Your Fitness Tracker Is a Spy You Paid For

Your Fitness Tracker Is a Spy You Paid For | Zaraike Digital Services
Day 4 · Week 1 · Healthcare Cybersecurity · Zaraike Digital Services

Your Fitness Tracker Is a Spy You Paid For

By Uchenna Okafor  |  IT Manager & Founder, Zaraike Digital Services  |  Securing Africa's Digital Future

You bought it.

You strapped it to your wrist. You wear it to bed, to the gym, to church, to work.

And every single day, it quietly learns your heart rate, your sleep pattern, your location, your stress levels — and for many women, your menstrual cycle.

Now ask yourself a question you have probably never asked: where does all of that data actually go?

You paid for the watch.
Someone else is getting paid for you.
📡 What Your Wearable Already Knows
❤️
Heart Rate & RhythmContinuous, 24 hours a day — including irregular patterns that hint at health conditions
😴
Sleep CyclesWhen you sleep, how well, how often you wake — patterns that reveal stress, illness, or lifestyle habits
📍
Location HistoryWhere you go, how often, at what time — built into a movement profile over months and years
🩸
Menstrual & Fertility DataCycle tracking, fertility windows, pregnancy attempts — among the most sensitive data a person can generate

The Diary That Tells on You

🔒 A simple story

Imagine you had a magic diary. Every day, it writes down everything about you without you even asking — when you wake up, when you're tired, when you're scared, when you're sick, even how fast your heart beats when you're nervous.

You think it's just your diary. Your secret. Your private little book.

But this diary has a tiny hidden mailbox at the back. Every night, while you sleep, it slips a copy of everything it wrote — straight to companies you've never met. They read about your whole day. Then they sell what they learned to other companies.

You never opened that mailbox. You didn't even know it was there. But it's been there since the day you got the diary — sitting quietly on page one, in writing too small for you to notice.

That diary is your smartwatch. The mailbox is a setting called "data sharing with partners." And it has probably been switched on since the day you took it out of the box.

👔 Explain It Like a Professional

The Wearable Data Economy

Wearable devices occupy a unique position in the data economy: they are simultaneously consumer electronics and continuous biometric sensors. Unlike a one-time form submission, a wearable generates a persistent, longitudinal stream of physiological and behavioural data — often more granular and harder to anonymise than data collected through any other consumer channel.

Most wearable manufacturers operate on a freemium or hardware-plus-services model, where the device sale is only one revenue stream. The accompanying mobile application frequently includes embedded software development kits (SDKs) from advertising networks, analytics providers, and — critically — health and life insurance data aggregators. Biometric data, once transmitted to these third parties, can be cross-referenced with other data sources to build remarkably detailed behavioural and health-risk profiles.

Crucially, much of this data falls outside traditional health privacy regulation. In most jurisdictions, including Nigeria under the NDPR, wearable-generated wellness data is not classified with the same protections as clinical medical records, despite being arguably more revealing — because it is continuous, contextual, and collected without a clinician's oversight or consent framework.

The implications extend beyond advertising. Life and health insurers in several markets have begun incorporating wearable data — sometimes voluntarily submitted for "discount" programs, sometimes acquired through data broker relationships — into underwriting and premium calculation models.

The device on your wrist was never just a fitness tool. It is a biometric data pipeline, and you are both the source and the product.

From Your Wrist to Their Servers — In Four Steps

01

Collection

Your wearable's sensors capture heart rate, movement, sleep, and location in real time, syncing to its companion app every few minutes.

02

Transmission

The app uploads this data to the manufacturer's cloud servers — and, depending on the SDKs embedded in the app, simultaneously to third-party analytics and advertising platforms.

03

Aggregation

Data brokers combine your biometric data with other available information — your shopping habits, your location history, your demographic profile — to build a composite picture of who you are.

04

Monetisation

That composite profile is sold or licensed to advertisers, insurers, and research firms — often without ever directly identifying you by name, but with enough specificity to target you precisely.

This Has Already Happened to Millions

Example 01 — Strava's Global Heatmap (2018)

A Fitness App Accidentally Exposed Secret Military Bases

Strava, a popular fitness tracking app, published a global heatmap showing aggregated user activity from millions of devices. Analysts quickly discovered the heatmap revealed the exact layouts of secret military bases in conflict zones — because soldiers wearing fitness trackers had unknowingly mapped the bases through their daily runs. If aggregated fitness data could expose military secrets, it can certainly expose far more about an ordinary person's daily life.

Example 02 — Fitbit Data and Insurance Programs

Wearable Data Entering Insurance Underwriting

Several insurers across global markets, including programs referenced by Fitbit and other wearable partnerships, have offered premium discounts to users who share their activity data. While framed as a wellness incentive, this establishes a precedent: health-adjacent behavioural data is being formally integrated into financial risk assessment — a shift few users fully register when they accept the optional integration.

Example 03 — Period Tracking Wearables Post-Roe (USA, 2022)

Reproductive Data Became a Legal Liability Overnight

Following the overturning of Roe v. Wade in the United States, privacy researchers raised urgent alarms about period and fertility tracking data stored by wearable companies — warning it could be subpoenaed in legal proceedings related to abortion in states where it had become criminalised. Data collected for personal wellness purposes suddenly became potential evidence in a completely different context the user never anticipated.

🔐 What to Do Today

You don't need to throw away your smartwatch. You need to take back control of what it's allowed to share.

01

Check Your App's Data Sharing Settings

Open your wearable's companion app and go to privacy or data settings. Look specifically for toggles related to "research partners," "third-party sharing," or "personalised ads." Switch off anything not essential to the app functioning.

02

Turn Off Location Access When Not Needed

Unless you are actively tracking a run or route, your wearable does not need constant location access. Set location permissions to "while using the app" rather than "always," or disable it entirely for features you don't use.

03

Read What "We Share With Partners" Actually Means

Search the privacy policy for the words "partners," "third parties," or "affiliates." This section — usually short and easy to skip — tells you exactly who else has access to your body's data and what they're permitted to do with it.

A smartwatch was never sold to you as a surveillance device. It was sold as a wellness companion — something to help you sleep better, move more, and understand your body.

But somewhere between the marketing and the fine print, your body's data became someone else's business model.

You paid for the device.
Don't let someone else profit from you twice.

Uchenna Okafor
IT Manager  |  Strategic IT Leadership, Governance & Infrastructure Resilience
Founder, Zaraike Digital Services
🔗 LinkedIn 📝 Blog
#WearableTech #DataPrivacy #CyberAwareness #DigitalSafety #NaijaTech #HealthcareCybersecurity #ZaraikeDigital #SecuringAfricasDigitalFuture

0 comments: