AI in health and wellness: wearables, apps, chatbots and your data

Where AI shows up in consumer health

Consumer health AI lives in three kinds of product, and each one is regulated differently.

The sensors are ordinary. The heart rate sensor on the back of a watch uses photoplethysmography (PPG): in the FDA's description of the Apple Watch, green LEDs shine into the wrist and light-sensitive photodiodes measure how much light returns, which changes as each heartbeat's pressure wave pushes blood past the sensor. When you are still, the sensor can time individual beats. ECG features use electrodes instead: the Apple Watch ECG app records for 30 seconds while you hold a finger on the digital crown, measuring the electrical potential between the crown and the electrodes on the back. Apple's sleep apnea feature works from accelerometer data, turning motion during sleep into estimates of breathing disturbances.

The AI is the model that turns those raw signals into a judgment. Apple's hypertension feature, for example, runs a machine-learning model on the watch that scores each qualifying PPG signal for hypertension risk, then aggregates the scores on the iPhone over 30-day periods before it decides whether to notify.

How an irregular rhythm notification decides

The first feature of this kind the FDA authorized shows the pattern the later ones share: many quiet measurements, then one cautious notification. In the version the FDA reviewed in 2018, the watch tried to record a one-minute sequence of beat-to-beat intervals, called a tachogram, roughly every four hours while the wearer was still. Each tachogram was classified as irregular or not, and a notification appeared only when five of six sequential tachograms were irregular within 48 hours. In the FDA's decision summary, 78.9% of notifications in the study population were confirmed as atrial fibrillation (AFib) by an ambulatory ECG monitor, although the study missed its preset goal for individual readings and the FDA relied on secondary analyses.

Which smartwatch health features the FDA has cleared

Each entry below is a decision in the FDA's device databases, for a software feature running on a consumer watch or ring. Read the right-hand column as carefully as the left: it comes from the indications and limitations the FDA accepted.

Three things follow from the table. First, the watch is not the device: Apple's hypertension summary calls the Apple Watch a general purpose computing platform, and each feature is cleared on its own. Activity and sleep tracking on the same watch fall under the general wellness policy described below, not under these clearances. Second, De Novo decisions open a category and 510(k) clearances follow it: Apple's 2024 sleep apnea notification cited Samsung's February 2024 De Novo as its predicate. Third, an FDA decision applies in the United States; availability elsewhere depends on each country's regulator.

What the clinical numbers say

Clearance does not mean a feature catches everyone. The FDA summaries publish how each feature did against a clinical reference test, and they show a deliberate trade-off: few false alarms, many missed cases.

The studies used different populations and reference tests, so do not rank the rows against each other. Read each row on its own: in Apple's hypertension study, which enrolled 2,229 adults without a hypertension diagnosis, the feature flagged 41.2% of those who had hypertension (an average of 130 mmHg systolic or 80 mmHg diastolic or higher) and 53.7% of those with stage 2 hypertension. That is why Apple's labels say the absence of a notification does not mean the absence of the condition.

The AI models inside these features also change. Apple's sleep apnea and hypertension features and Samsung's v2.0 were cleared with a predetermined change control plan (PCCP), which lets the maker update the model without a new 510(k) as long as each change stays within the plan the FDA reviewed.

Wellness product or medical device: where the line is

The same sensor can feed a wellness trend or a regulated notification. The deciding factor is what the product claims to do.

The US rule starts with the 21st Century Cures Act of December 13, 2016, which removed from the definition of a device any software intended for maintaining or encouraging a healthy lifestyle and unrelated to diagnosing, treating or preventing a disease. The FDA's general wellness guidance, reissued on January 6, 2026 to replace the September 2019 version, explains how it applies that line and says the FDA does not intend to review low-risk general wellness products. Two kinds of claim qualify: general claims about fitness, weight, sleep management, stress or mental acuity that name no disease, and claims that a healthy habit may help reduce the risk of, or live well with, a chronic condition such as high blood pressure or type 2 diabetes.

The 2026 guidance speaks directly to wearables that estimate body measurements. A non-invasive product may show values such as blood pressure, oxygen saturation, blood glucose or heart rate variability as a wellness product only if those values serve wellness uses and the product:

• does not reference a specific disease, clinical condition or diagnostic threshold;
• sends no alerts that recommend or require clinical action;
• makes no claim of clinical accuracy, medical grade or equivalence to a cleared device;
• has validated any value that mimics a clinical one.

It may still suggest that a health professional could help when readings fall outside wellness ranges, as long as the message names no condition and calls nothing abnormal. One of the guidance's own examples is a wrist-worn wearable for activity and recovery that reports sleep, pulse rate and blood pressure: low-risk wellness, provided its blood pressure values are validated and nothing in its marketing implies medical use.

The line is enforced. On July 14, 2025, the FDA sent WHOOP a warning letter saying its Blood Pressure Insights feature was an uncleared device. The agency pointed to the company's own wording, including "medical-grade" insights and a suggestion that higher blood pressure may indicate poor sleep, and to a colour-coded gauge of target ranges, and it said disclaimers did not outweigh a design built to estimate blood pressure. The letter also called blood pressure estimation not a low-risk function. Less than six months later, the 2026 guidance took a more permissive view of validated wellness estimates, as its wearable example shows. Under the new guidance, disease references, diagnostic thresholds, clinical alerts and claims of medical grade still put a product on the device side.

Two more rules matter for AI features:

• Clinical decision support. The FDA's clinical decision support guidance, last revised on January 29, 2026, exempts some decision software only when it supports a health care professional who can review its basis. Software that gives recommendations to patients or caregivers meets the definition of a device, and the FDA applies its other digital health policies to decide how to treat it.
• Canada. Health Canada's software as a medical device guidance, in effect since December 18, 2019, takes the same position: software intended for maintaining or encouraging a healthy lifestyle, such as general wellness apps, is not a medical device.

AI chatbots for health questions

Chatbots are now a mainstream health tool. OpenAI said in January 2026 that, based on its de-identified analysis, over 230 million people ask ChatGPT health and wellness questions every week. It introduced ChatGPT Health on January 7, 2026 as a separate space that can connect medical records (in the US) and apps such as Apple Health, with health conversations kept apart from other chats and not used to train its foundation models. OpenAI's own description says it is not intended for diagnosis or treatment, and a July 23, 2026 update opened it to US users 18 and over on the web and iOS.

The evidence on how well people do with chatbots is sobering. In a randomized study of 1,298 UK participants, published in Nature Medicine on February 9, 2026, Oxford researchers gave people medical scenarios and help from GPT-4o, Llama 3 or Command R+, or from any source they chose. Tested alone, the models named the relevant conditions in 94.9% of cases. People using the same models identified relevant conditions in fewer than 34.5% of cases and chose the right course of action in fewer than 44.2%, no better than the control group. The failure was in the conversation: what people told the model and what they took from its answer. Benchmarks on medical knowledge did not predict it. It is the same gap between fluent answers and understanding described in where AI models fall short.

Two practical consequences. Use a chatbot for the tasks OpenAI itself describes, such as explaining a test result, summarizing a document you already have or preparing questions for an appointment; the Oxford results are a reason not to let it decide what your symptoms mean. And a chatbot you sign up for yourself is a consumer app: its privacy terms, not HIPAA, decide what happens to what you upload.

AI in mental health apps: evidence and cautions

Mental health is where wellness apps and medical devices are easiest to confuse. The FDA said as much in its briefing for the November 6, 2025 meeting of its Digital Health Advisory Committee on generative AI mental health devices: the spectrum of devices and consumer wellness apps "has been a source of confusion". At that point the FDA had authorized over 1,200 AI-enabled medical devices, none of them for mental health uses, and fewer than twenty digital mental health devices of any kind, most of them prescription-only. Under the FDA's wellness guidance, an app that promotes relaxation or helps manage stress is a general wellness product; one that claims to help treat an anxiety disorder is not.

The evidence for generative AI therapy is early:

• The first clinical trial. Dartmouth's Therabot trial, published in NEJM AI in March 2025, gave a purpose-built therapy chatbot to 106 people with major depressive disorder, generalized anxiety disorder or an eating disorder, alongside a control group. Depression symptoms fell by 51% on average, anxiety by 31% and concerns about body image and weight by 19%. The researchers still stressed that no generative AI agent is ready to work fully autonomously in mental health.
• General chatbots as therapists. A 2025 study presented at ACM FAccT tested models including GPT-4o against therapy guidelines. They expressed stigma toward people with mental health conditions and responded inappropriately to some common and critical situations, for example by encouraging a client's delusional thinking, even in larger and newer models. The authors concluded that language models should not replace therapists.

Regulators are moving. On September 11, 2025, the FTC ordered seven companies, including Alphabet, Meta, OpenAI and Character Technologies, to explain how they test and limit the effects of companion chatbots on children and teens. In Illinois, the Wellness and Oversight for Psychological Resources Act, signed on August 1, 2025, prohibits using AI for mental health and therapeutic decision-making, while allowing it for administrative and supplementary support to licensed professionals.

Who protects your health data in an app

HIPAA covers less than most people assume. According to HHS, the HIPAA rules protect health information held by covered entities (health plans, most health care providers and clearinghouses) and their business associates. In most cases they do not protect data you download or enter into an app for your own use, unless a covered entity or its business associate provides the app, regardless of where the information came from. The same page warns that such data may be used to target ads or sold to data brokers. How records move and are protected inside the health care system itself is covered in the role of IT in healthcare.

In the US, the FTC fills that gap. Section 5 of the FTC Act prohibits misleading consumers and unfair practices that harm them, and the Health Breach Notification Rule requires personal health record vendors that HIPAA does not cover to notify users, the FTC and sometimes the media after a breach. The amendments the FTC finalized on April 26, 2024 made three changes that matter to app users:

1. They state plainly that health apps and similar technologies are covered.
2. A breach includes an unauthorized disclosure, such as sharing data with an ad platform without permission, not only a hack.
3. Notices must name the third parties that got the data, and for breaches of 500 or more people the FTC must be told at the same time as users, within 60 calendar days of discovery.

The amendments took effect in July 2024, and the FTC's compliance guide puts the civil penalty at up to $53,088 per violation (as adjusted in January 2025).

The FTC's cases show what the risk looks like in practice:

Outside the US, the rules differ:

• Canada. PIPEDA governs how private-sector organizations collect, use and disclose personal information in the course of commercial activity, which includes a company running a health app. Alberta, British Columbia and Quebec have their own substantially similar private-sector laws, and Ontario, New Brunswick, Nova Scotia and Newfoundland and Labrador have health information laws.
• European Union. Under Article 9 of the GDPR, data concerning health is a special category that may not be processed unless an exception applies, such as the person's explicit consent for a specified purpose. The EU AI Act adds another layer: AI that is itself a medical device, or a safety component of one, and needs a third-party conformity assessment under the Medical Devices Regulation counts as high-risk.

If you build a wellness app, or any software that handles health data without making medical claims, the same cases set the design brief: collect less, keep health data away from advertising and analytics tools, and treat any disease claim as a regulatory decision. Our AI and automation service removes personal data before a model reads it and tests every model or prompt change against the same set of real questions before it ships, and our data platform service keeps personal data classified, minimized and access-controlled to the laws that apply to you. The broader engineering is covered in how to build AI into an application.

How to judge a health app or AI feature before you trust it

Run through these checks before you act on what an app, a wearable or a chatbot tells you:

1. Find the claim. Read what the product says it does. If it names a disease, a diagnostic threshold or tells you to take clinical action, it should be a cleared or licensed device.
2. Look it up. Search the FDA's 510(k) database and De Novo database by maker or feature name, or Health Canada's Medical Devices Active Licence Listing. A cleared feature has an entry with a decision date.
3. Read the "not intended for" lines. Age limits, a previous diagnosis, pregnancy: the features in the table above exclude these, and results outside the intended population were not validated.
4. Check the evidence. For a cleared feature, the FDA summary gives sensitivity and specificity against a clinical reference. For a mental health app, look for a randomized trial, not testimonials.
5. Treat silence as unknown. No notification is not a negative test.
6. Read the data terms. Look for sharing with advertising or analytics partners, whether your conversations train models, and how to delete your data. Grant only the permissions the feature needs.
7. Take results to a clinician. Use an alert, a trend or a chatbot answer to start a conversation, never to change a treatment on your own.

AI is putting screening prompts on ordinary watches, rings and phones. The ones worth trusting say exactly what they are for and what they are not, and let you check their claims, their evidence and what happens to your data.