The short answer
Using HRV-derived information, linking one section to another from the same recording among 202 candidates achieved 30.7% at rank one and 55.4% within the top five. Random selection would be about 0.5% and 2.5%. This unreviewed analysis used the same day, device and posture in a closed candidate set. It does not establish identity verification across days or devices, or authentication that can reject an unknown person.
Key points
- Across 202 people in a public dataset, HRV-derived information linked two sections from the same person's recording
- Rank-one 30.7% (chance 0.5%); top-five 55.4% (chance 2.5%)
- 20,000 permutation replicates (smallest reportable one-sided p-value: 0.00005)
- But this is within a single session; stability across days, devices or sleep and wake was not shown
- It is not an Apple Watch evaluation, and not a measure of authentication performance
Why we tested it
HRV summarizes beat-interval variation in several ways. It is influenced by posture, breathing, age and measurement conditions, but it may also carry repeated person-level patterns or features shared by one recording.
For a health app, the degree to which two records can be linked matters when assessing the risks of storage, export and sharing.
How it was measured
Use public data
From PhysioNet's Autonomic Aging dataset, we used the 211 subjects already frozen as the held-out split. 202 of them met the conditions.
Use separate sections of each recording
Separate, non-overlapping sections from the same recording were used as reference and query data. The specific sectioning rules are unpublished.
Compare HRV-derived information
A research matching method used HRV-derived information. Its feature design, preprocessing and similarity calculation are unpublished.
Compare against chance
Picking at random from 202 gives 0.5% at rank one. That is the baseline the measured accuracy is set against.
Results
- Rank one: 62/202 = 30.7% (95% CI 24.7–37.4%; chance 0.495%)
- Top five: 112/202 = 55.4% (95% CI 48.6–62.1%; chance 2.48%)
- Permutation test: 20,000 replicates (smallest reportable one-sided p-value: 0.00005)
- Reversing the comparison direction in a sensitivity analysis: rank one 34.2%, top five 55.9%
What this result does not mean
Read as numbers alone, this looks like "HRV can verify identity". It cannot. The test has limits worth stating plainly.
- Enrolment and query come from the same recording session — same day, same device, same posture
- The candidate set is closed at 202; the ability to reject an unknown person was not measured
- Stability across days, devices, or sleep and wake was not demonstrated at all
- Session, sensor or processing artefacts specific to a recording may contribute to the linkage
- This is not an Apple Watch evaluation. The signal used was clinical ECG
How this shows up in Feelmo
Because of this result, Feelmo keeps HRV-derived data and scores on the device as a rule, with no automatic upload to Provider servers. Only when you start an export or a share does the content you chose go where you send it.
This analysis does not decide the legal status of the data, but it does show that separate sections of a same-session record may remain linkable, so we use a cautious design.
The data and transparency
Aggregate results, uncertainty intervals, sensitivity findings and the limits listed above are published as JSON.
Per-subject information and the specific feature design, preprocessing and matching calculation are unpublished. This means independent researchers cannot yet reproduce the exact analysis, which is an important limitation.