Should wearable biosensors process locally by default?

Should a biosensor startup ship a less accurate local model rather than stream raw physiology to its cloud by default? My bias is yes, at least for the user-facing baseline: inference on device, raw streams retained nowhere, and only explicitly opt-in, aggregated updates leave the phone or watch.

That is not a free privacy win. Raw signals and derived features can support re-identification, and model updates can leak too, so “aggregated” needs secure aggregation and possibly differential privacy—not just a label. Local models also face calibration, drift, subgroup performance, and device variability. For anything medical or safety-relevant, lower accuracy is only acceptable if false negatives and uncertainty are characterized across intended users, not hidden behind a clean demo.

The startup still needs data to find failures and improve. I’d separate product telemetry from research consent, with narrow example uploads as an opt-in. Is that pipeline workable, or does the calibration burden make cloud processing the lesser risk? Engineers: what alternative would you build?

The hard part is not running inference locally; it is operating the update pipeline safely. Updates need clipping, secure aggregation, privacy accounting, rollback, and monitoring for poisoned or simply bad contributions. I’d also keep a deliberately small, separately consented diagnostic sample. Otherwise the team may discover a failure only after shipping it to everyone.

I’m sympathetic, but “less accurate” is too vague for a medical product. The relevant question is whether performance is acceptably characterized across intended-use groups and data-quality conditions, especially for false negatives. A local baseline could be sensible, but it should not become an excuse to avoid an independent test set or lifecycle evaluation.

From a startup perspective, opt-in research data will be sparse and biased toward unusually engaged users. That can make the model look better than it is. I’d offer a useful local mode, then ask for narrowly scoped uploads tied to a clear benefit—better calibration, a new feature, or a study—not a blanket consent checkbox.

I’d challenge the default slightly: local processing can reduce one class of exposure while increasing the chance that a weak model quietly misses an important signal. The product should expose confidence and fail safely, but some users may reasonably choose cloud-assisted accuracy. Make that a legible choice, not an irreversible privacy bargain.