BeatBird accused of selling health data; Dingyue Insurance says the deal is “under review”

A post on an anonymous forum on the night of the 14th claimed that the health app BeatBird plans to give users’ sleep, heart-rate and menstrual-cycle data to Dingyue Insurance.

BeatBird said in a statement today that all data “is de-identified” and that it will “pursue the leaker to the full extent of the law”. The company is understood to have brought in outside security consultants for an internal investigation.

Privacy researchers point out that if birthdays, postcodes and device IDs are kept, people can very likely be re-identified even with their names removed.