“Privacy compliant” is not the same as private
Journal · 2026-09-15 · R. Klug · All notes
Read in: Deutsch · Français · Español · Italiano
Nearly every health app can truthfully say it: GDPR compliant, privacy policy in place, your data protected. All of it can be accurate — and none of it answers the question you actually have. Compliance describes a process: there is a policy, there is a lawful basis, there is a way to request deletion. It does not tell you where your heart data physically lives tonight, how many copies exist, or who will own the company holding them next year.
Try to answer three questions
Pick any cloud-connected wearable you use and try to answer, precisely:
- Where is last night stored, right now? The honest answer is a chain: the vendor’s cloud, in a region you may or may not be told; the subprocessors behind it — hosting, analytics, support tooling, content delivery — listed on a page that can be amended; backups on their own schedule. Each link is legitimate. The sum is that “where” has no findable answer.
- Who owns the company? Ownership is a moving fact. Startups are acquired, parent companies sit in other jurisdictions, investors change — and years of your physiology transfer with the assets, under whatever terms then apply. Ask anyone whose fitness platform was bought by a larger company: the data didn’t move, but everything around it did.
- Which law applies? Jurisdiction follows servers and corporate structure, not you. Data recorded on your wrist in Munich can be governed, in practice, by the legal reality of wherever the infrastructure and the owning entity sit — and that can change without any change in your app.
None of this requires bad intent from anyone. That is precisely the point: even with every company involved acting in good faith, you cannot trace your own data. A consent checkbox summarises a system too complicated to audit from the outside — and “private” has quietly come to mean “handled according to a document” rather than “known to be in one place.”
What “private” should mean
The standard we hold ourselves to: data is private when you can name every copy. Not trust, not certification — enumeration. Most cloud architectures cannot meet that standard — not from ill will, but because they create copies faster than any document can track them.
ampulse and Polar: the direct connection
This is why ampulse works differently, and the description fits in three sentences. Your Polar sensor connects directly to ampulse on your iPhone. Your nights and sessions are recorded there and belong to you. No account stands between you and your own heartbeat, and nothing is shared unless you share it.
That’s the whole promise, and it makes the three questions answerable for the first time: where is last night? On your phone, and in any export you made. Who owns the company holding it? For your data, the question doesn’t arise. Which law applies? With no third party holding your nights, there is no distant jurisdiction left to trace — the question shrinks to the device in your hand. Enumerable copies: the standard, met.
The hardware side of the pairing has its own weight: Polar has built heart rate instruments in Finland since 1977, and the Loop and H10 are sensors, not subscriptions. Sensor, phone, your files. How this compares with the cloud wearables in detail — and everything else about the record is on the privacy section of the product page.