Who owns your biodata? The quiet question under every health app you’ve ever opened.

Stack it up and it’s staggering. In the last few years the average person has started generating a continuous record of their heartbeat, their sleep architecture, their menstrual cycle, their blood glucose, their steps, their workouts, increasingly their voice and their face. This is the most intimate dataset that has ever existed about a human being — and the overwhelming majority of it lives on someone else’s server, under someone else’s terms.

For years this barely mattered, because nobody could do much with the data except draw you a graph. AI changes that overnight. The same record that was once a pretty dashboard is now legible — patterns, predictions, inferences about your future health that you never disclosed and didn’t authorise. Value and risk went up together, and the ownership question stopped being academic.

what “ownership” actually means here

People conflate three different things, and the apps are happy to let them. Access (you can look at it), portability (you can take a copy elsewhere), and control (you decide who reads it and for what) are not the same. Most health products give you the first, grudgingly offer the second, and quietly keep the third.

• Access without portability is a museum: you can admire your data behind glass, but you can’t take it home, so the company stays the only entity that can read across all of it.
• Portability without control is a leak: you can export a CSV, but you’ve also agreed the company can use, share, or train on the original. Your copy is a souvenir; theirs is the asset.
• Control is the one that matters: the right to decide that your year of sleep data feeds your clinician and your own AI thread — and nothing and no one else.

why AI raises the stakes

An unread dataset is inert. A readable one is leverage. Once a model can infer pregnancy from purchasing, depression from typing cadence, or relapse risk from sleep drift, your biodata stops being a record of what happened and becomes a prediction of what will — and predictions about your body are worth a great deal to people whose interests are not yours.

• Inference beats disclosure: you don’t have to tell anyone anything; a good-enough model guesses it from the exhaust you already emit.
• Aggregation is the real product: any single reading is harmless; the joined-up year is a profile, and the profile is what gets used or sold.
• The asymmetry compounds: they get better at reading you every year; you get a slightly nicer chart.

the unglamorous way to take your copy back

This is not a call to throw your devices in a drawer — the hardware is genuinely useful, and skin contact can’t be replaced by software. It’s a call to flip the asymmetry: keep the device, take the data, and become the one entity that can read across all of it. The tools to do this are boring and they already exist.

1. Export everything you can. Most services owe you a data export under law (GDPR’s right to portability among them). Pull your history out as files — CSV, JSON — on a schedule.
2. Hold your copy somewhere you control. A plain folder, a notes app on your disk, a sheet — anywhere that doesn’t need a corporate roadmap to keep existing next year.
3. Read it with an AI you direct, not one that harvests you. Feed your owned ledger into a chat thread to find the pattern; the model reflects your data back to you instead of absorbing it into a product.
4. Prune what you don’t need to share. Turn off the data licences you can, delete the accounts you don’t use, and stop paying twice — once for the device, once for the privilege of them keeping your record.

The question isn’t whether your biodata will be read by AI. It already is. The only open question is whether you’re in the room when it happens — holding your own copy, asking your own questions — or whether the only intelligence reading the record of your body belongs to someone selling the answer back to you.