimation of 4-5 minutes per night. Over 30 nights that's an hour and a half of REM that doesn't exist in your charts. REM is precisely the stage most correlated with memory consolidation, emotional regulation, complex dreaming. Statistically the one the ring sees worst.

4.2 — TemPredict, UCSF, 2020 — The Pandemic Boom

The most powerful marketing piece Oura has ever had. 2,000 healthcare workers wear the ring. Across 50 confirmed COVID cases, Oura's data show skin-temperature deviation in 76% of them, on average 2.75 days before a positive test. Press: ‘the ring that predicts COVID!’. [6]

What the press never highlighted:

• 76% sensitivity = 24% false negatives. Out of 50 cases, 12 people had COVID and the ring flagged nothing. If you use this to decide whether to go to work, you're wrong 1 in 4.
• Specificity not prominently reported. How often did the ring give a false fever alert? Retrospective study: the analysis was done knowing who had had COVID. That's different from ‘predicting’ in real time.
• There is no clinically certified infectious-disease detection feature. The app tells you ‘temperature above baseline’, not ‘you have COVID’. You make the interpretive leap — which is exactly the leap the FDA won't let them make.

Summary: they want the medical-device license without taking the road test. For now, the status is clear: wellness device, not medical device. Apple Watch has FDA clearance for sleep apnea and hypertension. Oura doesn't.

05 — Orthosomnia: When the Algorithm Replaces the Body

There's a new diagnostic category, coined by sleep doctors: orthosomnia. From Greek ‘orthos’ (correct, straight) + ‘somnia’ (sleep). It's insomnia induced by obsessing over getting the ‘correct’ sleep according to the tracker.

Documented clinical dynamic: the person wakes up rested. Opens the app. Score: 68/100. ‘Suddenly feels worse.’ The day becomes ‘a bad-sleep day’. In the evening, they go to bed early, anxious to recover. Anxiety to recover fires the sympathetic. HRV crashes. Tomorrow's score will be worse. Loop.

The Sleep Foundation has a dedicated page. Calm has an article. GoodTherapy talks explicitly about ‘wearable obsession’. A 2024 cross-sectional study tried to estimate prevalence in the general population: not negligible. Oura's own blog has a post titled ‘Stressed About Sleep Data? Orthosomnia, Explained’. When the company that sells the ring has to publish an article explaining how to handle ring anxiety, there's something to discuss.

06 — The Cost/Benefit Math (The Real Question)

Let's lay the numbers down. You paid €399 for the ring plus €5.99/month subscription (yes, post-Ring-4 you pay a subscription for advanced analytics). Claimed vs verified benefits:

Now the hidden cost. Not the subscription. The cost without a list price:

1. You contributed to a training set that algorithmizes the human body. Even if they don't ‘sell’ your data, they use it to improve prediction models that become features, that become paid functionality, that become B2B services for hospitals, insurers, employers.
2. You normalized continuous biometric surveillance. Five million people voluntarily decided their nighttime breathing pattern is something that belongs in a commercial cloud. Five years from now, when health insurers ask for that same data to underwrite a policy, the ‘but it's private’ argument will be sociologically weaker.
3. You (proportionally) financed opening a DoD manufacturing facility. Oura makes a margin on your purchase, invests that margin into production capacity ‘for the DoD’. It's legal, publicly stated, and a fact. If you're aware of it, your call. If you weren't, you are now.

07 — The Class Actions Italian Press Isn't Covering

While Italian press debates whether ‘Snopes debunked the Palantir-Oura rumor’ or not, in the United States Oura is the subject of at least two consolidated class actions and a federal appeal already decided. Let's look.

The ‘In re Oura Health Privacy’ case is the heavy hitter. Allegations — not proven yet, obviously — concern the alleged sharing of name, email, gender, height, weight, women's health data, sleep, strain, recovery metrics with third-party advertisers. If confirmed, they would directly violate the same privacy policy Oura advertises on its homepage («we do not sell or share your data with third parties»). Class certification is being fought right now.

7.1 — Bonus: the CEO isn't from any medical device background

Tom Hale, Oura CEO since March 1, 2022. Resume: Adobe → Macromedia → Linden Lab (yes, Second Life) → HomeAway (vacation rentals) → Momentive/SurveyMonkey (2018 IPO). Zero medical device, clinical diagnostics, or healthcare experience. Pure consumer-product / enterprise-SaaS background, with a historical focus on growth and M&A. He's a product CEO, not a science CEO. Fair. But also useful to read subsequent company choices (subscription model, anti-FDA lobbying, DoD manufacturing) not as ‘scientific’ but as ‘growing a SaaS platform’.

08 — Verdict

I'm not going to write ‘don't buy the ring’. That's not the point. If you have a specific need — endurance athlete tracking HRV to dial in training load, someone with disturbed sleep patterns who wants a baseline, a researcher doing self-quantification — Oura is one of the best tools on the market for the price. The multi-channel infrared PPG at 250 Hz is objectively good engineering. The NTC at 0.1 °C is objectively sensitive. The sleep-stage algorithm is objectively better than direct competition.

What's harder to defend is the mass diffusion of a biomedical sensor as if it were a fashion accessory. Five and a half million people do not need to track HRV at 30-second resolution to optimize their metabolism. Five and a half million people need to sleep more, get up earlier, drink less, and put the phone down before bed. None of those things requires a ring. All of them require listening to your body.

And while five million bodies feed a dataset, the same compliance-as-a-service vendor that made it possible to sell that data to the DoD is the one selling ImmigrationOS to ICE and Lavender to the IDF. Not because your data runs through it. Because the infrastructure that normalizes continuous monitoring of bodies is the same. Only the body being monitored — and which algorithm reads it — changes.

I don't have a clean answer. I have a ring in a drawer, bought years ago, that I've stopped wearing for a few months now. Not for ideology. Because I noticed I slept worse when wearing it. Probable reverse causation. Probable bias. Probably I'm looking for ex-post justification. Probably, yes.

But then I wake up, don't look at it, and feel fine. That's raw data, not peer-reviewed, and according to Oura it would have been a score: 84.

 _________________
|  oura.ring.4.exe |
|   process killed  |
|   uptime: paused  |
|   you: alive      |
|___________________|
        |||
    ___/   \___
   /           \
  (    🜂        )
   \___________/