Oura's IPO: The $14 Billion Question of Who Owns Your Sleep Data

Seventy-Three Percent

Seventy-three percent.

That is the number that stopped me cold when I read the breakdown of Oura's filing. Of the headline "up to $2.2 billion" raise, only about 27% is primary capital — actual money flowing into the company to build sensors, hire engineers, expand production. The other 73% is secondary: existing shareholders, early backers, and insiders selling their positions into the public market at the very moment the public is invited to buy.

I have watched this structure before. In late 2017, working as a junior developer in Los Angeles, I introduced fifteen friends to a token called MyToken. They put in savings they could not afford to lose. The founders had a vesting schedule too, and it looked reassuring on a slide. When that schedule unlocked, the price did not need a reason to fall. It only needed permission. Watching those savings evaporate taught me something I have never been able to unlearn: the mechanics of who sells, and when, tell you more about a project's true intentions than any whitepaper ever printed.

Oura is not MyToken. It is a real company with real revenue, a real product that I have personally worn on my finger for two years, and a genuine category-leading brand. But the 73% deserves exactly the same scrutiny I applied in 2017 — only now the vesting cliff is a lock-up expiration, the token is a share of common stock, and the exchange is Nasdaq instead of a thinly traded altcoin pair.

And beneath the offering mechanics sits a deeper question, one the prospectus will never phrase in these words, but the one my community has been asking me about all week: when a company goes public on the value of your biometric data, who actually owns the asset that is being priced? That question is where the blockchain conversation stops being an abstraction and becomes the whole story.

The Company Behind the Ring

Let me set the context plainly, because the numbers matter less than their proportions.

Oura is a Finnish-origin company that sells a titanium smart ring capable of tracking sleep stages, resting heart rate, heart rate variability, body temperature, and — increasingly — menstrual cycle phases and metabolic signals. It sells the hardware, and then it sells a subscription to interpret the hardware's data. That two-layer model is the entire business.

Over the first nine months of the reported period, Oura generated approximately $1.21 billion in revenue, up 74% year over year. Hardware accounted for about $974 million of that — roughly 80%. The subscription line contributed $240.5 million — roughly 20%. The company posted net income of $60.8 million, meaning it crossed into profitability while still growing at a rate most mature consumer-electronics firms would envy. Membership doubled to 5 million subscribers.

By any honest reading, those are strong numbers. A 74% top-line increase with positive net income, in a hardware-adjacent category, is not a story you can dismiss. The company priced at the top of its range, at a reported $14.1 billion valuation, and the offering was oversubscribed roughly four times. The previous billion-dollar-plus US listing was Jersey Mike's in July. Between then and Oura, the calendar was nearly empty: Kraken's parent pushed its own listing to 2027, Holtec Nuclear and Bamboo Insurance shelved their offerings entirely.

So we have a genuinely healthy growth company walking into an IPO window that is starved of supply, priced at the upper bound, and absorbed by demand four times the available shares. Every one of those facts is true simultaneously, and the temptation — especially in crypto, where we are trained to chase the narrative — is to read the oversubscription as validation. It is not. Oversubscription is a statement about scarcity, not about value. Those are different things, and confusing them is the single most expensive mistake in any market.

The Ownership Trap: Your Body as a Data Asset

Here is where I want to slow down and apply the lens I have spent the better part of two decades sharpening — the one I built after 2017, auditing not for bugs but for ethical red flags.

Oura collects what European law calls "special category data." Under the General Data Protection Regulation, that is the most tightly protected class of personal information: health data, biometric data, data revealing physiological or genetic characteristics. Your sleep architecture, your heart rhythm, your temperature curve, the phases of your menstrual cycle — these are not preferences you can reset. They are the physical signature of who you are, continuously updated, captured every night while you are unconscious and unable to consent in any meaningful, moment-to-moment way.

The entire "software valuation" narrative that Oura rides on depends on this data being an asset. The company markets itself as a data-and-insights business, not a ring manufacturer, because data businesses command higher multiples than hardware businesses. But here is the structural tension nobody at the roadshow says out loud: the data that justifies the software multiple is the same data that carries the heaviest regulatory constraint and the deepest ethical exposure. The more you monetize it, the harder the regulators squeeze, and the more fragile the valuation story becomes.

This is the exact problem that decentralized identity was invented to solve. A verifiable credential model — where the user holds the cryptographic key to their own health record and grants scoped, revocable, auditable access to third parties — is not a buzzword. It is a technically coherent answer to the question Oura's business model cannot answer cleanly: if the data is mine, why does the company capture all the value of its use? Zero-knowledge proofs let you prove a fact about your body — "my resting heart rate dropped 8% this quarter" — without surrendering the underlying raw stream. That is a real capability that exists today. It is deployed, if imperfectly, in identity and credentialing systems across the ecosystem.

And yet Oura's model is the opposite. The ring captures, the cloud aggregates, the algorithm interprets, and the company sells access to the interpretation. The user pays twice — once for the hardware, once for the subscription — and in return receives insights, while the underlying asset, the longitudinal biometric record, sits on Oura's servers under Oura's governance.

I am not making a naive "everything should be on-chain" argument here, so let me be precise about what I am saying. I am saying that the central question of the next decade of consumer health is the same question we fought over in crypto in 2020: who holds the keys, and who reaps the yield. Oura has answered it in the traditional way. The consequences of that answer are only beginning to surface.

The Rent-Seeking Layer Nobody Prices In

Now let me get into the mechanics that the retail buyer will never see on the front page, because this is where my audit instincts kick in hardest.

Oura's $240.5 million in subscription revenue does not arrive as clean money. On mobile, subscription billing flows disproportionately through Apple's App Store and Google's Play Store. Apple's standard commission is 30%, dropping to 15% for smaller developers and specific categories; Google's structure is similar. If even half of Oura's subscription revenue moves through these channels — and for a consumer app with a strong iPhone demographic, the true figure is plausibly higher — then a meaningful slice of that $240.5 million is being intercepted before it ever reaches Oura's gross margin.

That is a hidden tax. It is a tax imposed by a platform that Oura does not control, cannot negotiate with at scale, and cannot route around without breaking the user experience that made the subscription valuable in the first place. And the platform's rules are not stable: they shift with antitrust rulings, with the Digital Markets Act in Europe, with the outcome of litigation in various jurisdictions. Every one of those shifts directly moves Oura's subscription economics.

This is the crypto-native observation, and it is the one I want to underline. Oura's subscription layer inherits all the fragility of centralized platform dependency while capturing none of the sovereignty that a permissionless payment rail would provide. A protocol doesn't take 30% and doesn't unilaterally change its terms. A platform does both. When we talk about why decentralized payment infrastructure matters, this is the concrete, unglamorous case: not because "on-chain" is a vibe, but because a 30% rent charged by a single counterparty who can change the rules is a structural discount on every dollar of recurring revenue.

Now apply the same logic to the upside the market is paying for. The bull case for Oura — the reason it is priced at a software multiple rather than a hardware multiple — is the promise that subscription revenue scales and data services layer on top. But both of those growth vectors run through chokepoints. Subscriptions run through the App Store. Data services run through regulatory approval that is hardening, not loosening. The multiple assumes frictionless expansion of exactly the two lines that face the most friction. That is the mispricing.

The Scarcity Illusion: What Four Times Oversubscription Really Means

Let me tell you what four times oversubscription actually tells us, because the crypto parallel is almost too perfect to ignore.

In the token markets, we lived through the era of the "limited supply" launch — the carefully staged whitelist, the capped raise, the demand that exceeded allocation by multiples. Every one of those launches felt like validation. Demand exceeded supply. The market wanted in. And almost every time, the scarcity was manufactured: the supply cap was arbitrary, the demand was primed by narrative, and the only thing the oversubscription proved was that the launch was marketed well to a crowd that had been taught to read allocation multiples as quality signals.

Oura's four-times-oversubscribed offering sits inside an IPO calendar so thin that it is the first ten-billion-dollar-plus US listing since July. That thinness is not incidental. It is the entire mechanism. When supply of investable new listings collapses, the handful of offerings that do come to market absorb disproportionate demand — not because they are better than the companies that stayed private, but because the market is hungry and there is almost nothing else to eat. The oversubscription is a measurement of scarcity in the IPO pipeline, not a measurement of confidence in smart rings.

I wrote a piece during the 2022 winter that I still stand behind, built from the weekly town halls we ran at Ethos Circle: scarcity narratives are the most reliable manipulation in any market, because they convert the fear of missing out into the appearance of due diligence. The buyer who grabs allocation because "it was four times subscribed" is not doing analysis. They are doing momentum. And momentum cuts both ways.

Contrast this with how a disciplined market would read the same facts. A healthy IPO would show demand concentrated in long-term institutional holders, a primary/secondary split weighted toward the company, and a valuation that reflects the business's actual revenue composition. Oura shows the opposite on two of those three counts: a 73% secondary overhang and a software multiple on an 80% hardware company. The only thing genuinely strong is the third — the demand — and I have just explained why that demand is a supply artifact.

The 73% Overhang: A Vesting Cliff by Another Name

I want to spend real time on the 73% secondary number, because it is where the crypto and equity worlds converge most directly, and where my 2017 scar tissue is most useful.

In token markets, we learned to read vesting schedules the way sailors read weather. Founder and early-investor allocations typically unlock over 12 to 48 months, often with a cliff. The single most predictive on-chain signal of a local top has never been the price chart. It has been the unlock calendar. When a large insider allocation is scheduled to become liquid, the supply pressure is known in advance, and sophisticated holders front-run it by exiting before the cliff.

Oura's IPO is a vesting cliff dressed in a suit. Seventy-three percent of the raise is existing holders selling. That means the moment the deal prices, the company does not receive most of the money the headline advertises — the sellers do. And because those sellers are subject to lock-up agreements, the market now has a scheduled, dated future event: the lock-up expiration, when the remaining insiders become free to sell into the public float.

I have seen what that event does. In the token markets it is called the "unlock dump." In equity markets it is more polite, but the mechanics are identical. When you buy an IPO whose float is dominated by secondary sales and whose insiders are sitting on a scheduled liquidity event, you are not buying the company. You are providing exit liquidity to the people who already own it.

Now, the counterargument is fair and I will state it: secondary sales in an IPO are normal, early investors need liquidity to return capital to their own LPs, and a functioning venture ecosystem requires exits. True. All true. But the proportion matters enormously. A deal that is 27% primary is a deal where the company raised a little and the insiders sold a lot. That is a liquidity event. It is not a growth financing. And it is being marketed — by virtue of its scarcity and its oversubscription — as a validation of the category.

Let me put an even finer point on it. When the majority of a raise is existing shareholders cashing out, the incentive alignment between the seller and the buyer inverts. The seller wants the highest possible price today. The buyer wants durable value tomorrow. Those are not the same interest, and when the seller controls the timing and the supply, they rarely lose.

The Protocol Premium and the Software Multiple

There is a specific narrative game that runs through both crypto and public markets, and I have watched it destroy more retail capital than any exploit.

In crypto, it is the "protocol, not an app" claim. Every project wants to be valued as a protocol — a base layer with network effects and defensible margins — rather than an application, which is a commodity that competes on price. The protocol premium is real: protocols trade at higher multiples because they are perceived as more durable. The problem is that most things that call themselves protocols are applications wearing protocol language.

Oura is playing the equity-market version of this game. It wants to be valued as a software company — a data-and-subscription business with recurring revenue and expanding margins — rather than a consumer-electronics manufacturer. The software multiple is the protocol premium of the public markets. And the tell is the same in both domains: look at the revenue composition.

Eighty percent of Oura's revenue comes from selling physical rings. That is a hardware business. Hardware businesses carry the full weight of their category: manufacturing cost, supply-chain concentration, inventory risk, component sourcing, product-cycle obsolescence, and the brutal reality that your margins are bounded by what people will pay for a durable good. Software margins are not. That is why the multiple gap exists, and it exists for good reason.

So when Oura is pitched at a software multiple, the market is being asked to pay for a business it is not yet. Could it become one? Yes — if subscription penetration rises dramatically, if the data services layer becomes real and defensible, if the App Store rent can be reduced or routed around. That is the entire bull case. But paying today's price for tomorrow's structural transformation is exactly the trade that burned the 2021 token buyers who bought "the future of finance" at the peak of an application's life cycle.

I say this with affection for the product. The ring is genuinely good. The sleep insights changed how I manage my recovery. But my affection for a product has never once been a reason to pay the wrong price for its equity, and it never will be. A good product is not a good investment thesis. The two are correlated, not identical, and the market's most reliable trap is the moment it convinces you otherwise.

Where the Real Blockchain Use Case Lives

Let me now make the constructive case, because critique without construction is just noise, and the ENFJ in me cannot leave an audience with only a diagnosis.

The genuine blockchain application here is not tokenizing the ring. It is not putting your sleep data on a public chain. That would be reckless — you cannot un-publish biometric data, and the privacy surface of an immutable ledger is a nightmare for exactly the special-category information we discussed. Anyone pitching "your health data on-chain" as a feature has not thought about the failure modes, or worse, has.

The real application is in the ownership and access layer beneath the product. This is the DePIN thesis applied honestly: not "decentralize the hardware," because a sensor is a sensor and a titanium ring cannot be trustless, but "decentralize the data rights and the value flow." A model where the user holds a cryptographic identity, the biometric stream is encrypted to that identity, access is granted through scoped and revocable credentials, and any third party who wants to use the data — an insurer, a researcher, a wellness platform — pays through a mechanism that routes value back to the person who generated it.

That is technically feasible today. It requires a hardware root of trust, a key management layer, and a consent architecture. All three exist. The reason no mainstream health hardware company has done it is not technical — it is that the current model captures the value for the company, and the ownership model would distribute it to users. Incumbents do not voluntarily give up the asset.

This is precisely where decentralized physical infrastructure networks have a real, non-speculative role. A health-data network where users own their streams and are compensated for verified contributions is a coherent business. It aligns the incentive to share with the person doing the sharing. And it sidesteps the central regulatory landmine, because consent becomes granular, revocable, and auditable at the data layer rather than buried in a terms-of-service agreement nobody reads.

But — and this is the pragmatism test I always apply before I let myself get excited — I have watched DePIN health projects promise exactly this for years and reach almost no real users. The hardware is hard. The user experience is worse. The cold-start problem for a data network that needs both supply (users' data) and demand (buyers of insights) is brutal. So I hold this thesis at arm's length. The architecture is right. The execution record is thin. The gap between a correct idea and a shipped product is where most of crypto's value has historically evaporated.

The Contrarian Angle: Maybe Centralization Is the Point

Now let me argue the other side, hard, because the most valuable thing I can do for a reader is hand them the best version of the case against me.

Everything I have written so far carries an implicit assumption: that decentralized ownership of biometric data is both desirable and achievable at scale, and that Oura's centralization is a flaw. Let me stress-test that assumption — and I think it partly fails.

First, hardware is genuinely not a decentralization problem, and pretending otherwise is where DePIN narratives embarrass themselves. A ring that measures your blood oxygen requires a miniaturized sensor, a power budget measured in microwatts, an industrial-design process, a global supply chain, and a quality-assurance regime. None of that is improved by a token. Decentralization adds coordination cost without adding capability at the hardware layer. Oura's centralization of manufacturing is not a bug; it is the only way the product exists at all.

Second, the "you own your data" promise is easier to state than to honor. If a user holds their biometric record and something goes wrong — a lost key, a misconfigured consent, an exploit — there is no customer-service desk to call. Self-custody of health data is a far higher-stakes proposition than self-custody of a token. Lose your keys and you lose your sleep history permanently. The crypto industry has spent a decade learning how catastrophically bad ordinary users are at key management, and the lesson has been humbling. Exporting that failure mode into healthcare is not progress.

Third — and this is the sharpest version of the counterargument — consumers may not want data ownership at all. They want a product that works. The history of mainstream technology adoption is a history of convenience beating sovereignty, over and over. Oura's 5 million members did not subscribe because they wanted to own their data. They subscribed because the ring told them something useful about their recovery. The ownership question is my concern, as an auditor and an evangelist. It is not necessarily theirs. And building a movement on a value proposition the user does not feel is the oldest mistake in this space.

So here is the honest synthesis: Oura's centralization is defensible at the hardware layer, questionable at the data layer, and indefensible at the value-capture layer. I can accept that a decentralized ring is nonsense while insisting that a centralized claim on your biometric yield is a problem worth naming. The contrarian move is not to demand the company decentralize everything. It is to be precise about which layer actually needs it — and to stop letting the "decentralize it all" instinct, which is itself a VC-manufactured narrative, substitute for that precision.

Anonymity, Consent, and the Shield

There is one more dimension I want to address, because it sits at the intersection of my values and Oura's core asset, and because I think it is the most under-discussed regulatory risk in the entire deal.

Health data is the one category where anonymity stops being a lifestyle and becomes a necessity. A wallet address can be a shield. A sleep record cannot. Your biometric stream is the most personally identifying dataset that exists — it is more uniquely you than your fingerprint, because it is continuous and behavioral. The moment that data is aggregated, correlated, or breached, it cannot be anonymized in any durable sense. Re-identification from supposedly anonymized health data is a solved problem, and the solutions are getting easier every year.

Oura sits on five million of these longitudinal records. That is not a footnote in the risk section. It is the risk section. A breach would not be a reputational event; it would be a categorical one, because the data cannot be rotated like a compromised password. And if the company ever pushes into monetizing that data — through insurance partnerships, research licensing, or wellness integrations — it crosses from handling special-category data to commercializing it, which invites the full force of GDPR enforcement, the incoming EU AI Act's treatment of health algorithms, and a patchwork of tightening US state laws.

I have watched my community's reaction to subscription changes before. When users feel a data relationship has become extractive rather than reciprocal, the backlash is not proportional and it is not patient. The subscription billing itself carries a second regulatory edge — the FTC's "click-to-cancel" rule and European consumer law both target exactly the auto-renewal friction that a hardware-plus-subscription model depends on. And the question my community keeps asking, the one the analysis document framed perfectly — whether the subscription bill is worth the data being collected — is not a marketing challenge. It is a trust challenge.

And trust, as I have written for years, is the only protocol that matters. You cannot audit trust into a product. You cannot code it into a privacy policy. You build it, or you lose it, and once it is gone, no amount of oversubscription or brand equity buys it back.

Being Human in an Automated Market

Let me step back from the spreadsheet and say something about why this particular IPO matters to me beyond the numbers, because I think it connects to why any of us are here.

When I was moderating Ethos Circle for 72 hours straight during the October 2020 exploits, translating panicked exploit reports into safety checklists so 2,500 members could understand what was happening to their money, I learned that the most valuable thing I could provide was not analysis. It was context for human beings who were scared. Analysis without empathy is just a well-organized way of feeling superior to people who are losing.

Oura's IPO is going to attract a wave of retail buyers who will read "software company," "wellness megatrend," and "four times oversubscribed," and will make a decision the same way my fifteen friends made their decision in 2017 — on the strength of the story, not the structure. My job, if I have one, is not to tell them whether to buy. It is to hand them the structure: the 73%, the App Store rent, the hardware/software mismatch, the data-ownership question, the lock-up cliff. Just the structure, plainly. What they do with it is theirs.

I have said this before and I will say it again: code is law, but people are the context. The most rigorous analysis in the world is worthless if it does not reach the person holding the phone at 2 a.m. trying to decide whether to move their savings. The whole point of the work — the whole reason I stopped being a pure software engineer after 2017 and started auditing for ethical red flags — is that the mechanics are indifferent to the humans they affect. Someone has to read them on behalf of the humans.

What I Am Watching

I do not end with summaries. I end with the signals I will be tracking, because the value of analysis is entirely in whether it can be falsified.

Watch the primary/secondary ratio in any follow-on offering. If the company comes back to market to raise primary capital, that is a different signal than another secondary-heavy liquidity event. Watch the subscription percentage. If it climbs meaningfully above 20% of revenue, the software thesis begins to earn its multiple. If it stalls while member counts grow, the narrative is separating from the economics. Watch the App Store economics for any disclosed restructuring. Watch the lock-up calendar, because a scheduled supply event is a scheduled supply event no matter what it is called. Watch for the first Big Tech ring. And watch for the first serious privacy incident, because in this business the first one may be the last chance.

The ring on my finger is a good product. The company behind it is a real business. And the IPO is neither of those things. It is a transaction — priced at the top of a scarcity-driven window, structured so that most of the money leaves the building, and valued on a story its own revenue composition does not yet support.

The thing I keep coming back to, the thing I want to leave in the reader's mind, is not a price target. It is a question. When you buy a share of a company whose most valuable asset is the intimate data of its customers, you are not just buying an equity position. You are buying a claim on a relationship between that company and five million people who fell asleep trusting it.

Community over coin, always. The market will price the coin. It is up to all of us to decide what the community is worth — and whether, this time, we are going to read the structure before we pay for the story.