It certainly is. HIPAA binds healthcare providers and those entities who get data from them. Samsung is not bound by either of these, unless it is sourcing the health information from, like, your doctor, and not from your watch.