How a Smartwatch Is Made: Sensors, SoC, Battery, Firmware and Pairing

A smartwatch is made by packing a low power system on chip or microcontroller, a small OLED or LCD display, a lithium polymer pouch cell, optical heart rate (PPG) and often ECG sensors, a motion sensor, radios and a haptic motor into a sealed case, then flashing firmware and pairing it to a phone. The phone does most of the heavy lifting: it delivers firmware updates, syncs health data to the cloud and holds the keys that let the watch trust it. That pairing, and where the health data goes afterwards, is where most of the security and privacy questions live.

This post goes one level deeper than our smartphone build explainer. For the cell chemistry behind the battery see how lithium ion batteries are made, for the panel see how OLED and LCD displays are made, and for the radio side see our posts on Bluetooth versions and their security history and Bluetooth LE GATT, pairing and bonding.

Watch makers keep bills of materials, yields and factory scripts private. We cite primary sources where they exist and otherwise describe steps without inventing numbers.

Key takeaways

• A smartwatch has a phone's building blocks, shrunk and power starved: a chip, memory, a touch display, a pouch cell, sensors, radios, a haptic motor and a sealed case.
• Optical heart rate shines LEDs into the skin and measures reflected light. Motion, fit, cold skin and skin optics all limit accuracy.
• A watch ECG is a single lead recording made by closing a circuit between the wrist and a finger of the other hand. The FDA classified the first over the counter ECG app for a watch through the De Novo route on 11 September 2018 under 21 CFR 870.2345.
• Watch batteries are small lithium polymer cells. IEC 62133-2:2017 sets safety tests for portable lithium cells, and US transport rules in 49 CFR 173.185 require cell types to pass the UN Manual of Tests and Criteria section 38.3.
• Water resistance claims for watches come from two different worlds: ISO 22810 for water resistant watches, and the IEC 60529 IP code for enclosures of electrical equipment. They are not interchangeable.
• Software ranges from a real time operating system on a microcontroller to a full operating system such as watchOS or Wear OS. Most updates reach the watch through the phone over Bluetooth LE or Wi-Fi.
• Bluetooth LE Secure Connections (Security Mode 1 Level 4, added in Bluetooth 4.2, adopted December 2014) is the mode NIST recommends. Just Works pairing gives no protection against a man in the middle.
• In the US, most fitness and health data from consumer watches falls outside HIPAA. The FTC Health Breach Notification Rule, amended in 2024, explicitly covers internet connected devices that track fitness, sleep and vital signs. In the EU and UK, health data is special category data.

Wafer, cell and glass to boxed watch: the step table

This table is the map for the rest of the post. The order of the late steps varies by maker; no maker we found publishes per stage yields, so each row names the check rather than a percentage.

Steps 1 to 4 happen across many suppliers, so a single watch is a supply chain of its own. Step 9 is where security is won or lost: if debug ports stay open or every unit shares a key, later software work cannot fix it.

A concrete open source example of step 9

Commercial factory scripts are private, but one open source project documents its factory files in public. The InfiniTime firmware for the PineTime watch publishes the files needed by the factory: a merged-internal.hex file holding the bootloader plus the firmware image, flashed at offset 0x00 of the nRF52832 microcontroller's internal flash, and a spinor.bin recovery firmware image flashed at offset 0x00 of the external SPI NOR flash. The project's bootloader README notes that the application image sits at offset 0x8000 of internal flash. That is the whole idea of factory flashing in miniature: a bootloader, a main image and a recovery image, each at a known address.

A dated timeline of smartwatch standards and rules

What is inside a smartwatch?

Open a smartwatch and you find a stack of layers, from the cover glass down to the sensor window on the back. Here is each part and what it does.

The brain: SoC or microcontroller

There are two broad designs.

• Application processor watches run a full operating system on a system on chip with one or more application cores, a GPU, a few hundred megabytes to a few gigabytes of RAM and several gigabytes of flash. They usually add a low power co-processor or always on microcontroller that handles sensors and the clock face while the main cores sleep.
• Microcontroller watches run a real time operating system on a single microcontroller with an integrated Bluetooth LE radio, hundreds of kilobytes of RAM and a few megabytes of flash, often split between internal flash and an external SPI NOR chip. The PineTime is an example: InfiniTime runs on its nRF52832 with FreeRTOS, the LVGL graphics library and the Apache NimBLE Bluetooth stack, according to the project README.

The choice drives almost everything else: battery life, which apps can run, how updates work and how big the attack surface is.

Display and touch

Watch screens are small OLED panels or, on long battery life watches, low power LCDs, with a capacitive touch layer under strengthened glass, sapphire or polymer. The display driver IC and touch controller run small firmware of their own. Our display build post covers the panel process in depth.

Battery and charging

A lithium polymer pouch cell, shaped to fit around the board, is usually the single largest part by volume. A power management IC handles charging, voltage rails and a fuel gauge that estimates remaining charge. Charging is usually inductive through the back, sometimes with pogo pins instead.

Sensors

• PPG optical module: LEDs (commonly green for heart rate, plus red and infrared for blood oxygen estimates) and photodiodes behind the back window.
• ECG electrodes: on watches that offer an ECG, one electrode on the back and another in the crown or bezel.
• IMU: a MEMS accelerometer and gyroscope for steps, workouts, fall detection and wrist raise.
• Others: barometric altimeter, magnetometer, ambient light sensor, skin temperature sensor, and on some models a microphone for voice input.

Radios

Bluetooth LE is universal; many watches add Wi-Fi, NFC, GNSS and sometimes LTE with an embedded SIM. Each radio has its own firmware, and antennas must work through a case pressed against a wrist.

How are the optical heart rate (PPG) and ECG sensors built?

PPG: light in, light out

Photoplethysmography measures how much light comes back from the skin. Each heartbeat pushes a pulse of blood through the small vessels under the sensor, which changes how much light is absorbed, so the reflected signal ripples at the heart rate. The module is built from LED dies and photodiode dies mounted on a small substrate, with optical barriers between them so light cannot leak straight across without going through skin, and a lens or window on the back crystal. An analog front end chip drives the LEDs in short pulses and samples the photodiodes, and firmware turns raw samples into beats.

What limits PPG accuracy

The physics is simple, the signal is not. The things that degrade it are well known:

• Motion. Arm movement shifts the sensor against the skin and moves blood around. Firmware uses the accelerometer to model and subtract motion, but hard interval sport is still the worst case.
• Fit. A loose strap lets ambient light in and lets the sensor move. A strap that is too tight squeezes the vessels.
• Perfusion. Cold skin and low blood flow give a weak signal.
• Skin and tattoos. How light passes through skin varies with pigmentation, hair and ink, which changes signal strength. That is one reason regulators ask for validation across varied users before any clinical claim.
• Placement. A wrist is a noisier site than a fingertip or ear lobe.

Estimates built on PPG, such as blood oxygen, heart rate variability, sleep stages or blood pressure trends, inherit all of those limits. The FDA's January 2026 general wellness guidance says non-invasive optical estimates of values like blood pressure or oxygen saturation can stay general wellness outputs only if they serve wellness uses, do not prompt clinical action, and are validated when they mimic clinical values.

ECG: closing a circuit across the body

A watch ECG uses two electrodes: one on the back touching the wrist, one on the crown or bezel. When you touch the crown with a finger of the other hand, the circuit runs across your chest and the watch records a single lead signal. The FDA's De Novo letter for the first over the counter watch ECG app describes it as a single channel recording similar to a Lead I ECG, used to classify atrial fibrillation or sinus rhythm, and states the app is not intended for people under 22 years old. That classification created the regulation for electrocardiograph software for over the counter use, 21 CFR 870.2345, product code QDA.

The hardware is two conductive electrodes, a very low noise analog front end and firmware that filters mains hum and muscle noise. Accuracy suffers from poor contact, dry skin and movement, and a single lead cannot see everything a 12 lead hospital ECG sees.

How sensors are calibrated in the factory

Each unit gets trims, such as accelerometer offset and gain or LED drive current, written to flash during provisioning and normally kept apart from the main image so an update cannot overwrite them.

How are watch batteries and charging coils built?

The cell

Watch cells are lithium ion cells in a pouch format, commonly called lithium polymer. The electrodes are coated foils (a cathode on aluminium, a graphite anode on copper) with a separator between them, either stacked as sheets or wound and flattened, then sealed in a laminated aluminium pouch, filled with electrolyte, formed with the first charge cycles and aged to catch early failures. A protection circuit guards against overcharge, overdischarge and short circuits. Our battery manufacturing post walks through the chemistry and the cell line in detail.

Safety tests that apply

Two sets of requirements matter most for a watch cell.

• IEC 62133-2:2017. The IEC describes it as setting requirements and tests for the safe operation of portable sealed secondary lithium cells and batteries, under intended use and reasonably foreseeable misuse. The 2017 edition split nickel systems into a separate Part 1, added coin cell requirements, updated how cells are assembled into batteries and added vibration and shock tests. Amendment 1 followed in 2021.
• UN 38.3 for transport. In the US, 49 CFR 173.185 requires each lithium cell or battery to be of a type proven to meet the criteria in part III, sub-section 38.3 of the UN Manual of Tests and Criteria before it ships. Cell types that only met Revision 3 of the manual are no longer valid.

The charging coil

Most watches charge inductively: a transmitter coil in a puck creates an alternating magnetic field, and a receiver coil behind the back crystal turns it into current. The receiver is a small coil of copper wire or a printed coil with a ferrite sheet behind it to shield the electronics and concentrate the field. Many watches use a maker specific puck and protocol rather than the Qi standard used by phones, so check the maker's documentation before assuming a phone charger will work.

The Wireless Power Consortium says Qi launched in 2010, Qi v2.0 launched in 2023 with magnetic attachment for alignment, and Qi v2.2.1, branded Qi2 25W, launched in July 2025. Magnetic alignment is the same idea watch pucks have used for years: if the coils line up, less energy turns into heat. Heat is the enemy of a sealed watch, because it ages the cell and stresses adhesives.

How is a watch sealed and tested for water resistance, drops and sweat?

Two rating systems

Watches carry water claims from two separate standards worlds:

IEC lists IEC 60529 as the classification of degrees of protection provided by enclosures for electrical equipment with a rated voltage not exceeding 72.5 kV, consolidated as the 1989 second edition with amendments in 1999 and 2013. We could not retrieve the ISO catalogue page for ISO 22810 during research, so we do not quote its test conditions here; read the standard or the maker's statement of which tests were run.

How sealing is built

Sealing is a stack of small decisions: a gasket at every opening, adhesive bonding of the cover and back crystal, a sealed crown, and membranes over speaker, microphone and barometer ports that pass sound and air pressure but not liquid water.

How it is tested

Factories commonly air leak test every unit, because it is fast and dry, and run immersion and pressure tests on samples. Sweat, drop, button cycling and temperature tests belong to qualification rather than every unit testing. Adhesives and gaskets age, which is why makers warn that water resistance can decline over time.

What software runs on a smartwatch?

The layers

From the bottom up, a watch usually has:

1. Boot ROM and bootloader. Code in mask ROM verifies and starts a first stage bootloader, which verifies and starts the operating system. On microcontroller watches the bootloader may be MCUboot or a vendor bootloader.
2. Operating system. An RTOS on microcontroller watches; watchOS or Wear OS on application processor watches.
3. Radio and sensor firmware. The Bluetooth controller, Wi-Fi, GNSS, cellular modem, display driver, touch controller and sensor hubs each have firmware, often supplied as binary blobs by the chip maker.
4. System services and apps. Watch faces, workout tracking, notifications, payments.
5. Companion app on the phone. Pairing, settings, firmware download and health data sync.
6. Cloud services. Account, backup, health data storage and sharing.

What platform docs say about the big two

Apple's Platform Security guide says Apple Watch uses many of the same hardware based security capabilities as iPhone and iPad: it performs secure boot and secure software updates, maintains operating system integrity and protects data on the device and in communication with a paired iPhone or the internet. It also implements hardware encrypted storage and class based protection of files and keychain items, and watchOS can be set to update overnight.

Google's Wear OS documentation describes the Data Layer API that phone and watch apps use to sync. When the devices are connected over Bluetooth there is a single encrypted channel using standard Bluetooth encryption managed by Google Play services. When Bluetooth is unavailable, data is routed through Google Cloud, and the docs say all data transferred that way is end to end encrypted. For the phone and watch apps to talk at all, the package name and the signing signature must match on both devices. Health Services on Wear OS gives apps access to exercise, passive monitoring and spot measurements, so third party apps do not drive the sensors directly.

How firmware updates reach the watch

Updates nearly always travel through the phone:

• Full OS watches download the update over Wi-Fi or through the phone, verify its signature, install it into an inactive partition or staging area and switch over on reboot. Android's A/B update design keeps two sets of partitions, normally called slot A and slot B, so a device can fall back to the old slot and keep a working system if the update fails. Watches often require a minimum charge level and the charger attached.
• Microcontroller watches receive a whole image over Bluetooth LE using a device firmware update (DFU) protocol driven by the companion app. The watch writes the image to a secondary slot, and the bootloader swaps it in.

InfiniTime is a good open example of the second pattern. Its bootloader README explains that the bootloader is based on MCUboot and deliberately has no Bluetooth stack: the running firmware downloads the new image into the external SPI flash, and at the next boot the bootloader swaps the old and new images. If the new firmware does not mark itself valid, the bootloader reverts to the old one at the next reset. The README also documents what happens in degraded cases: the firmware does a CRC check before applying an update, and the bootloader starts a watchdog just before running new firmware so that a frozen image resets the chip after about seven seconds and rolls back. Its BLE documentation describes the DFU archive as a firmware .bin plus a .dat init packet, and tells users to validate the firmware in settings after updating.

Signed images, rollback and downgrade protection

A CRC catches corruption, not tampering. That is the job of signatures. The MCUboot design documentation explains that the bootloader can embed one or more public keys at build time and that the final step of its integrity check is verifying that the image was signed with the matching private key. It can also take a key hash from hardware instead of compiling the key in. For downgrade protection, MCUboot supports a security counter in the signed image metadata, compared against a counter stored in trusted non volatile storage, so an attacker cannot install an older, vulnerable but validly signed image.

Whether those features are on is a build decision. The image creation command in InfiniTime's bootloader README creates an image with imgtool without passing a signing key, which suits a hobbyist watch that owners are meant to reflash. A commercial watch should ship with signature checking enforced, a security counter in use and debug ports locked, and the maker should say so.

How does a watch pair and stay bonded with a phone?

Bluetooth LE security modes in plain words

NIST SP 800-121 Rev. 2 lays out the Bluetooth LE security model clearly:

The pairing method decides whether the result is authenticated:

A watch with a screen can show a code, so it has no excuse to use Just Works. Fitness bands without screens often do, and the security then depends on what the band does after pairing.

Privacy: rotating addresses

A watch advertises constantly, so a fixed Bluetooth address would let anyone with a receiver follow you. LE privacy uses an Identity Resolving Key exchanged at pairing to generate Resolvable Private Addresses that change over time; only bonded devices holding the key can recognise them, as NIST describes. Apple's guide says the BLE device address on Apple Watch rotates at 15 minute intervals.

What Apple documents for watch pairing

Apple's Platform Security guide describes the pairing flow in detail. An Apple Watch can pair with only one iPhone at a time, and unpairing tells the watch to erase all content and settings. Pairing uses a secret encoded in an animated pattern on the watch, captured by the iPhone camera, with a six digit PIN as a fallback. With watchOS 26 and iOS 26 or later, the devices exchange keys over an IKEv2 connection authenticated either with the secret from the pattern or with a PIN derived secret using SPAKE2+, and ML-KEM-1024 adds post quantum protection alongside elliptic curve Diffie Hellman. Each device then generates Ed25519 key pairs; on the watch the private keys are rooted in its Secure Enclave. With older versions, the pattern secret is used for BLE out of band pairing and the PIN for BLE Passkey Entry, then the devices exchange keys over IKEv2/IPsec or an IDS based process.

After key exchange, the Bluetooth session key is discarded, and traffic between iPhone and watch is encrypted with those keys, with the Bluetooth, Wi-Fi and cellular link encryption as a second layer. The guide lists AES-256-GCM for iOS 15 or later with Apple Watch Series 4 or later on watchOS 8 or later, ChaCha20-Poly1305 for older combinations, and ML-KEM-768 for post quantum protection with iOS 26 and watchOS 26.

What Android documents for companion pairing

On Android, a companion app usually pairs through the Companion Device Manager. Google's documentation says that on Android 8.0 (API level 26) and higher, companion device pairing scans for nearby Bluetooth or Wi-Fi devices on the app's behalf without the app needing the fine location permission, and the API supports device profiles, including one for watches. The pairing method itself is still negotiated by the Bluetooth stacks on the two devices.

What happens when the phone is lost

Three things matter when the phone goes missing:

• The watch keeps its own lock. Apple documents wrist detection: if it is on, the watch locks soon after it is removed from the wrist, and Apple Pay then needs the watch passcode.
• Theft protection ties the watch to an account. Apple documents that when Find My is on for the iPhone, the paired watch can use Activation Lock, which requires the Apple Account and password to unpair, erase or reactivate it.
• Re-pairing usually means a reset. On most platforms, pairing the watch with a new phone means erasing the watch and restoring from a backup. Check your platform's own help pages for the exact flow, because backup behaviour differs between makers.

If a companion app keeps health history only on the phone, losing the phone loses the history, so export it regularly.

Where does health data go, and what rules cover it?

The data path

Sensor samples become heart rate, sleep and workout records on the watch, sync to the companion app, then usually to the maker's cloud, and from there to whatever other apps, wellness programmes or clinicians the user connects. Every hop is a place where a permission, an API key or a database can leak.

United States: HIPAA has limits, the FTC rule fills the gap

HIPAA applies to covered entities such as health plans and most providers, and to their business associates. A consumer buying a watch and syncing it to the maker's app is usually outside HIPAA. The Federal Register notice for the FTC's 2024 amendments says the Health Breach Notification Rule requires vendors of personal health records and related entities that are not covered by HIPAA to notify individuals, the FTC and sometimes the media of a breach of unsecured identifiable health data.

The current rule text in 16 CFR Part 318 is specific about wearables:

• Scope. "Health care services or supplies" includes any online service such as a website, mobile application or internet connected device that tracks diseases, vital signs, bodily functions, fitness, fertility, sleep, mental health, diet and more.
• What a personal health record is. An electronic record that can draw information from multiple sources and is managed, shared and controlled by or primarily for the individual. A watch app that also imports data from a phone or another app can fall inside that.
• What a breach is. Unauthorized acquisition, which includes an unauthorized disclosure, not only a hack. Sharing data with an advertiser without authorisation can count.
• Deadlines. Notices to individuals and the media go out without unreasonable delay and no later than 60 calendar days after discovery. A breach affecting 500 or more people requires notice to the FTC at the same time as notice to individuals; smaller breaches can be logged and reported annually, within 60 days after the end of the calendar year. Media notice applies when 500 or more residents of a state or jurisdiction are affected.
• Penalties. A violation is treated as an unfair or deceptive act or practice, which carries civil penalties.

The amendments were published on 30 May 2024 and took effect on 29 July 2024.

FDA: wellness product or medical device?

The FDA line depends on intended use and claims, not on hardware. The January 2026 general wellness guidance gives worked examples, including a wrist worn product that reports sleep, pulse rate and blood pressure from PPG for activity and recovery: it can be a low risk general wellness product provided its blood pressure values are validated, but not if its claims imply use in a medical or clinical context. Features like the ECG app are cleared or classified as devices, with their own labelling limits.

EU and UK: special category data

Under the GDPR and the UK GDPR, data concerning health is special category data. The UK Information Commissioner's Office lists health data, genetic data and biometric data used for identification among the special categories and notes that some other protected characteristics can count as health data where they reveal information about health. Processing special category data needs both a lawful basis and a separate condition, which in consumer wearables is usually explicit consent.

Baselines for connected devices

NIST IR 8425 (September 2022) sets a cybersecurity baseline for consumer IoT products and is a useful checklist for what a watch maker should be able to describe, from software updates to data protection.

Step by step: review a watch's permissions, data sharing and update status

Here is a practical walkthrough. The phone steps apply to any watch; the command line steps are optional for people who want to see more.

1. Inventory what you have

Write down the watch model, companion app, phone OS version and every third party app that reads health data from the watch's app or platform.

2. Check the firmware and OS versions

In the companion app, find the watch's software version and whether automatic updates are on. Compare with the maker's latest release notes. If a watch has not had an update in a year, check whether the maker still supports it.

On a Wear OS watch with developer options and debugging enabled (Google's docs describe debugging Wear OS over Wi-Fi), you can read version details with standard Android commands:

# List connected devices; the watch should appear once debugging is authorised
adb devices

# Build fingerprint and security patch level of the watch
adb -s <watch-serial> shell getprop ro.build.fingerprint
adb -s <watch-serial> shell getprop ro.build.version.security_patch

# Third party packages installed on the watch
adb -s <watch-serial> shell pm list packages -3

Turn debugging off again when you are done; an open debug bridge is an attack surface.

3. Review permissions on the watch and the phone

Check which apps have body sensor, activity, location, microphone and notification access on both devices. For any Android package you are unsure of:

# Show granted runtime permissions for one package
adb -s <watch-serial> shell dumpsys package <package.name> | grep "granted=true"

Remove access for apps you no longer use, on the watch and in the phone's health data sharing settings.

4. Review cloud sharing and account security

In the maker's account settings, check connected services, research programmes and data export options. Turn on two step sign in for the account, because the account usually controls theft locks and holds years of health history. Export a copy of your data so you know what the maker holds.

5. Check how the Bluetooth bond was made (Linux, optional)

If you pair a watch or band with a Linux machine for development or a third party app, BlueZ can tell you about the bond. These commands do not change anything:

# List paired devices and inspect one
bluetoothctl devices Paired
bluetoothctl info AA:BB:CC:DD:EE:FF

# Was the LE long term key created by an authenticated pairing?
# (prints only the flag lines, not the key itself)
sudo grep -E "^\[LongTermKey\]|Authenticated|EncSize" \
  /var/lib/bluetooth/<adapter-address>/AA:BB:CC:DD:EE:FF/info

Authenticated=0 on the long term key means the pairing was unauthenticated, typically Just Works. To capture your own adapter's HCI traffic while pairing and see the method that was negotiated, run sudo btmon in a second terminal.

Removing a bond is reversible but breaks the connection until you pair again. Confirm the address first:

# Confirm the address belongs to the device you mean before removing it
bluetoothctl info AA:BB:CC:DD:EE:FF | grep -E "Name|Paired|Bonded"
bluetoothctl remove AA:BB:CC:DD:EE:FF

6. If you build firmware: sign images and use a security counter

For teams building microcontroller wearables on MCUboot, the imgtool documentation shows the key and signing flow. Keep the private key off build machines that run untrusted code, ideally in a hardware backed store managed by your release team.

# Generate a signing key (keep the private key offline or in an HSM)
./scripts/imgtool.py keygen -k release-ecdsa-p256.pem -t ecdsa-p256

# Export the public key as C source to compile into the bootloader
./scripts/imgtool.py getpub -k release-ecdsa-p256.pem > sign_key.c

# Sign the application image with a version and a security counter
./scripts/imgtool.py sign --key release-ecdsa-p256.pem \
  --header-size 0x200 --pad-header --align 4 \
  --slot-size 0x74000 --version 1.4.0 --security-counter 7 \
  app.bin app-signed.bin

The header size and slot size must match your flash layout; the values above are placeholders. Enable signature checking and, if your hardware has trusted counter storage, hardware rollback protection (MCUBOOT_HW_ROLLBACK_PROT) in the bootloader configuration. Then, on a development board, try a deliberately unsigned image and an older signed image and confirm the bootloader refuses both.

7. Scan the software around the watch

The companion app, the cloud sync service and the firmware repository all pull open source components. Scan them like any other codebase:

# Companion app or sync service repository
safeguard scan --dir .

# A container image for the sync back end
safeguard scan --image registry.example.com/watch-sync:1.8.2

# A firmware SBOM you generate in your build
safeguard scan --sbom firmware-sbom.cdx.json

Results land as JSON under ./output. Firmware written in C often has no package manifest, so an SBOM that lists the RTOS, Bluetooth stack, graphics library and bootloader versions is the practical way to get those components into any scan.

Common mistakes

• Treating a depth figure as a diving rating. "50 m" on a watch is a test pressure, not a promise that it survives a 50 metre dive or a high pressure jet.
• Treating IP68 as a fixed test. IPX8 conditions are agreed by the manufacturer, so read what was actually tested.
• Assuming HIPAA protects watch data. It usually does not. The FTC rule and state laws are what apply to most consumer health apps in the US.
• Leaving Just Works pairing on a device that has a screen. If a watch can show a number, use Numeric Comparison or Passkey Entry.
• Shipping firmware with a CRC but no signature. A CRC finds corrupted downloads, not modified ones.
• Signing without downgrade protection. A validly signed old image with a known bug can be reinstalled unless a security counter blocks it.
• Leaving SWD or JTAG debug ports open in production. Physical access then means full firmware read and write.
• Reusing one key across every unit. One extracted key should never unlock a fleet.
• Forgetting the companion app. Health data often leaks from the app, its analytics SDKs or the cloud API rather than from the watch.
• Ignoring end of support. A watch that no longer gets updates keeps its old Bluetooth stack and OS forever.

FAQ

How does a smartwatch measure heart rate?

With photoplethysmography: LEDs shine into the skin and photodiodes measure how much light returns. Each heartbeat changes blood volume under the sensor, so the reflected light pulses at the heart rate. Motion, a loose strap and cold skin are the usual causes of bad readings.

Is a smartwatch ECG the same as a hospital ECG?

No. A watch records a single lead signal similar to Lead I by closing a circuit between the wrist and a finger of the other hand. A hospital 12 lead ECG looks at the heart from many angles. The FDA's first over the counter watch ECG app was classified to detect atrial fibrillation or sinus rhythm, not to diagnose other conditions.

Is a 50 m water resistant watch safe for swimming?

Often yes for surface swimming, but the figure is a test pressure, not a depth limit, and seals age. Check the maker's guidance for swimming, showers, saunas and high speed water sports, and look for a separate diving rating if you dive.

How do smartwatch firmware updates work?

The phone or Wi-Fi delivers a signed update. Full OS watches install into an inactive partition and switch on reboot, with a fallback if it fails. Microcontroller watches receive a whole image over Bluetooth LE, store it in a second slot, and the bootloader swaps it in and can roll back if it does not start correctly.

Is Bluetooth pairing between a watch and phone secure?

It can be. LE Secure Connections with Numeric Comparison, Passkey Entry or Out of Band pairing resists a man in the middle. Just Works does not. Platforms such as Apple's add their own key exchange on top of Bluetooth, as described in Apple's Platform Security guide.

What happens to my watch if I lose my phone?

The watch keeps working for timekeeping and on device features, but sync, updates and many apps depend on the phone. Theft locks such as Apple's Activation Lock tie the watch to your account. Pairing to a new phone usually means erasing the watch and restoring from backup.

Does HIPAA cover my smartwatch health data?

Usually not, unless the data is handled by or for a health plan, provider or their business associate. In the US, the FTC Health Breach Notification Rule covers many consumer health apps and connected devices that are outside HIPAA.

Can I run open source firmware on a smartwatch?

On some models, yes. The PineTime ships with InfiniTime, which is GPL licensed and built on FreeRTOS, LVGL and NimBLE, and pairs with open companion apps such as Gadgetbridge, an Android app that manages watches and bands without the vendor app. Most commercial watches lock their bootloaders.

Where Safeguard fits, honestly

Safeguard does not make, test or analyse watches. It does not scan watch firmware binaries, verify bootloader signatures, generate a hardware bill of materials, manage devices or check Bluetooth pairing, and its models are single-purpose security models for software, not for sensors, batteries or medical signal processing. The fit is narrower and real: the software around a watch is ordinary software. Companion apps pull mobile SDKs and analytics libraries, cloud sync services pull web frameworks and container base images, and firmware projects pull an RTOS, a Bluetooth stack, a graphics library and a bootloader. Safeguard scans repositories, container images and SBOM files for known vulnerable components, shows which projects carry a given component and version, ranks findings by reachability where it can, and can open fix pull requests when a fixed version exists, with autonomous remediation switched off by default.

Every release of a companion app or sync back end rebuilds against its dependencies again, and firmware for wearables bundles open source stacks that have their own advisories, so software supply chain hygiene still decides whether a fix you depend on actually reaches the wrist. The fit is indirect for the hardware and direct for the code your team builds and ships around it.

Fix it without waiting for upstream

Whatever the vulnerability, most of the risk sits in two gaps. The first is the time between a fix being published and that fix actually running in your production builds. The second, and worse, is the time before any fix exists at all, while a maintainer works out a patch and a release schedule. Waiting through both gaps is a habit, not a requirement. Safeguard gives teams three ways to close them.

1. Autonomous remediation: pull requests, not tickets

When a fixed version exists, Safeguard's Griffin models open a tested, policy gated pull request that moves the affected dependency to the safe version. You can run it on one repository or in bulk across every project that carries the vulnerable version. Remediation covers eight categories, including dependencies, licenses, security posture and findings. Reachability analysis ranks the vulnerable code paths your application actually calls first, so the first pull requests you merge are the ones that matter most. Autonomous remediation ships switched off, with every category set to Manual, so your team decides how much runs on its own and what still needs a human approval.

2. Gold Open Source: the safe version in seconds, free

gold.safeguard.sh is free and needs no login. Search any CVE or package to see affected and fixed versions, CVSS, EPSS, CISA KEV status and a recommended safe version, or use the "Am I affected?" checker. The same data is available through a free read API, README status badges and RSS threat feeds. The safeguard-sh/gold-scan-action GitHub Action can fail a build on a known exploited vulnerability, on any known vulnerability, or never, so a version you have just removed cannot quietly come back in next week's merge.

3. Gold Registry: start from components that are already fixed

registry.safeguard.sh provides hardened, drop in replacements for upstream packages and container images. Every Gold artifact is held continuously to zero exploitable critical or high CVEs, zero malware and a completed license check, with SLSA L3 or higher provenance, a Sigstore signature and a public evidence page you can hand to an auditor. An artifact loses its Gold badge if it regresses. Teams can point their own package directory at the registry so hardened equivalents resolve without changing how developers install anything.

When upstream has no fix yet, or will not ship one, Safeguard first works to get the fix accepted upstream. If the issue is severe or upstream will not move, Safeguard builds a fork, fixes the vulnerability there and publishes a hardened Gold build, so you are not stuck on a maintainer's release schedule. You can also request a hardened, compatibility tested build of a specific package. This fork and patch flow is in early access today, so ask which packages it covers before you plan around it.

One honest limit: when the vulnerable code lives in a vendor appliance, a hosted service or an operating system runtime you do not build yourself, the fix still has to come from that vendor or distribution. The steps above apply to the open source dependencies and container images you build and ship, which is where most teams carry the largest and least tracked share of their exposure.

See how Safeguard would help

The first demo is a real Safeguard CLI session asked to fix a lodash CVE: it reads the finding and advisory, asks before each command, edits package.json, runs npm install and npm test with approval, and pushes nothing. The same flow fits a companion app's web dashboard or a health data sync service your team maintains.

Click through it at your own pace, or open it full screen.

The second demo sets up the Safeguard runner on your own machine, approves it with its device code and scans from the terminal. That suits firmware teams who build watch images on their own hardware and want scans of the repository and its SBOM to run next to the toolchain.

Click through it at your own pace, or open it full screen.

The third demo is a real Android session: send work to a computer running the CLI and approve each command on the phone with Allow once, Allow for turn or Deny. A developer away from the desk can approve a dependency fix in a companion app repository without anything running unattended.

Click through it at your own pace, or open it full screen.

To try it on your own repositories, download Safeguard and follow the CLI documentation.

Quick check

Sources

• Apple, Apple Platform Security guide (PDF), watchOS system security and secure pairing sections
• NIST CSRC, SP 800-121 Rev. 2 (Update 1), Guide to Bluetooth Security
• NIST, SP 800-121 Rev. 2 Update 1 full text (PDF)
• Bluetooth SIG, Core Specification 6.0
• eCFR, 16 CFR Part 318, Health Breach Notification Rule
• Federal Register, Health Breach Notification Rule, 89 FR 47028 (30 May 2024)
• FDA, General Wellness: Policy for Low Risk Devices (guidance page)
• FDA, General Wellness guidance, issued 6 January 2026 (PDF)
• FDA, De Novo classification letter DEN180044, ECG App (11 September 2018)
• IEC webstore, IEC 62133-2:2017 Secondary cells and batteries, lithium systems
• IEC webstore, IEC 60529 Degrees of protection provided by enclosures (IP Code)
• eCFR, 49 CFR 173.185, Lithium cells and batteries
• Wireless Power Consortium, Qi wireless charging
• Android Developers, Wear OS Data Layer overview
• Android Developers, Health Services
• Android Developers, Companion device pairing
• Android Open Source Project, A/B system updates
• UK ICO, What is special category data?
• NIST CSRC, IR 8425, Profile of the IoT Core Baseline for Consumer IoT Products (September 2022)
• MCUboot, Bootloader design
• MCUboot, imgtool documentation
• InfiniTime, project README
• InfiniTime, Bootloader, OTA and DFU README
• InfiniTime, Files needed by the factory
• InfiniTime, BLE implementation and API
• Gadgetbridge project site

Last reviewed: 23 October 2026.