AppMatic Tech builds wearable and fitness tracker apps for US, UK, and EU markets, designing claims, notifications, and data flows around FDA general wellness rules, MHRA and EU MDR software classification, HIPAA, and GDPR, in Swift, Kotlin, and Flutter. AppMatic Tech is based in Ahmedabad, India, with 330+ products shipped since 2017.
The same heart rate variability chart can be a wellness feature or a regulated medical device. The difference is what the app says about it. In 2026 that line moved in the United States: the FDA revised its General Wellness guidance in January, and closed its dispute with WHOOP over Blood Pressure Insights in June. The UK and the EU did not move in the same direction. For a team shipping a wearable app in more than one market, the result is three rule sets that share one principle, intended purpose, and differ in almost everything else. This article compares them and sets out the design rules AppMatic Tech follows. It is not legal advice; every product should confirm its position with regulatory counsel.
Key takeaways
Claims, not sensors, decide whether a wearable app is a medical device.
| Point | Detail |
|---|---|
| Intended purpose decides | All three regimes judge software by its claims, labelling, and marketing. |
| FDA loosened in 2026 | Non-invasive wellness estimates, including blood pressure, can stay outside device rules if strict conditions are met. |
| WHOOP set the precedent | A warning letter in July 2025 ended in a closeout in June 2026 for the modified feature. |
| UK and EU did not follow | MHRA and EU MDR still treat monitoring and diagnostic claims as device territory. |
| HIPAA rarely applies | Consumer wearable apps fall under the FTC Health Breach Notification Rule and state laws instead. |
| GDPR treats health data as special | EU and UK apps need an Article 9 condition, usually explicit consent. |
Why does medical device classification matter for wearable apps?
A medical device needs clearance, approval, or conformity assessment before sale, plus a quality system, post-market surveillance, and change control. A wellness product needs none of those. For a wearable startup, the classification decides whether a feature ships in weeks or in years.
All three regulators read intended purpose from the same evidence: the app's on-screen text, notifications, store listing, website, advertising, and, increasingly, what an AI coach says in conversation. A single push notification that names a disease can move an otherwise wellness product into device territory. That makes classification an engineering and content problem, not only a legal one.
What did the FDA change for wearables in January 2026?
On January 6, 2026, the FDA issued revised guidance, General Wellness: Policy for Low Risk Devices, superseding the 2019 version. The revision focuses on sensor-based wearables that estimate physiologic parameters such as blood pressure, blood glucose, blood oxygen saturation, and heart rate variability.
Under the revised guidance, a non-invasive product can be a general wellness product when all of the following hold:
- Wellness-only intended use
- The product supports general wellness, such as fitness, sleep, or stress management, and nothing more.
- No disease references
- The product does not refer to specific diseases, clinical conditions, or diagnostic thresholds.
- Validated values
- Values that mimic clinical measurements are shown only if they are validated.
- No substitute or equivalence claims
- The product does not claim to replace an FDA-cleared device or claim clinical equivalence, clinical accuracy, or "medical grade" status.
- No clinical direction
- The product does not prompt clinical action or medical management, through alerts or otherwise, and gives no treatment guidance.
- Limited notifications
- The product may suggest that seeing a healthcare professional could help when outputs fall outside wellness ranges, without naming a condition, calling a value abnormal, or giving thresholds.
The guidance gives examples. A non-invasive product that shows blood pressure alongside sleep metrics and pulse rate, without disease references, can qualify. A wearable that estimates blood glucose to show nutritional effects can qualify if it is contraindicated for people with diabetes and pre-diabetes. A minimally invasive glucose wearable using microneedles does not qualify, even with wellness-only claims.
Products that fall outside the policy remain devices. On January 23, 2026, the FDA also issued draft guidance on clinical performance testing for cuffless non-invasive blood pressure devices, which sets evidence expectations for blood pressure features that are regulated.
What happened with WHOOP Blood Pressure Insights?
WHOOP's Blood Pressure Insights (BPI) estimates blood pressure each morning from heart rate, heart rate variability, and blood flow during sleep, after a one-time calibration with a standard cuff. The dispute over BPI is the clearest case study of the wellness line:
- May 15 and May 27, 2025. WHOOP met with the FDA's Center for Devices and Radiological Health about BPI.
- June 2, 2025. WHOOP sent the FDA a letter describing BPI.
- July 14, 2025. The FDA issued a warning letter stating that BPI was marketed without required premarket approval.
- January 6, 2026. The FDA revised its General Wellness guidance, including blood pressure among parameters that wellness products may estimate.
- June 2026. The FDA sent a closeout letter stating that it "does not intend to enforce" device requirements for BPI as modified, citing changes WHOOP made to the feature and its labelling.
Two details matter for every other product. The closeout is specific to BPI as modified, not to any other product or future change. And WHOOP's regulated feature, the ECG Heart Screener on WHOOP MG, went through FDA clearance separately. A wearable app can carry both kinds of feature, but each needs its own claims and its own evidence.
Which US privacy laws apply to wearable apps?
| Law | Who it covers | What it requires |
|---|---|---|
| HIPAA | Covered entities, such as providers and health plans, and their business associates | Privacy, security, and breach rules for protected health information. A direct-to-consumer wearable app is usually outside HIPAA unless it serves a covered entity. |
| FTC Health Breach Notification Rule | Vendors of personal health records and related entities, including health apps and connected devices, that are not covered by HIPAA | Notice to consumers, the FTC, and sometimes the media after a breach. The amended rule, effective July 29, 2024, treats unauthorised disclosure, not only hacking, as a breach. |
| Washington My Health My Data Act | Organisations handling consumer health data of Washington consumers | Consent before collecting and sharing consumer health data, with most provisions in force from March 31, 2024 and a private right of action. |
The FTC rule changes how analytics and advertising SDKs are used. Sending identifiable health data to an advertising platform without the user's authorisation can itself count as a breach, so AppMatic Tech keeps third-party SDKs out of health data screens and documents every data flow.
Apps that do serve covered entities, such as remote patient monitoring, follow HIPAA as well, as covered in remote patient monitoring app architecture.
How does the UK regulate wearable apps?
The Medicines and Healthcare products Regulatory Agency (MHRA) applies an intended-purpose test to software and apps. Apps for general wellbeing, and apps that give only general information without personalised advice, are unlikely to be medical devices. Apps that monitor or analyse a user's data to inform diagnosis or treatment are more likely to be. The MHRA's guidance flags marketing words such as "diagnose", "monitor", and "analysis" as indicators that a product may be a medical device.
For market access, Great Britain currently accepts CE-marked devices under transitional rules:
| CE certification | Accepted in Great Britain until |
|---|---|
| EU MDD or AIMDD | The earlier of certificate expiry or June 30, 2028 |
| EU MDR, IVDR, or IVDD | June 30, 2030 |
In February 2026 the MHRA consulted, until April 10, 2026, on proposals that include indefinite recognition of devices compliant with the EU MDR or IVDR. Until those proposals are adopted, the dates above apply, and devices must also be registered with the MHRA before being placed on the Great Britain market.
UK GDPR treats health data as special category data, so a UK wearable app needs both a lawful basis and an Article 9 condition, which for consumer apps is usually explicit consent.
How does the EU regulate wearable apps?
The EU Medical Device Regulation (MDR) also starts from intended purpose: software is a medical device only if the manufacturer intends a medical purpose, read from labelling, instructions, and promotional material. Once software is a device, Rule 11 of Annex VIII sets its class:
| Software function under MDR Rule 11 | Class |
|---|---|
| Provides information used for diagnostic or therapeutic decisions | IIa |
| Those decisions could cause serious deterioration of health or surgical intervention | IIb |
| Those decisions could cause death or irreversible deterioration of health | III |
| Monitors physiological processes | IIa |
| Monitors vital physiological parameters where variations could cause immediate danger | IIb |
| All other medical device software | I |
The monitoring tier matters for wearables. Software that monitors heart rhythm or blood oxygen for a medical purpose starts at class IIa, which requires a notified body. The same signals shown for fitness, with wellness claims, stay outside the MDR.
Two more EU rules apply:
- GDPR Article 9. Health data is special category data. Processing it requires an Article 9(2) condition, usually explicit consent, and member states may add national conditions under Article 9(4).
- The European Health Data Space. Regulation (EU) 2025/327 entered into force in March 2025 and applies in phases from March 26, 2027. Article 47 sets labelling requirements for wellness applications that claim interoperability with electronic health record systems, and Article 49 creates an EU database for registering them. A wellness app that does not claim EHR interoperability is not caught by those articles.
How do the US, UK, and EU rules compare?
| Question | United States | United Kingdom | European Union |
|---|---|---|---|
| Who decides device status | FDA | MHRA | Manufacturer, with notified body for class IIa and above |
| Wellness exemption | General Wellness guidance, revised January 6, 2026 | Intended-purpose test in MHRA guidance | Intended purpose under the MDR |
| Wellness blood pressure estimates | Possible if non-invasive, validated, and free of disease references | Treated case by case; monitoring claims indicate a device | Monitoring for a medical purpose is class IIa or above |
| Health data privacy | HIPAA for covered entities; FTC Health Breach Notification Rule and state laws for consumer apps | UK GDPR special category data | GDPR Article 9 special category data |
| Extra rules to watch | Washington My Health My Data Act | CE recognition dates and MHRA registration | EHDS labelling for wellness apps claiming EHR interoperability |
The US is now the most permissive of the three for wellness estimates, which creates a practical risk: a feature designed under the FDA's 2026 guidance may need different wording, or may need to be switched off, in the UK and EU.
How should a wearable app be designed to stay in wellness territory?
AppMatic Tech applies an eight-point design checklist to every wearable app before release:
- Write the intended purpose first. One paragraph, agreed with counsel, that every screen, notification, and store listing must match.
- Maintain a banned-terms list. Disease names, "diagnose", "detect", "medical grade", and clinical thresholds are blocked in app copy, push notifications, and AI coach responses.
- Template every notification. Out-of-range messages follow the FDA's permitted pattern, suggesting a healthcare professional could help without naming a condition.
- Validate any clinical-looking value. If the app shows blood pressure, SpO2, or similar values, the validation evidence is documented before launch.
- Separate regulated features. Cleared features, such as an ECG module, run in their own code path with their own claims, version control, and release gates.
- Gate features by market. Remote configuration switches features and wording by country, so a US-permitted feature can be disabled in the UK or EU.
- Guard the AI coach. Every AI response passes a claims filter, and test sets include questions that tempt the model into diagnosis.
- Map every data flow. Health data never reaches advertising or analytics SDKs without authorisation, which keeps the app clear of the FTC breach rule and GDPR consent problems.
Pro tip: Treat notification and AI coach copy as regulated content with an approval workflow. In AppMatic Tech's experience, claims drift in through small copy changes made after launch, not through the original feature design.
The engineering side of these features, including sync and scoring, is covered in how to build a screenless fitness tracker app, and regional rules outside the US, UK, and EU are covered in wearable app development in India and wearable app development for Saudi Arabia and the UAE.
How AppMatic Tech builds regulated and wellness wearable apps
AppMatic Tech has shipped 330+ products since 2017, holds a 5.0 Clutch rating, and keeps an 83% client retention rate. AppMatic Tech builds the engineering side, including claims-aware notification systems, market-level feature flags, audit trails, and AI guardrails, and works alongside each client's regulatory counsel, who owns the classification decision.
Relevant work includes Capmedic, an asthma spirometry app built in Kotlin for deployment at Northwestern Medicine, Homecare2go, a US remote patient monitoring app supported through its US market launch, and EYVA, a non-invasive six-vital wellness device app shipped on iOS and Android.
The service overview is on the AppMatic Tech wearable app development page, and clinical products are handled under healthcare app development. Scoping starts at contact@appmatictech.com or the contact page.
Sources
| Claim used in this article | Source |
|---|---|
| FDA revised General Wellness guidance, January 6, 2026: conditions and examples | Covington, FDA revised general wellness guidance |
| FDA draft guidance on cuffless blood pressure devices, January 23, 2026 | Hardian Health, FDA wearables guidance update |
| WHOOP BPI timeline, closeout wording, and how BPI works | SGB Executive, FDA drops WHOOP warning letter |
| FTC Health Breach Notification Rule amendments and effective date | Hogan Lovells, FTC finalizes revised Health Breach Notification Rule |
| Washington My Health My Data Act dates and private right of action | BakerHostetler, Introduction to Washington's My Health My Data Act |
| MHRA intended-purpose test and indicator words | BSI, UK guidance on stand-alone medical device software |
| CE recognition dates in Great Britain and the 2026 MHRA consultation | DAC Beachcroft, MHRA extra time for CE-marked devices |
| EU MDR intended purpose and Rule 11 classes | NAMSA, MDR rules for medical device software |
| EHDS entry into force, application dates, and Articles 47 to 49 | EU Monitor, Regulation 2025/327 |
Frequently Asked Questions
- Is a fitness tracker app a medical device?
- A fitness tracker app is not a medical device in the US, UK, or EU when the app's intended purpose is general wellness, such as tracking activity, sleep, or fitness, without references to diseases, diagnostic thresholds, or treatment. The same app becomes a medical device when the app's claims, labelling, notifications, or marketing say the app diagnoses, monitors, or manages a disease or condition.
- What changed in the FDA general wellness guidance in January 2026?
- On January 6, 2026, the FDA issued revised General Wellness guidance stating that non-invasive products estimating physiologic values such as blood pressure, blood oxygen, blood glucose, and heart rate variability can be general wellness products if the intended use is wellness only, values are validated, no disease or diagnostic threshold is referenced, and no clinical action is directed.
- What happened with WHOOP Blood Pressure Insights and the FDA?
- The FDA issued WHOOP a warning letter on July 14, 2025, stating that Blood Pressure Insights was an unapproved medical device. After the FDA revised its General Wellness guidance on January 6, 2026, and WHOOP modified the feature and the feature's labelling, the FDA sent a closeout letter in June 2026 stating that the FDA does not intend to enforce device requirements for the feature as modified.
- Does HIPAA apply to wearable apps?
- HIPAA applies only to covered entities, such as healthcare providers and health plans, and the business associates of covered entities. A consumer wearable app sold directly to users is usually outside HIPAA, but the FTC Health Breach Notification Rule, effective in amended form from July 29, 2024, and state laws such as Washington's My Health My Data Act can apply instead.
- How does the EU classify wearable health software under the MDR?
- Under EU MDR Rule 11, software that provides information used for diagnostic or therapeutic decisions is class IIa, rising to IIb or III where decisions could cause serious deterioration or death, and software that monitors physiological processes is class IIa, rising to IIb for vital parameters where variations could cause immediate danger. All other medical device software is class I.