A sleep or heart rate reading says something about a person's health, and a hotel has no reason to hold it.

Why it matters

The advanced guest knows this. They measure their sleep at home, they know the value of these figures, and they wonder what happens to their data when a hotel lends them a device.

IO8's answer fits in one sentence: we measure the room, not the guest.

What science establishes

On this subject, it is the law that establishes. We cite the European General Data Protection Regulation (GDPR) in the version published by the CNIL, the French data protection authority.

Health data are a category apart. The GDPR defines them as data “related to the physical or mental health of a natural person [...] which reveal information about his or her health status”. Article 4, point 15. Processing them is prohibited in principle, as is the processing of biometric data used to identify a person. Article 9, paragraph 1. It is permitted only by exception, for example with explicit consent for a specific purpose. Article 9, paragraph 2. In Portugal, the CNPD, the supervisory authority, points out that biometric data are sensitive data: their processing is permitted only where a law expressly provides for it, or with explicit, informed, specific and freely given consent. CNPD, Biometria. Established.

Wellness data can become health data. The CNIL specifies that everything depends on the nature of the data and on how it is cross-referenced with other data. A weight cross-referenced with a step count or calorie intake makes it possible to draw conclusions about health. Established.

Only what is necessary is collected. Data must be “adequate, relevant and limited to what is necessary in relation to the purposes”. Article 5, paragraph 1, point c, known as the data minimisation principle. The controller must build it in by design and by default, including for the retention period. Article 25. Established.

The stakes are real. A breach of these principles can lead to a fine of up to 20 million euros or 4 % of total worldwide annual turnover. Article 83, paragraph 5. Established.

What is emerging

Health apps share a great deal. In a laboratory analysis of 24 medicines-related apps, 19 transmitted user data, to 55 entities in total, most of them specialising in analytics or advertising. Grundy et al., 2019. Emerging, limited sample of apps.

Users want to stay in control. In a survey of 273 smartwatch users aged 18 to 65, participants said they were more comfortable sharing their data with their doctor without going through the internet, and preferred fully anonymised data for public health. Goodings et al., 2025. In the Netherlands, among 2,086 adults aged 50 and over, 29 % said they were willing to donate their activity data to research; privacy concerns were among the reasons for refusing. Keusch et al., 2025. Emerging, self-reported surveys.

What we refuse to say

We do not calculate a guest “longevity score”. No score of this kind is validated, and producing one would make the hotel a holder of health data.

We do not profile guests on the basis of their nights. No biometric data are used for sales, marketing or loyalty programmes.

We do not say that a lent device is a medical device, nor that its figures are worth a medical examination.

What a hotel can do

Why it is simple. The hotel does not need the guest's data to offer them a better night. It needs the data of its room.

Minimum baseline (no equipment cost). Collect no biometric data. A device is lent for use with the guest's own app and account, on their phone. On return, the device is unlinked from any account and reset. A clear sentence in the welcome booklet says so.

Optimised baseline. Publish the room readings, which concern no individual: night-time CO2 below 800 ppm, noise below 30 dB, evening light below 2,700 K, temperature of 18 to 19 °C, filtered water, morning light above 1,000 lux. Each room publishes its own readings. The lending of devices from the IO8 stack, at 50 € per night against a card pre-authorisation, follows the same rule: the card pre-authorisation is a matter of payment, never of health.

The target. A hotel that holds nothing it would have to protect. A check by the establishment's data protection officer remains recommended; any cost is to be confirmed by quote.

What the Living Lab measures

Measurement planned. The Living Lab, near Lisbon, is being equipped in waves. It measures the environment of its rooms, not their occupants.

For each device lent, we will check and publish the unlinking and reset procedure, as well as the list of data the device transmits to its manufacturer, according to its public documents.

Sources

• Regulation (EU) 2016/679 (GDPR), Articles 4, 5, 9, 25 and 83. Text published by the CNIL. cnil.fr
• Regulation (EU) 2016/679, Official Journal of the European Union. eur-lex.europa.eu
• CNIL. Qu'est-ce qu'une donnée de santé ? cnil.fr
• CNPD (Comissão Nacional de Proteção de Dados). Organizações, áreas temáticas: Biometria. cnpd.pt
• Grundy Q et al. Data sharing practices of medicines related apps and the mobile ecosystem: traffic, content, and network analysis. BMJ, 2019. doi:10.1136/bmj.l920
• Goodings AJ et al. Determinants of continuous smartwatch use and data-sharing preferences with physicians, public health authorities, and private companies: cross-sectional survey of smartwatch users. J Med Internet Res, 2025. doi:10.2196/67414
• Keusch F et al. Data donation as a method to measure physical activity in older adults: cross-sectional web survey assessing consent rates, donation success, and bias. J Med Internet Res, 2025. doi:10.2196/69799

Also from the founder

Question 48 · How do you protect health data?

The longevity audit for venues  ·  The Research Journal

IO8 Living Lab, near Lisbon. Measured, never promised.

← Previous articleSeries 1