Are Samsung's "S Health" devices storing health data in the cloud?

Question

Samsung wearables like the Gear watches can run the Android app S Health are advertised to be quite secure and can be run by using the Samsung Knox security feature which is in itself advertised as certified by government agencies and so forth.

However there seems to be no easily available information if my health data is just securely stored on the device or if it's automatically stored on a cloud storage as well.

This section from the App description seems to point to a rather free usage of at least the step count.

Compete with your friends and check your ranking. You can compete with your friends in the address box once your Samsung account is registered. On "together" section, you can select your own competitor and compare your steps with people of different age group across the globe.

Which data of S Health devices is stored where and how can I control it?

Answer 1

Rather a lot of personal information is collected, according to the Privacy Policy. Here are some of the more sensitive pieces of information collected:

When not logged in

• Birth year
• Gender
• Height, weight and activity levels
• Device identifiers

When using 'Enhanced Features'

• Phone number
• Nickname, profile image, birthday and country
• Steps, burned calories, distance, activity logs

When logged in

• Device identifiers for any accessories
• Information about exercise routines
• Heart rate, ECG, body fat, skeletal muscle, muscle mass, basal metabolic rate, blood glucose level, blood pressure level, blood oxygen (SpO2) level, hemoglobin (HbA1c) level, stress level and sleep-related information.

As you can see, with all those data points, someone could get a clear picture about your health, activity and location. Samsung even admit in the Privacy Policy:

Please note that such wellness-related information can reveal your state of health and can therefore consist of sensitive personal data.

However, I'm not surprised or even upset that Samsung collects that information; without collecting it, the fitness tracking wouldn't work very well at all.

Samsung are a little vague about where the information is stored:

We use a variety of standard security measures, including encryption and authentication tools. When you access information, we offer the use of a secure server.

Your guess is as good as mine!

If you're not comfortable with this, European data protection regulations help a lot:

You may also have statutory rights to access and edit such information and you have the right to request information about your personal data. Furthermore, you may refuse the disclosure of your information to a third party at the moment the information is collected. If you have any questions about the information we hold, please contact our customer service department at http://help.content.samsung.com or the European Data Protection Officer, Samsung Electronics (UK) Limited, Samsung House, 1000 Hillswood Drive, Chertsey, Surrey KT16 0PS.

Not convenient, but in theory, you can ask Samsung to stop collecting data at any point, or request all of the information they have on you.