Reading past the launch-day promise
Park told Bloomberg that the privacy principles Fitbit set when it launched in 2007, including not sharing data with third parties without the user's consent, carry over to Luffu. The company's privacy policy, last updated August 23, 2026, adds detail that the launch coverage did not explore. Luffu says it does not "sell" consumer health data as defined under the relevant laws. It may, however, share personal information with the providers that help run the service, a list that includes AI or machine learning services, analytics and marketing services. It also says it uses personal information to improve its services and build new ones, including developing, training and fine-tuning models and AI technologies.
On retention, the policy says data is kept for as long as the person uses the service, or as long as needed for the purposes it was collected for or for business purposes, with no fixed end date stated. It covers precise geolocation, and it describes rights to request deletion and to withdraw consent. Put side by side, the launch-day promise and the policy are not in conflict, but they are answering different questions: one is about outside parties, the other also covers how Luffu itself may use what it holds.
There is also a legal backdrop worth knowing. Many people assume health information on a wearable carries the same protections as a medical chart. Usually it does not. The Federal Trade Commission notes that many companies collecting health information, from fitness trackers to connected blood pressure cuffs, are not covered by HIPAA. For those companies, its Health Breach Notification Rule requires them to notify customers, the FTC and in some cases the media after a breach of identifiable health information. In practice, the company's own policy and settings do most of the work of deciding where a parent's data goes.