How a heartbeat on a smartwatch becomes an AI prediction

A connected watch or ring tells its owner how well they slept and whether their heart rate is unusual. A Tech Anatomy episode in French, published in February 2025, told the story from the point of view of a single piece of data, one heart rate measurement, following it from the wrist to an AI model and back. The journey is worth retracing, with a few corrections and additions, because it shows where decisions about that data are made.

Step one: the measurement

Most wrist devices measure heart rate optically, using a technique called photoplethysmography. Small LEDs, usually green, shine light into the skin, and a sensor measures how much is reflected back. Blood absorbs green light, so the amount reflected changes slightly with each pulse wave, and the device derives a heart rate from those variations. At this stage the measurement is raw, and noisy: movement, a loose strap or cold skin can all distort it.

Step two: the device and the phone

The first processing happens close to the body. The watch filters the signal, discards readings it judges unreliable and computes a heart rate. It then sends data, typically over Bluetooth, to a companion app on a smartphone. There, the measurement joins thousands of others recorded through the day, and the app computes averages and trends, such as resting heart rate or heart rate during sleep.

The episode presented the next step, sending data to the cloud, as necessary because phones lack storage and computing power. That is true for some processing but not all. Manufacturers increasingly run models directly on the watch or phone, both to save battery and bandwidth and to limit how much personal data leaves the device. Where each computation happens varies by manufacturer and by feature, and it is usually described in the product's privacy documentation rather than in its marketing.

Step three: the servers and the training data

When data is sent to remote servers, it can serve two different purposes, which are easy to confuse. The first is computing something for the user: an analysis too heavy for the phone, or a sleep score. The second is improving the models themselves, by pooling data from many users to train or refine an algorithm. The second use is what turns one person's heartbeat into a contribution to a model that serves everyone.

Two broad families of machine learning are involved. In supervised learning, a model is trained on examples where the right answer is known, for instance heart rhythm recordings labelled by cardiologists as normal or as atrial fibrillation, a common irregular rhythm. It learns to reproduce those labels on new data. In unsupervised learning, there are no labels: the model looks for structure on its own, such as clusters of similar patterns or readings that deviate from a person's usual baseline. Anomaly detection often relies on the second family, prediction of a known condition on the first.

Step four: back to the user

The result returns to the app as a number, a trend or, occasionally, an alert suggesting the user see a doctor. Whether such an alert is reliable was measured in the Apple Heart Study, published in the New England Journal of Medicine in 2019. Among 419,297 participants, 0.52 percent received an irregular pulse notification, and when a notification coincided with an ECG patch recording, 84 percent of notifications corresponded to atrial fibrillation. Tech Anatomy covered that study in more detail in an article on wearables in cardiology.

The episode suggested that this kind of analysis can anticipate problems well before symptoms appear. That is the aim, and for some conditions, such as silent atrial fibrillation, detection without symptoms is documented. Whether earlier detection by consumer devices leads to better health outcomes is a separate question that has not yet been answered for most uses.

The protections, stated precisely

The episode described the data as anonymised once it reaches the servers. In practice, much of it is pseudonymised: the name is replaced by an identifier, but the data can still be linked back to the person by whoever holds the key, or by cross-referencing. Under the EU's General Data Protection Regulation, pseudonymised data remains personal data, with all the obligations that follow, while truly anonymous data falls outside the regulation. Making data anonymous in that strict sense is harder than it sounds: a 2019 study in Nature Communications estimated that 15 demographic attributes are enough to re-identify 99.98 percent of Americans in a dataset.

Health data is also a special category under the GDPR, whose processing requires an explicit legal basis, such as the user's explicit consent. A separate set of rules applies depending on what the feature claims to do. Under the EU Medical Device Regulation, software intended to diagnose, monitor or predict a disease is a medical device and must be certified as such, while a feature presented as wellness, such as a sleep score, generally is not. The same heart rate can therefore pass through regulated and unregulated features within the same device.

Two readings

One reading emphasises the benefits. Continuous measurement across millions of people generates data that clinical studies could never collect, models trained on it can flag conditions that would otherwise go unnoticed, and European rules give users strong rights over how that data is used.

Another reading emphasises asymmetry. Users rarely know which data leaves their device, which is used to train models, or how long it is kept, and privacy policies are long and change over time. The value created by pooled data accrues mostly to manufacturers, and the boundary between a wellness feature and a medical one is drawn by the manufacturer's own claims.

What the episode and the evidence do not settle

How much data each manufacturer sends to its servers, and how it is used for training, is not systematically disclosed or audited. Accuracy figures for consumer features are often published by the manufacturers themselves, on populations that may not resemble the people most at risk.

What to watch

The indicators worth following are whether more processing moves onto the device itself, whether European regulators enforce the line between wellness and medical claims more strictly, and how the European Health Data Space, which sets labelling rules for wellness applications that claim to work with electronic health records, ends up treating data generated by consumer wearables.

Listen to the episode

Comment une Donnée se Transforme en IA ?

Listen · 7 min