.

Julie Appleby, Kaiser Health News

Your bed could be watching you.

OK, so not with a camera.

But if you have any of a variety of "smart beds," mattress pads or sleep apps, it knows when you go to sleep. It knows when you toss and turn. It may even be able to tell when you're having sex.

Sleep Number, one company that makes beds that can track heart rate, respiration and movement, said it collects more than 8 billion biometric data points every night, gathered each second and sent via an app through the internet to the company's servers.

"This gives us the intelligence to be able to continue to feed our algorithms," CEO Shelly Ibach told attendees at a Fortune Brainstorm Health conference in San Diego last month.

Analyzing all that personal data, Ibach continued, not only helps consumers learn more about their health, but also aids the company's efforts to make a better product.

Still, consumer privacy advocates are increasingly raising concerns about the fate of personal health information -- which is potentially valuable to companies that collect and sell it -- gathered through a growing number of internet-connected devices.

"We don't know what happens to all that data," said Burcu Kilic, director of the digital rights program at Public Citizen, an advocacy group in Washington, D.C.

The information "is also relevant and important to pharmaceutical companies and those that make hospital-related technology," Kilic said.

Nonetheless, consumers are flocking to mattresses and under-mattress sensors aimed at quantifying sleep as well as sleep-tracking devices; sleep apps are among the most popular downloads on Apple and Android smartphones.

The Sleep Number bed is one of the most heavily marketed of such products, with press releases and ads often equating good sleep with a better life. Sales of the beds grew 6% from 2017 to $1.5 billion in 2018, company filings show. Early this year, the company signed a partnership with Ariana Huffington's Thrive Global, a corporate wellness firm she launched after leaving The Huffington Post in 2016. Last year, the bed maker began a multiyear partnership with the NFL, in which the company gives its Sleep Number beds to players.

The company says it goes to great lengths to protect its customers' data.

"To be clear, Sleep Number does not share any Sleep IQ or biometric" data outside the company, Sleep Number spokeswoman Julie Elepano said in an email exchange.

Still, that differs from the company's privacy notice, which clearly states that personal information -- potentially including biometric data -- "may" be shared with marketing companies or business partners. They, in turn, could send out pitches for Sleep Number or offers to participate in partner product loyalty programs. The policy also says personal information could be given to partners for "research, analysis or administering surveys."

Finally, the privacy policy says Sleep Number can "exploit, share and use for any purpose" personal information with names or addresses withheld or stripped out, known as "de-identified" data.

When asked about the seeming difference between what the privacy policy states and her comments, Elepano did not address that directly, but reiterated that the company does not share even de-identified biometric data.

Details From Dreamland

Starting with when you turn in and when you wake up -- and many things in between -- these beds know a lot.

And because it's a bed, there's an inescapable salaciousness factor.

"I can't imagine it wouldn't be possible to look at that data and say, 'Oh, that looks like sex,'" said Lee Tien, senior staff attorney at the Electronic Frontier Foundation, talking about the whole range of sleep-tracking tools. "The raw data may not tell you that, but what they do is take the raw data and try to interpret it."

Smart beds and other types of sleep trackers have different sensors. Sleep Number beds have movement sensors, for instance, which can inflate, deflate or otherwise adjust the mattress for comfort.

Some sleep apps and devices made by other firms even use microphones to track snoring.

Late last year, there was a collective social media freakout when bloggers noticed a quirk in the Sleep Number bed privacy policy that seemed to indicate those beds had a microphone.

But they don't, the company was quick to note.

Instead, Sleep Number beds gather data through tiny changes in the mattress's air pressure, said Pete Bils, Sleep Number's vice president of sleep science and research.

That data -- along with goals each consumer sets for sleep -- go into creating what the firm calls a Sleep IQ Score, a term devised to assess how well a consumer slept and is used heavily in the company's marketing. Over time, the score can show if a person is deviating from their averages.

If consumers don't want to track what's going on in bed, they can flip on a "privacy mode" setting, which halts transmission but also limits what a consumer can learn about their sleep patterns, which is presumably one reason they bought the bed in the first place.

"The more you use the bed, the more it knows you," said Bils.

From what is spelled out in privacy policies for these beds and apps, it's clear the data could be useful in other ways, too.

For example, the French company Withings, which makes the Sleep under-mattress monitor that can track movement, heart rate, snoring and other factors, said it shares anonymous and aggregated data "with partners such as hospitals, researchers or companies, as well as to the public in blog posts and data studies."

According to the Sleep Number privacy policy, it collects personal information, which can include names and information about a consumer's age, weight, height and gender. If a consumer creates a user profile on the bed's app, that personal information is expanded to include specifics about movement, positions, respiration and heart rate.

That is also true for children if parents create a user profile for them.

The policy also notes that personal data might be stored indefinitely, even "after you cancel or deactivate" user accounts.

It's More Than Just Zzzzz

The privacy policies of many devices that track and transmit personal information allow for the sharing of data that has been stripped of personal identifiers.

But privacy experts have shown it's not terribly difficult to use or combine such information to "re-identify" people.

"You are left with the impression that, 'Don't worry, no one will be able to point to you,' but they don't actually say that," said Tien. "I don't know how they actually could say that."

Unlike personal data collected in a doctor's office or a sleep clinic, the information gathered by sleep trackers is not protected by federal privacy rules.

Some sleep trackers or apps can connect with other "smart" devices in your home, such as a thermostat or coffee maker.

Nifty, for sure, because as you wake up, your heater can kick on and the coffee maker can start doing its thing. But it also can mean those devices are sharing your information. Sleep Number said its beds can import information from other devices but does not share customer information with them.

Still, the interconnectedness exposes more vulnerabilities.

"We connect all these devices to each other," noted Kilic at Public Citizen. "If hackers want to get into the system, [they] can easily do so and collect all this info from you: How do you use your bed? How often do you have sex? This is very sensitive information."

Privacy experts recommend encryption and the use of strong passwords and additional authentication whenever possible.

The goal of the data gathering, Sleep Number and other companies say, is helping sleep-deprived Americans do a better job at, well, sleeping.

But do consumers really need an app -- or a bed that can cost thousands of dollars -- to tell them how rested they feel in the morning?

Such tools are "great because it makes people more aware of sleep, but it's a slippery slope," said Dr. Seema Khosla, a pulmonologist and medical director of the North Dakota Center for Sleep, a sleep study facility in Fargo. Khosla, who uses a few trackers herself, is also the lead author of the American Academy of Sleep Medicine's position paper on sleep apps.

One unexpected consequence: Consumers so attuned to their data may experience anxiety -- and an inability to sleep.

"We call it orthosomnia," she said. "They get all this data and get upset about having a perfect number. We tell them to put it away for a couple of weeks."