Imported wearables: health and biometric data checks
Health information and biometrics used to uniquely identify someone are special category data. Processing requires a lawful basis under Article 6 and a valid condition under Article 9; a factory's app agreement alone does not establish these. Ask for a feature-level data map before ordering through Cambridge China Bridge.
Map the wearable, app and cloud service
Ask the supplier to map each feature: what the wearable measures, what the app calculates, what reaches cloud servers and who can access it. Include inferred results, identification templates and support access. Establish who decides each use of the information rather than assuming the factory handles everything.
Keep this assessment alongside the checks in our connected-product security guide. For intended medical uses and claims, consult our medical-device sourcing guide. Use our product marking guide for conformity documentation.
Separate activity readings from health information
The ICO says step count on its own is unlikely to be health data. Using it with other measurements to predict health status can change that classification. Special category data also includes intended health inferences, so examine the app's outputs as well as the sensor readings.
Ask for sample screens and an explanation of every health score. Record what each result claims to reveal and how it is calculated. Do not accept a description such as 'fitness only' without checking the actual features.
Check whether biometrics identify the wearer
Biometric data becomes special category biometric data when used to uniquely identify someone. Biometrics used without that purpose do not fall into that biometric special category, although health-related processing may still need separate assessment.
Ask whether the system creates or compares a fingerprint, face or voice template to recognise the wearer. Request a demonstration of enrolment and matching, including what happens when somebody who has not enrolled uses the device.
Identify the processing condition before activation
For special category processing, identify both an Article 6 lawful basis and an Article 9 condition. A contract or legitimate interests basis does not supply the additional condition. Where required, the relevant condition must also meet the domestic conditions in Schedule 1 of the Data Protection Act.
Explicit consent is a possible condition, but it must be freely given, specific, affirmative and unambiguous, and withdrawable at any time. Ask to see the consent wording and withdrawal journey. If no condition fits and valid explicit consent cannot be obtained, the special category processing cannot proceed.
Working out your own order? Send us the product on WhatsApp and we reply the same working day: WhatsApp us
Turn the assessment into purchasing evidence
Processing likely to be high risk requires a data protection impact assessment. Ask your data-protection adviser to assess the proposed features before activation. Keep the classification reasoning, chosen basis and condition, app demonstrations and unresolved questions together.
Use an approved feature list in the purchase specification. Ask the factory to flag changes to sensors, identification functions, app calculations, cloud destinations and support access before implementing them. Cambridge China Bridge's staff in China can request supplier explanations and demonstrations for your buyer-side review.
Frequently asked questions
Is a wearable's step count special category data?
Not automatically. The ICO says step count alone is unlikely to be health data, but using it to predict health status can make it health data. Check the purpose and resulting inferences.
Are all wearable biometrics special category data?
The biometric classification depends on using the data to uniquely identify someone. Assess health-related uses separately, even where identification is absent.
Can legitimate interests cover wearable health data?
An Article 6 lawful basis alone is insufficient. Special category processing also needs a valid Article 9 condition, with any applicable domestic conditions.
Is explicit consent always required?
No. It is a possible condition, rather than the only condition. Check which condition fits the purpose. If none fits and valid explicit consent cannot be obtained, the processing cannot proceed.