Google's AI plans for Fitbit include your medical records

Google is integrating its Gemini AI as 'Coach' into the Fitbit app and inviting users to link medical records, leveraging partners b.well Connected Health and Clear; Fitbit was acquired by Google for $2.1B in 2019 and now sells Premium at $8/month. The Fitbit account migration to Google (deadline extended to May 19, 2026) and device lineup consolidation follow co-founder departures and the discontinuation of the standalone Fitbit wearable. Privacy and data-use concerns are highlighted despite Google's claim that medical records won’t be used for ads, implying potential user trust and regulatory risks.

Analysis

This product move increases Google’s regulatory and litigation exposure in a concentrated, measurable way: mixing sensitive EHR data with consumer AI features expands attack surface and creates clear HIPAA/FTC/European DPIA vectors that can crystallize into enforcement actions within 3–18 months. The economic hit need not be a multibillion fine to matter — a sustained headline cycle plus one major breach or class-action could compress Google’s consumer-ads multiple by 3–6% and slow Pixel/Fitbit hardware adoption, costing hundreds of millions in lost revenue over 12 months.

Second-order winners include Apple and privacy-first incumbents: firms that can credibly promise on-device processing and minimal cloud aggregation stand to gain subsriber and device share at the margin; even a 1–2ppt switch in smartwatch share toward Apple would be meaningful to AAPL services and upgrade cadence over 12–24 months. Conversely, partners like b.well and Clear now carry outsized counterparty risk — any failure or misuse at a partner will likely be treated in headlines as a Google failure, amplifying reputational damage.

Catalysts to watch: (1) regulatory filings or inquiries (FTC/OCR/EU regulators) in next 1–6 months; (2) security incident or partner disclosure within 0–12 months; (3) measurable Fitbit/Premium churn or Pixel sales trends reported over next 2 quarterly earnings that show user migration. The path to reversal is clear — a transparent, auditable on-device-only processing roadmap or third-party SOC2/HIPAA attestations signed within 90–180 days would materially reduce the overhang and tighten implied volatility on GOOG options.

Key Decisions for Investors

• Pair trade (6–12 month horizon): short GOOGL (GOOGL) 1% net exposure vs long AAPL 1% net exposure. Target GOOGL downside ~10% (stop +8%); target AAPL upside +12% (stop -6%). Rationale: regulatory overhang on Google vs privacy premium and hardware resilience at Apple.
• Tactical options hedge on Google (3–9 months): buy 25–30 delta GOOGL puts (near-term expiries 3–6 months) sized to cover ~0.5–1.0% portfolio equity risk. Reward: protects against a headline-driven 15–25% draw; cost acceptable as insurance vs concentrated legal/regulatory tail risk.
• Long AAPL call spread (6–12 months): buy AAPL 12-month 1–2x 25–30 delta call, finance with selling 45–55 delta call to reduce cost. Position size 0.5–1% portfolio. Rationale: capture idiosyncratic share gains and services upside if privacy rotation accelerates; defined max loss limits drawdown.
• Event-driven short on Google partner risk (3–9 months): initiate small short on public health-data integrators or suppliers if a partner SOC/HIPAA gap is disclosed (monitor newsflow). Keep position size small (<=0.5% portfolio) and use tight stops; asymmetric payoff if partner failure triggers roll-up reputational damage.
• Monitor and reassess at regulatory milestones (30/90/180 days): reduce GOOGL short or unwind options if Google publishes verifiable on-device processing attestation or secures major HIPAA certifications for partners; if no progress, add size incrementally up to stated limits.