Device manufacturers aren’t covered by the Health Insurance Portability and Accountability Act (HIPAA) of 1996, reports Bloomberg Law.

“So, in most cases, when an individual hands over their health data to a device company, that company is not prohibited from disclosing that data to other entities. This gives device companies a lot of leeway in terms of what they can do with health information they obtain.”