How a Smart Ring Is Made: PPG, Batteries, Firmware and Data

A smart ring is made by folding a flexible circuit board, carrying LEDs, photodiodes, a temperature sensor, a motion sensor and a Bluetooth Low Energy chip, around a small curved lithium battery, then sealing that assembly inside a metal or ceramic shell with resin so that it survives sweat, water and knocks. Its optical sensor uses photoplethysmography (PPG), shining light into the finger and measuring how much comes back, to estimate heart rate, heart rate variability and, on some models, blood oxygen. Those numbers travel over Bluetooth to a phone app and usually to the maker's cloud, where US law treats most of them as consumer wellness data rather than medical records.

That answer hides a lot of engineering and a lot of policy. The ring has to run for days on a battery smaller than a fingernail, take firmware updates over a radio link without bricking, and hand very personal data to an app whose privacy terms decide where it goes next. This post goes one level deeper than our smartwatch build, which covers the larger wrist version of the same idea. For the radio details, see Bluetooth LE GATT, pairing and bonding, and for the charging side, the evolution of charging ports, USB-C PD and Qi2.

Nothing here is medical advice. A ring's readings are estimates. If a number worries you, talk to a clinician and use a device that is authorised for that purpose.

Key takeaways

• A smart ring is a sealed, wrapped stack: flexible printed circuit, optical front end, temperature sensor, accelerometer, Bluetooth LE system on chip, curved lithium polymer cell and a charging coil or contacts, all potted in resin inside a shell.
• Repair is essentially impossible by design. The resin that makes the ring waterproof also locks the battery and board in place, so a failed cell usually means a replacement ring.
• PPG measures changes in reflected light as blood volume pulses. Fit and motion are the big accuracy limits. A peer-reviewed study of wrist wearables found error during activity was on average about 30 percent higher than at rest.
• The US Food and Drug Administration's January 2026 general wellness guidance says optical wearables that estimate values such as oxygen saturation or heart rate variability can be low risk wellness products, as long as they avoid disease claims, clinical alerts and unvalidated clinical-looking values.
• HIPAA usually does not cover a ring you buy yourself. The Federal Trade Commission's Health Breach Notification Rule can, and the FTC counts an unauthorised disclosure, not just a hack, as a breach.
• Firmware updates arrive over Bluetooth. A well designed ring verifies a signature before booting new firmware and refuses to roll back to an older, vulnerable version.
• Your most useful privacy controls are in the app: which integrations are connected, what is synced to the cloud, and how to export and delete your data.

Raw material to sized ring: the step table

A ring is assembled in a different order from a phone or a watch. There is no case to open later, so every test that matters has to happen before the resin goes in. The table below describes the typical flow at the level of process categories; individual makers vary the order and the materials.

A dated timeline of the rules and standards around smart rings

Smart rings sit where Bluetooth, wireless power, IoT security baselines and health privacy rules meet. These are the dated milestones that matter for a ring sold in the US today, each checked against the publisher's own page.

The Bluetooth Core Specification is the other anchor. The Bluetooth SIG lists Core Specification 6.0 as adopted and notes a set of specification updates that are mandatory when claiming compliance with it. A ring's Bluetooth qualification states which core version it implements, which matters for the pairing and privacy features described below.

What is inside a smart ring?

Open the marketing renders and a ring looks like a solid band. Inside it is a crowded, curved electronics package. The typical parts are:

The optical sensor: LEDs, photodiodes and an analogue front end

The core of any smart ring is a reflective PPG sensor. One or more LEDs shine into the skin on the palm side of the finger, and one or more photodiodes next to them measure how much light comes back. Rings commonly use green light for heart rate during the day, because green is absorbed strongly by blood near the surface, and red and infrared light where the design estimates blood oxygen, because oxygenated and deoxygenated haemoglobin absorb those two wavelengths differently. An analogue front end chip drives the LEDs with short pulses, amplifies the tiny photodiode current, filters it and digitises it, and it does this many times per second while the main processor sleeps.

The finger is a good place for this. The palm side of the finger has dense blood vessels close to the surface, and a ring is held in a fixed position against them in a way a loose watch strap often is not. That is the main reason ring makers chose the form factor.

Skin temperature sensor

A temperature sensor, often a small digital sensor or thermistor on the inner surface, tracks skin temperature. Rings report it as a change from your own baseline, typically overnight, rather than as body temperature. Skin temperature is affected by room temperature, bedding and how snugly the ring fits, which is why the value is presented as a trend.

Accelerometer, and sometimes a gyroscope

A three axis accelerometer counts steps, estimates activity and, most importantly, tells the algorithms when the hand is moving. Motion is the enemy of a clean PPG signal, so the firmware uses the accelerometer to decide when a reading can be trusted and to estimate sleep and wake periods. Some designs add a gyroscope.

Bluetooth LE system on chip

A single chip usually combines a low power microcontroller core, flash memory, RAM, a Bluetooth Low Energy radio and cryptographic hardware. It runs the firmware, buffers sensor data in flash between syncs, runs the radio and manages charging. The radio antenna has to work inside, or around, a metal shell, which is a real design problem: metal blocks radio, so antenna placement, window materials and shell design are decided together.

Curved lithium polymer battery and protection circuit

The battery is a lithium polymer cell shaped to follow the band. Capacity is small because there is so little volume, and makers usually quote different capacities for different ring sizes, since a larger ring has room for a slightly longer cell. Every lithium cell needs a protection circuit that cuts off at over voltage, under voltage, over current and over temperature, plus a charger that follows the cell's charge profile.

Charging coil or contacts

Rings charge in one of two ways. Some have exposed metal contacts on the inner surface that sit on pins in a dock. Others have a small receiver coil and charge inductively from a matching dock. Inductive charging keeps the shell sealed, which helps water resistance; contacts are simpler and more efficient at very small sizes. Whether a ring charges on a general Qi pad is a separate question, covered in the power section below.

What a ring usually does not have

Most rings have no screen, no speaker, no buttons and no cellular or Wi-Fi radio. Everything you see comes through the phone app. Some rings add a haptic motor, an NFC antenna for payments, or electrodes for an electrical skin measurement; check the maker's own specification for your model before assuming any of these.

How is a ring built, and why is repair essentially impossible?

Flexible board, folded into a circle

A watch can use a flat rigid board. A ring cannot. Ring makers use a flexible printed circuit, copper on a thin polyimide film, with small stiffened islands where chips sit. The flat assembled board is then curled into a cylinder and placed in a carrier, with the curved battery on one side and the optical window on the palm side. Flexible boards are fragile while open and rigid once supported, so the folding step is one of the most delicate in the line.

Shell materials

The outer shell is commonly titanium, stainless steel or ceramic, sometimes with a coating such as a diamond-like carbon finish. The inner surface carries a window, usually a resin or glass, that passes the LED wavelengths. Metal shells are tough but block radio and complicate inductive charging; ceramic and resin let more radio energy through but are more brittle. Makers choose based on antenna performance as much as looks.

Potting and sealing

Once the electronics sit in the shell, the remaining space is filled with resin, very often an epoxy. Potting does three jobs at once. It keeps water and sweat out, it holds the battery and board so they do not move when the ring is knocked, and it spreads mechanical stress so solder joints survive daily wear. Water resistance claims are then checked by test, usually stated as a depth rating or an IP code, and you should read your maker's statement on swimming, hot water and saunas rather than assume.

Sizing variants

Rings come in many sizes, and each size is effectively a different product internally. The circumference changes the length of flexible board, the curve and length of the battery, and the antenna geometry. That is why makers ask customers to wear a sizing kit for a day before ordering, and why battery life figures are often given as a range across sizes.

Why repair is out of reach

Three things make a ring practically unrepairable. The resin bonds to the board and battery, so they cannot be removed without destroying them. The battery cannot be swapped because its shape is unique to that size and model. And breaking the seal ends water resistance. The practical result is that a ring's life is its battery's life, and when the battery fades the usual remedy is a warranty replacement or a new ring. That is worth knowing before you buy, and it is a reason to check how long the maker supports each model with app and firmware updates.

How does PPG turn reflected light into heart rate, HRV and blood oxygen?

The signal

Blood absorbs light. With each heartbeat a pressure wave expands the small arteries in the finger, so slightly more blood sits under the sensor and slightly less light returns to the photodiode. The PPG signal is that small pulsing change, riding on a much larger constant level from skin, bone and venous blood. The analogue front end removes the constant part, amplifies the pulsing part and digitises it. A clean PPG waveform looks like a train of rounded peaks, one per heartbeat.

Heart rate

Heart rate is the number of pulses per minute. Firmware finds the peaks, or uses a frequency method on a short window of samples, and converts the interval between beats into beats per minute.

Worked example: if the firmware finds 12 peaks in a 10 second window, the rate is 12 × 6 = 72 beats per minute. If the average interval between consecutive peaks is 0.8 seconds, the rate is 60 ÷ 0.8 = 75 beats per minute. The two methods give slightly different answers on the same data, which is one reason two devices worn together rarely agree exactly.

Heart rate variability

Heart rate variability is the variation in time between beats. Rings commonly report a measure based on successive differences in inter-beat intervals, usually from overnight data when you are still, because HRV needs very accurate timing of each beat and motion ruins that.

Worked example of one common measure, RMSSD (root mean square of successive differences): take five inter-beat intervals of 800, 820, 790, 810 and 805 milliseconds. The successive differences are 20, minus 30, 20 and minus 5 milliseconds. Their squares are 400, 900, 400 and 25, which sum to 1,725. The mean is 1,725 ÷ 4 = 431.25, and its square root is about 20.8 milliseconds. A single missed or extra beat would add a difference of hundreds of milliseconds and swamp that result, which is why HRV is computed only on clean stretches of signal.

Blood oxygen

Blood oxygen estimates use two wavelengths, typically red and infrared. Oxygenated and deoxygenated haemoglobin absorb those wavelengths differently, so the ratio of the pulsing signal at the two wavelengths changes with oxygen saturation. The device converts that ratio into a percentage using a calibration curve built from testing. A ring measuring through the finger by reflection works under harder conditions than a clinical clip-on oximeter that shines light through the fingertip, which is one reason ring makers present blood oxygen as a wellness trend, often only overnight.

Respiration rate and other derived values

Breathing slightly modulates the PPG baseline and the beat timing, so some rings estimate breathing rate overnight from the same signal. Sleep stages are estimated from a mix of motion, heart rate, HRV and temperature. These are model outputs, not direct measurements.

What limits accuracy

The peer-reviewed evidence on wearable optical heart rate is clearer than marketing suggests. Bent and colleagues, writing in npj Digital Medicine in 2020, compared six wrist devices (four consumer and two research grade) against an ECG reference in 53 participants spread across all six Fitzpatrick skin tone groups. They found that activity had a significant effect on accuracy, with absolute error during activity on average about 30 percent higher than at rest; for the consumer devices mean absolute error rose from 7.2 to 10.2 beats per minute. Walking tended to push reported heart rate above true heart rate, while typing pushed it below. They reported no statistically significant difference in heart rate accuracy across skin tones overall, while noting a significant interaction between skin tone and one particular device.

That study looked at wrist devices, not rings, so treat it as evidence about the method rather than about any ring. The general lessons carry over:

• Fit. A ring that is loose lets ambient light in and lets the sensor move against the skin. A ring that is too tight can reduce blood flow. Both degrade the signal.
• Motion. Hand movement creates artefacts in the same frequency range as a pulse. Rings get their best data at night, when the hand is still.
• Perfusion and temperature. Cold fingers have less blood flow near the surface, so the pulsing signal is smaller.
• Device and algorithm. Results differ between devices, and between firmware versions of the same device, because the filtering and peak detection are software.
• Skin tone. Light absorption by melanin is a known factor in optical sensing. For heart rate, the study above did not find a consistent overall effect; for blood oxygen, ask whether the maker has published validation across skin tones before relying on the number.

What the FDA says about optical wellness estimates

The FDA's General Wellness guidance, issued on 6 January 2026, replaces the September 2019 version and speaks directly to devices like rings. It says the FDA may consider products that use non-invasive sensing, with optical sensing as the example, to estimate physiologic parameters such as blood pressure, oxygen saturation, blood glucose or heart rate variability to be general wellness products when the outputs are intended solely for wellness uses. The conditions include that the product is non-invasive, is not intended for diagnosing or treating a disease, does not claim to substitute for an authorised device, does not prompt specific clinical action, and does not show values that mimic clinical ones unless those values are validated, for example by manufacturer testing or peer-reviewed literature.

The same guidance says a product is not a wellness product if it is intended to measure or report values for screening, diagnosis, monitoring, alerting or managing a disease, or if its labelling or interface refers to specific diseases or diagnostic thresholds, issues clinical alerts, or claims clinical grade accuracy. A wellness product may suggest that seeing a healthcare professional could be helpful when values fall outside wellness ranges, as long as it does not name a disease, call the value abnormal or provide ongoing disease monitoring. Two of the guidance's illustrative examples are close to rings: a portable product that monitors pulse rate or oxygen saturation during exercise and hiking, and a wrist-worn wearable that measures pulse rate by photoplethysmogram and sleep by accelerometer.

The practical reading for a ring owner is simple. Unless a specific feature on your ring has its own FDA authorisation, which the maker would state, the numbers are wellness estimates. They are useful for trends in your own data. They are not medical readings.

How is power managed on a battery this small?

A ring's battery holds very little energy, so the firmware's job is to keep almost everything asleep almost all of the time.

Duty cycling the sensors

The LEDs are the largest steady consumer, so they are pulsed briefly and only as often as the current mode requires. During the day a ring may sample heart rate periodically rather than continuously; at night, when the signal is cleaner and sleep metrics need it, sampling is more frequent. The accelerometer runs at a low rate and wakes the processor only when motion crosses a threshold. The temperature sensor is read occasionally because temperature changes slowly.

Worked example of why this matters, using illustrative numbers rather than any product's specification: a cell of 20 milliamp hours supplying an average draw of 0.25 milliamps lasts about 20 ÷ 0.25 = 80 hours, a little over three days. If continuous LED sampling raised the average to 1 milliamp, the same cell would last about 20 hours. Every design choice on a ring is a trade between sampling and those hours.

Bluetooth LE connection intervals

Bluetooth Low Energy saves power by letting the two devices agree to talk only at regular connection events and sleep in between. A longer connection interval, and a peripheral latency that lets the ring skip events when it has nothing to send, cut radio power sharply at the cost of slower syncing. Rings therefore buffer readings in flash and sync in bursts when the app opens or on a schedule, instead of streaming. When you open the app and watch the sync spinner, the ring has negotiated a faster interval for the transfer and will slow down again afterwards.

Charging

Rings charge through contacts or through an inductive coil in a dock. The Wireless Power Consortium's Qi standard covers inductive charging for a wide range of products, with Qi v2.0 launched in 2023 and Qi v2.2.1, branded Qi2 25W, launched in July 2025, and only products that pass WPC certification testing may display the Qi or Qi2 logo. A ring with an inductive dock is not automatically Qi certified, and a ring's tiny coil may not charge on a general phone pad at all. Use the charger the maker supplies, and check the maker's documentation before trying any other pad.

Battery ageing

Lithium cells lose capacity with cycles and with time spent at high charge and high temperature. Charging a ring every day to full and leaving it on a warm dock is harder on the cell than topping up when needed. Because the cell cannot be replaced, battery ageing sets the practical life of the ring.

How does firmware get updated over Bluetooth, and how does the ring pair with the phone?

Pairing and bonding

When you set up a ring, the app finds it by its Bluetooth advertisements, connects and starts pairing. NIST's Guide to Bluetooth Security (SP 800-121 Rev. 2) describes the LE pairing methods. LE Secure Connections uses elliptic curve key agreement. The association models differ in whether they protect against an attacker in the middle: Numeric Comparison and Passkey Entry add a check that the two devices agreed keys with each other, while Just Works does not, because neither side displays or confirms a value. A screenless ring often cannot show a passkey, so makers rely on proximity during setup, on out-of-band methods, or on an app-level authentication with the maker's cloud on top of Bluetooth bonding.

Bonding stores the long-term keys on both devices, so later reconnections are encrypted without pairing again. If you remove the ring from your phone's Bluetooth settings, you delete that bond; the ring may also need a factory reset from the app to forget the phone.

On Android, the companion device pairing API, available since Android 8.0 (API level 26), lets an app ask the system to scan for and pair with a nearby accessory without granting the app the fine location permission. That is a privacy improvement for ring apps: the app does not need to see your location just to find the ring.

How an over-the-air update works

A firmware update for a ring has three stages:

1. Download. The app fetches a new firmware image from the maker's server.
2. Transfer. The app sends the image over Bluetooth to the ring, which writes it into a spare area of flash, often called the secondary slot, while still running the old firmware from the primary slot.
3. Verify and swap. On the next reboot a bootloader checks the new image and, if it is valid, swaps it into place.

The open source MCUboot bootloader, used widely in Zephyr based and other microcontroller projects, documents this pattern in detail. It verifies image signatures, supports either swap based upgrades that can revert to the previous image if the new one does not confirm itself, or overwrite based upgrades, and it must be configured at build time to choose between them. It also offers downgrade prevention, which enforces that a new image must carry a higher version or security counter than the one it replaces. The Zephyr project's device firmware upgrade documentation pairs MCUboot with MCUmgr and its SMP protocol, which carries image upload and management commands over transports including Bluetooth.

Not every ring uses these components. Many use their chip vendor's own bootloader and DFU service. The properties to look for are the same:

NIST IR 8259A, the IoT device cybersecurity capability core baseline, names software update as one of its six capabilities, along with device identification, device configuration, data protection, logical access to interfaces and cybersecurity state awareness. NIST IR 8425 profiles that baseline for consumer IoT products. They are useful checklists for asking a ring maker what it does, even though neither is a certification.

Where does the data go, and which laws apply?

The data path

A ring's data typically flows in four hops:

1. Ring to phone. Readings buffered in the ring's flash sync over an encrypted Bluetooth link to the app.
2. Phone to the maker's cloud. Most ring apps upload raw or processed data to the maker's servers, where heavier algorithms compute sleep scores, readiness scores and trends, and where your history is stored so it survives a phone change.
3. Cloud or phone to health platforms. With your permission, apps can write data into a phone health store such as Android Health Connect or Apple HealthKit, where other apps you authorise can read it. Health Connect, for example, defines data types for vitals, sleep sessions, steps and skin temperature.
4. Onward to third parties. Integrations with fitness, nutrition, insurance or employer wellness programmes, research studies and, increasingly, AI assistant features can each receive a copy.

Many ring makers also sell a subscription, and some features, including history and detailed scores, may sit behind it. That changes nothing about what the ring measures, but it does mean the cloud account is central to how the product works.

One maker's policy, as an example of what to read

The only reliable source for how a named company handles data is its own privacy policy, so read the one for your ring. As an example of the kind of statements to look for, Oura's privacy policy, read on 24 October 2026, states that it does not sell or share personal data for cross-context behavioural advertising; that with your permission its services may integrate with third parties including Google Health Connect, Apple HealthKit and LLM providers; and that you can disconnect a third party integration at any time, which prevents future access, but that because it cannot recall data a third party has already received, you should exercise deletion rights directly with that third party. That last point applies to every ring: disconnecting an integration stops new data, it does not delete the old copies.

HIPAA usually does not apply

HIPAA applies to covered entities, such as health plans and healthcare providers, and to their business associates. When you buy a ring yourself and use the maker's app, the maker is usually not a HIPAA covered entity. The FTC's guide to its Health Breach Notification Rule explains that HIPAA covered entities, and companies acting solely as HIPAA business associates, are excluded from the FTC rule because HHS rules cover them, which is the other side of the same line. A ring supplied by your doctor or insurer as part of a care programme could sit on the HIPAA side of that line; the programme's own notices will say so.

The FTC Health Breach Notification Rule

For consumer health products outside HIPAA, the FTC's Health Breach Notification Rule is the main federal breach rule. According to the FTC's business guide, updated in July 2024 for the amended rule:

• The rule covers vendors of personal health records, PHR related entities and their third party service providers.
• A fitness app that can pull data from more than one source, for example from the user and a wearable, is likely a vendor of personal health records, even if some users never connect a tracker.
• A company offering a fitness tracker is likely a PHR related entity if it sends identifiable health information to health apps.
• A breach of security is the acquisition of unsecured identifiable health information without the person's authorisation, and it is not limited to hacking. Unauthorised disclosure, such as sending health data to a social media platform without consent, can count.
• Individuals must be notified without unreasonable delay and within 60 calendar days of discovery. If 500 or more people are affected, the FTC must be told at the same time, and if 500 or more residents of one state are affected, prominent local media must be notified too. Smaller breaches are reported to the FTC within 60 days after the end of the calendar year.
• Violations are treated as unfair or deceptive practices, and the guide lists a civil penalty of up to 53,088 dollars per violation following its January 2025 inflation update.

For ring makers and app developers, the important point is the disclosure clause. A software development kit that quietly sends identifiable health data to an advertising or analytics service, without the user's authorisation, can turn an ordinary app release into a notifiable breach. That is a software supply chain problem as much as a privacy one.

State and international rules

Federal rules are not the whole picture. Some US states and many other countries have their own privacy or health data laws, with their own scope and dates, and this post does not summarise them. If you build or sell rings, check each jurisdiction's own text with counsel; if you wear one, the app's privacy policy should list the rights you have where you live.

Smart ring, smartwatch and chest strap compared

A chest strap's ECG electrodes measure the heart's electrical activity directly, which is why straps remain the usual reference for heart rate during intense exercise. Rings do best overnight. Watches sit in between and carry more features. These are categories, not rankings, and individual models differ.

Step by step: review permissions, sharing, data export, firmware and pairing

These steps are for owners checking their own ring and phone. They change nothing on the ring's firmware and do not bypass any protection.

Step 1: list what the app can access on your phone

On Android, open Settings, then Apps, then the ring's app, then Permissions. Expect Nearby devices (Bluetooth). Question Location if the app was set up through companion device pairing, and question Contacts, Microphone, Camera or Physical activity unless a feature you use needs them.

If you use developer tools, you can list the same grants from a computer. This reads only; it does not change anything:

# Replace com.example.ringapp with the app's package name
adb shell dumpsys package com.example.ringapp | grep -E "permission|granted=true"

On iPhone, open Settings, then Privacy and Security, and check Bluetooth, Location Services and Health for the ring's app.

Step 2: review the health store permissions

On Android, open Health Connect from the phone's Settings (its exact location varies by Android version and phone maker; searching Settings for Health Connect finds it). Choose App permissions and review which apps can write and read which data types. Remove read access from any app you no longer use.

On iPhone, open the Health app, tap your profile, then Apps, and review each app's read and write access.

Step 3: review integrations in the ring's own app

In the ring app's settings, find the list of connected services: fitness platforms, nutrition apps, employer or insurer programmes, research studies and AI assistant features. Disconnect anything you do not actively use. Then, for each service you disconnect, go to that service and delete the data it already holds, because disconnecting stops new data but does not recall old copies.

Step 4: export your data, then decide what to delete

Most ring apps or account websites offer a data export. Download it first, so you keep your own history, and store it somewhere encrypted. Then decide whether to delete account data. Deletion is permanent and usually ends the subscription history and any trends; read what the maker says will be deleted and how long backups take to expire.

Before you request account deletion, check that you are signed in to the right account and have the export saved and opened at least once. Deletion requests are usually irreversible.

Step 5: check firmware status and support

Open the device page in the ring app and note the firmware version. Look for a "check for updates" control and install pending updates while the ring is on its charger with the phone close by. Then find the maker's statement on how long your model will receive updates. A ring that no longer gets firmware or app updates should be treated like any other unsupported device.

Step 6: check Bluetooth bonds

On the phone, open Bluetooth settings and look at paired devices. Remove old rings, test units and anything you do not recognise. On a Linux laptop you have used with a ring or a development kit, you can list paired devices with BlueZ:

bluetoothctl devices Paired
# Older BlueZ releases use:
bluetoothctl paired-devices

To remove a bond for a device you no longer use, first confirm the address is the one you mean:

# Check the device details first; make sure this address is the old ring, not a device you still use
bluetoothctl info AA:BB:CC:DD:EE:FF
# Then remove the bond
bluetoothctl remove AA:BB:CC:DD:EE:FF

Step 7: before you sell, give away or return a ring

Unpair the ring inside the app, which on most models also resets it, then remove it from the phone's Bluetooth list, then remove it from your account. If the app offers a factory reset, use it. A ring that is still linked to your account may keep syncing to it, or may refuse to pair for the next owner.

For teams who build ring firmware: check signing and downgrade protection in your own builds

If you develop firmware for a ring or a similar wearable on MCUboot, confirm in your own build that images are signed and carry a security counter, and check a release image before you ship it. These commands are from MCUboot's imgtool documentation and work only on images and keys you own:

# Sign an application image with your project key and a version
imgtool sign --key root-ec-p256.pem \
  --header-size 0x200 --align 4 \
  --slot-size 0x67000 --version 1.4.2 \
  --pad-header build/app.bin build/app.signed.bin

# Verify the signed image against the key before release
imgtool verify --key root-ec-p256.pem build/app.signed.bin

Then confirm in the bootloader configuration that downgrade prevention is enabled, that the swap mode matches your recovery plan, and that the debug port is locked on production units. Keep signing keys out of the repository and in a hardware backed store, and record which image, key and bootloader version shipped with each hardware revision.

For the app and cloud side, scan the companion app and sync service repositories for known vulnerable dependencies the same way you would any other project. With the Safeguard CLI, for example:

# From the root of the companion app or sync service repository
safeguard scan --dir .
# Or scan an SBOM produced by your firmware build
safeguard scan --sbom build/firmware.cdx.json

Results are written as JSON under ./output.

Common mistakes

• Treating wellness estimates as medical readings. A ring's blood oxygen, temperature trend or HRV is a wellness estimate unless a feature has its own authorisation. The FDA's guidance draws that line explicitly. If a reading worries you, see a clinician and use an authorised device.
• Comparing one night to another device's number. Different devices use different algorithms and placements. Compare your ring to itself over weeks, not to a friend's watch.
• Wearing the ring loose or on a different finger each night. Fit and position change the optical signal. Pick one finger and a snug, comfortable size.
• Leaving third party integrations connected. Every connected service holds a copy of your data, and disconnecting later does not delete those copies.
• Assuming HIPAA protects your ring data. It usually does not. The FTC's rule covers breaches, but day to day handling is governed by the maker's privacy policy and any state law that applies.
• Ignoring end of support for the app or the model. When the maker stops updating a model or its app, security fixes stop too. Check support periods before buying and plan a replacement.
• Putting the ring on any wireless charger. A ring's coil and dock are matched. Use the supplied charger unless the maker says otherwise.
• For builders: shipping without downgrade prevention. Signed images alone do not stop someone reinstalling an older, validly signed image with a known bug.
• For builders: adding analytics SDKs to a health app without checking what they send. Under the FTC's rule, an unauthorised disclosure can be a notifiable breach.

FAQ

How does a smart ring measure heart rate?

It shines LED light into the palm side of your finger and measures, with photodiodes, how much light comes back. Each heartbeat briefly increases blood volume under the sensor, which changes the reflected light. Firmware counts those pulses and converts them to beats per minute.

Are smart rings accurate?

They can be accurate for resting heart rate and overnight trends when the ring fits well, and less accurate during movement. A peer-reviewed study of wrist wearables found error during activity was on average about 30 percent higher than at rest. Treat ring numbers as wellness estimates and compare them over time against your own baseline.

Is a smart ring a medical device?

Usually not in the US. Under the FDA's January 2026 general wellness guidance, optical wearables that estimate values such as heart rate variability or oxygen saturation for wellness can be low risk wellness products, provided they avoid disease claims and clinical alerts. If a specific feature has FDA authorisation, the maker will say so.

Does HIPAA protect smart ring data?

Usually not when you buy the ring yourself. HIPAA applies to covered entities, such as health plans and providers, and their business associates. Consumer health apps and trackers are more likely to fall under the FTC's Health Breach Notification Rule, plus whatever the maker's privacy policy promises.

Can you replace a smart ring's battery?

In practice, no. The battery is curved to fit one size and is set in resin with the circuit board, and opening the shell ends water resistance. When the battery fades, the usual options are a warranty replacement or a new ring.

How long does a smart ring battery last?

Makers typically quote several days per charge, and the figure varies by size and model because larger rings have room for a slightly bigger cell. Heavier sensor use, such as frequent daytime readings, shortens it. Capacity also declines as the cell ages.

Can I charge a smart ring on a Qi charger?

Only if the maker says so. Some rings charge through metal contacts, others through a small coil in a matched dock, and only products that pass Wireless Power Consortium testing may carry the Qi or Qi2 logo. Use the supplied charger unless the documentation says otherwise.

How do smart ring firmware updates work?

The phone app downloads a new image and sends it to the ring over Bluetooth. The ring stores it in a spare area of flash, and on reboot a bootloader checks the image's signature before switching to it. Good designs can revert if the update fails and refuse older images with known bugs.

Who can see my smart ring data?

The maker, through its app and cloud, plus any service you connect, such as a phone health store, a fitness platform, an employer programme or an AI feature. Check the app's integrations list and the maker's privacy policy, and delete data from services you disconnect.

How do I delete my smart ring data?

Export your data first, then disconnect integrations and delete data held by each connected service, then request account deletion in the app or on the maker's website. Remove the ring from your phone's Bluetooth list and reset it before passing it on.

Where Safeguard fits, honestly

Safeguard does not make, test or analyse rings. It does not scan firmware binaries, verify bootloader signatures, generate a hardware bill of materials, manage devices, check Bluetooth pairing or assess sensor accuracy, and its models are single-purpose security models for software, not for optics, batteries or physiological signals. The fit is narrower and real: the software around a ring is ordinary software. Companion apps pull mobile SDKs and analytics libraries, sync services pull web frameworks and container base images, and firmware projects pull an RTOS, a Bluetooth stack and a bootloader. Safeguard scans repositories, container images and SBOM files for known vulnerable components, shows which projects carry a given component and version, ranks findings by reachability where it can, and can open fix pull requests when a fixed version exists, with autonomous remediation switched off by default.

Every release of a ring's app or sync service rebuilds against its dependencies again, and ring firmware bundles open source stacks with their own advisories, so software supply chain hygiene still decides whether a fix you depend on reaches the finger. The fit is indirect for the hardware and direct for the code a team builds and ships around it.

A ring's hardware cannot be patched by its owner, but the software around it can: the companion app, the sync service and the open source Bluetooth stack, RTOS and bootloader inside the firmware are rebuilt and redeployed by the teams that make them. That is where the steps below apply, and fork and patch, the last of them, is early access.

Fix it without waiting for upstream

Whatever the vulnerability, most of the risk sits in two gaps. The first is the time between a fix being published and that fix actually running in your production builds. The second, and worse, is the time before any fix exists at all, while a maintainer works out a patch and a release schedule. Waiting through both gaps is a habit, not a requirement. Safeguard gives teams three ways to close them.

1. Autonomous remediation: pull requests, not tickets

When a fixed version exists, Safeguard's Griffin models open a tested, policy gated pull request that moves the affected dependency to the safe version. You can run it on one repository or in bulk across every project that carries the vulnerable version. Remediation covers eight categories, including dependencies, licenses, security posture and findings. Reachability analysis ranks the vulnerable code paths your application actually calls first, so the first pull requests you merge are the ones that matter most. Autonomous remediation ships switched off, with every category set to Manual, so your team decides how much runs on its own and what still needs a human approval.

2. Gold Open Source: the safe version in seconds, free

gold.safeguard.sh is free and needs no login. Search any CVE or package to see affected and fixed versions, CVSS, EPSS, CISA KEV status and a recommended safe version, or use the "Am I affected?" checker. The same data is available through a free read API, README status badges and RSS threat feeds. The safeguard-sh/gold-scan-action GitHub Action can fail a build on a known exploited vulnerability, on any known vulnerability, or never, so a version you have just removed cannot quietly come back in next week's merge.

3. Gold Registry: start from components that are already fixed

registry.safeguard.sh provides hardened, drop in replacements for upstream packages and container images. Every Gold artifact is held continuously to zero exploitable critical or high CVEs, zero malware and a completed license check, with SLSA L3 or higher provenance, a Sigstore signature and a public evidence page you can hand to an auditor. An artifact loses its Gold badge if it regresses. Teams can point their own package directory at the registry so hardened equivalents resolve without changing how developers install anything.

When upstream has no fix yet, or will not ship one, Safeguard first works to get the fix accepted upstream. If the issue is severe or upstream will not move, Safeguard builds a fork, fixes the vulnerability there and publishes a hardened Gold build, so you are not stuck on a maintainer's release schedule. You can also request a hardened, compatibility tested build of a specific package. This fork and patch flow is in early access today, so ask which packages it covers before you plan around it.

One honest limit: when the vulnerable code lives in a vendor appliance, a hosted service or an operating system runtime you do not build yourself, the fix still has to come from that vendor or distribution. The steps above apply to the open source dependencies and container images you build and ship, which is where most teams carry the largest and least tracked share of their exposure.

See how Safeguard would help

The first demo is a real Safeguard CLI session asked to fix a lodash CVE. It reads the finding and advisory, asks before each command, edits package.json to the fixed version, runs npm install and npm test with approval, prints a summary and pushes nothing. The same flow fits a ring's web dashboard or a health data sync service your team maintains.

Click through it at your own pace, or open it full screen.

The second demo sets up the Safeguard runner on your own machine, approves it with its device code and scans from the terminal. That suits firmware teams who build ring images on their own hardware and want scans of the repository and its SBOM to run next to the toolchain, without sending the source elsewhere.

Click through it at your own pace, or open it full screen.

The third demo is a real Android session: send work to a computer running the CLI and approve each command on the phone with Allow once, Allow for turn or Deny. A developer away from the desk can approve a dependency fix in a companion app repository, and nothing runs unattended.

Click through it at your own pace, or open it full screen.

To try it on your own repositories, download Safeguard and follow the CLI documentation.

Quick check

Sources

• FDA, General Wellness: Policy for Low Risk Devices (guidance page)
• FDA, General Wellness guidance, issued 6 January 2026 (PDF)
• FTC, Complying with FTC's Health Breach Notification Rule
• Bent B, Goldstein BA, Kibbe WA, Dunn JP. Investigating sources of inaccuracy in wearable optical heart rate sensors. npj Digital Medicine 3, 18 (2020)
• Bluetooth SIG, Core Specification 6.0
• NIST CSRC, SP 800-121 Rev. 2, Guide to Bluetooth Security
• NIST CSRC, IR 8259A, IoT Device Cybersecurity Capability Core Baseline (May 2020)
• NIST CSRC, IR 8425, Profile of the IoT Core Baseline for Consumer IoT Products (September 2022)
• Wireless Power Consortium, Qi wireless charging
• MCUboot, Bootloader design
• Zephyr Project, Device Firmware Upgrade
• Android Developers, Health Connect
• Android Developers, Companion device pairing
• Oura, Privacy Policy

Last reviewed: 24 October 2026.