We were building a personalized workout recommendation feature that used heart rate and activity history. Legal flagged it as health data under GDPR and HIPAA, so we worked with them and our privacy team to determine what we could and couldn't collect. We ended up reducing the data retention window from 90 days to 30 days and stopped sending raw heart rate values to the server. The feature still launched and users rated it highly in post-launch surveys. It taught me the importance of looping in privacy stakeholders early.
We were building a sleep quality coaching feature for a wearable. My first instinct was to aggregate nightly sleep staging data server-side for the model — but I pushed back on that design myself. Sleep data is among the most sensitive health signals a device can capture. I proposed on-device inference using Core ML: the model ran locally, no raw sleep data left the device, and we only surfaced a plain-language coaching prompt. The constraint forced us to redesign the UX around what the device could explain without a server dependency. User trust scores in beta were 23 points higher than our prior health feature. The privacy boundary became the product's clearest user benefit.