Imagine an email from Aditya Birla Health Insurance: you’ve earned ₹2,000 in cashback this quarter, because your Fitbit showed you averaged 8,000 steps a day. It feels like a reward. It is also a window. The same data that earned you that cashback told your insurer how sedentary you were in December and how poorly you slept in November. If you’d had a low-activity month, it might have quietly informed how your renewal was priced.
That’s the deal. The cashback is real. So is the surveillance.
What fitness trackers actually collect
Modern wearables are not pedometers. The list of what a current Fitbit Sense or Apple Watch Series 9 records looks nothing like counting steps.
Heart rate is measured continuously — not just during workouts, but 24 hours a day. Resting heart rate, elevated heart rate during rest, heart rate variability (HRV). That last one is a proxy for stress levels and nervous system state. A Fitbit can tell, over time, whether your baseline stress is trending upward.
Sleep is tracked in stages (light, deep, REM) using movement and heart rate data. Miss several nights of deep sleep in a row and it’s logged. An insurer with access to that record can infer recovery patterns, shift work schedules, and alcohol use. Heavy drinking disrupts sleep stages in characteristic ways. That is far more than any self-reported questionnaire reveals.
Blood oxygen (SpO2) appears on newer Fitbits, including the Sense, Charge 5, and later models. Low SpO2 readings at night can indicate sleep apnea — a condition that affects premiums when disclosed and, when not disclosed, constitutes a material omission.
ECG readings are available on Apple Watch Series 4 and later, and the Fitbit Sense. They can detect atrial fibrillation, a heart rhythm irregularity that, in the wrong hands, could affect your insurability.
Menstrual cycle tracking is built into newer Fitbits and the Samsung Galaxy Watch. Regularity, irregularities, predicted fertile windows: extremely personal data, stored on servers. The privacy risks of period tracking data apply here too.
All of this is generated passively. You don’t submit a form. You wear a device and it produces a continuous record of your physiology.
Google now owns Fitbit
Google completed its acquisition of Fitbit in January 2021 for $2.1 billion. The EU approved the deal only after extracting commitments from Google. One was a pledge not to use Fitbit health and wellness data for Google advertising for ten years from the approval date. That deadline is 2030. After that, the commitments expire and Google’s obligations are less clear.
What Google has done in the meantime is integrate Fitbit into Google Health. Your health data now lives inside the same company that holds your search history, location history, Gmail, and Google Pay transactions. Your steps and sleep data are part of that picture — connected to everything else Google knows about you in ways that are difficult to fully audit.
Google maintains that it doesn’t use health data for ads. The question is whether that holds past 2030, and whether it holds if Google’s business priorities shift. Nobody knows.
Apple’s approach is genuinely different — up to a point
Apple Health data is stored on-device by default. Apple does not use HealthKit data for advertising. When a third-party app requests access to your health data, iOS prompts you explicitly — per category, per app. That granularity is real. Apple is not mining your resting heart rate to serve you ads.
But Apple’s control extends only to Apple’s own systems. If you grant a third-party wellness app access to your HealthKit data — a fitness app, a meditation app, an insurance partner app — Apple’s protection ends there. That app can collect, store, and share your health data under its own privacy policy, which may be far less protective. The security of your Apple Watch data depends heavily on which apps you’ve said yes to.
This is a meaningful difference from Google, but it’s not a guarantee. It relocates the risk from Apple to the apps sitting on top of Apple’s platform.
The insurance angle
The connection between wearables and insurance is no longer hypothetical. It’s live, operational, and growing.
Aditya Birla Health Insurance’s Activ Health program in India offers premium discounts and cashback when customers meet fitness targets: steps, active minutes, workouts. The targets are tracked through a connected wearable or smartphone. The data flows from your device to their platform. Meeting targets earns rewards. Not meeting them doesn’t trigger an explicit penalty — today. But the insurer now has a real-time view of your physical activity that no medical test could replicate.
Vitality, a program run by Discovery Health and licensed to insurers globally, operates on similar logic. Customers share health and activity data; they earn points; points translate to discounts, rewards, and premium reductions. Partners include major insurers across South Africa, the UK, Europe, and parts of Asia.
John Hancock went further. In 2018, the US life insurer stopped selling traditional life insurance entirely — all new policies require participation in its Vitality wellness program. Customers wear a tracker; John Hancock gets the data. Not a voluntary add-on. The product.
The concern is not that these programs are fraudulent — they operate on consent, explicit if often buried. The concern is actuarial drift. Insurers accumulating long-term fitness data will, over time, identify what it predicts. Low activity correlates with worse health outcomes. Once they can flag high-risk individuals through behavioral data rather than medical history, the pressure to price accordingly is enormous. They may not say “we’re raising your premium because your step count is low.” They’ll say “we adjusted pricing based on our risk models.” The outcome is the same.
Where India stands
The Insurance Regulatory and Development Authority of India (IRDAI) has not issued specific guidance on how wearable data can be used in underwriting. The framework doesn’t yet exist.
The Digital Personal Data Protection Act (DPDPA) classifies health data as sensitive, so explicit consent is required before collection. Insurers running wellness programs satisfy this by burying a data-sharing clause in the program’s terms. You click “join Activ Health.” Several screens in, you’ve consented to health data collection and processing.
Legally valid. Not meaningful in any practical sense. Most people joining for premium discounts are not reading five pages of data processing terms. They’re clicking through to the cashback.
The EU extracted binding commitments from Google over Fitbit data because it built the regulatory capacity to do so. IRDAI has not moved in that direction yet.
What you can do
Joining a wellness program for the cashback is a rational decision. So is knowing exactly what you’re agreeing to.
Before joining any insurance wellness program, read the data sharing section of the terms — not the marketing page. Which third parties receive your data? What are they allowed to do with it? Is there an exit mechanism that actually removes your historical data?
On Fitbit, go to Settings > Privacy > Personal Information and review what’s shared with connected apps. Revoke access to anything you no longer use.
On Apple Watch, open the Health app, tap your profile, then Sources. Review which apps have access to which categories and remove anything you don’t actively trust.
The data has value far beyond the cashback it’s traded for. The rewards are real. So is what you’re giving up.
What you can do right now
Want to see what data brokers expose about you? See what a scan finds → shows an example report: the kinds of sites that list your name, phone, and address. Once KnytX Shield launches it will find and remove these automatically. Join the waitlist to get in early.