Hide The Complexity, Own The Risk: Oura’s CIO On Responsible Health AI

Every company has to worry about AI safety and security. But the stakes are much higher when dealing with sensitive information, like an individual’s health data. Trust becomes non-negotiable. And it’s up to technology leaders to deliver the privacy, accountability, transparency and scale needed to deliver on that mandate.

That’s Sanjay Chandra’s mission at Oura: Strengthening the IT foundation so patients are confident in the insights delivered. As Oura expands beyond wearables into a full-blown healthcare technology platform, Sanjay’s purview encompasses more than just stewardship. Like other CIOs, he’s on the frontlines helping business users translate their problems into technology solutions.

CIOnews talked to Sanjay about his path to Oura, the evolving role of the CIO, governance as a foundational problem, and why invisible technology doesn’t mean invisible accountability.

How’d you end up at Oura?

I’ve lived and worked in the Bay Area for more than two decades. My career has taken me across media and entertainment, financial services, enterprise software, automotive, and now health technology

I was drawn to technology because it combines problem-solving with real-world impact. Over time, my scope expanded from systems into operations, risk, and business strategy. That is what ultimately led me to the CIO role at Lucid, and now Oura.

If you weren’t a CIO, what would you be doing?

I have always loved the world of medicine and I suspect I would have done something in that space. In many ways, Oura connects me back to something I inherently was interested in.

Why Oura, and why now?

Oura has built a strong foundation across hardware, software, science, data, and member experience. The opportunity now is to scale that foundation as the company expands across products, geographies, and healthcare partnerships.

At Oura, I’m not starting from scratch. I have the opportunity to build on a solid foundation with a world class team to ensure the systems underneath the business are secure, reliable, interoperable, and ready for the next stage of growth. In health technology, privacy, consent, security, and governance have to be built in from the start—not added later.

How are you thinking about data infrastructure in the age of AI?

AI raises the standard for data infrastructure. Data has to be accurate, well understood, discoverable, and protected. You need clear ownership, lineage, consistent definitions, strong quality controls, and fine-grained access. We have a strong foundation for all of that and a platform that always us to scale the business.

Do specialized AI models impose different data requirements?

Yes. Specialized intelligence requires domain-specific data, strong provenance, thoughtful evaluation sets, subject-matter expertise, and a way to test whether the system is useful and safe for its intended purpose.

Even when a company uses a commercial or open source model, it still owns responsibility for the data and the experience around it. At Oura, member data should not be treated as an undifferentiated training resource. It can help personalize an experience without automatically becoming part of model training. That distinction matters for privacy, consent, and trust.

How is the CIO mandate different from traditional IT leadership?

Availability, cost, delivery, compliance, and support still matter. They are table stakes. But the CIO role now extends into product, data, risk, business strategy, and the company’s relationship with customers and partners.

The CIO has to be a steward of trust as well as an operator of systems. That means helping the business decide what to build, buy, or partner for; preparing the organization to use AI responsibly; and connecting technology investment to measurable business and member outcomes.

What does AI governance look like?

A policy document alone is not governance, and a platform without accountability is not governance either. You need clear ownership for the use case, the data, the model, the user experience, and the risks.

Technically, the safe path should be the easy path. That means common capabilities for identity and access, data classification, approved environments, model ownership, evaluation, monitoring, auditability, incident response, and human review where the stakes require it.

I’m less interested in whether we call it an “AI factory” or a “control plane” than in whether it works. I see a control plane as shared guardrails and services, with teams closest to the use case remaining accountable for the outcome. Good governance should accelerate innovation by reducing late-stage surprises.

What does success look like in one year?

A year from now, I want technology to be a stronger enabler of the business. Teams should be able to move faster because our systems are more connected, our data is more trusted, and the path from an idea to a secure implementation is clearer.

Success means fewer manual handoffs, stronger security and privacy by default, better visibility into priorities, and a clearer path for enterprise AI use cases that create measurable value without unnecessary risk. It is not about the number of pilots we announce. It is about better experiences for employees and members and a foundation that supports responsible growth.

‍How are you thinking about business-system transformation?

Build versus buy should not be ideological. For commodity capabilities, a partner can often provide speed, scale, and maturity. Where Oura has unique data, workflows, or member needs, we may build the connective tissue or experience ourselves. But we won’t shy away from building in-house where we feel a need has not been met or is innovation-stagnant.

The right answer is usually a combination: buy the core systems where that makes sense, build the integrations and automation that make them work for Oura, and start with the business journey rather than the technology category. Where are we creating friction? Where are we relying on manual handoffs? Where can better systems improve speed, accuracy, or member experience?

How can AI make technology more invisible?

For employees, the near-term opportunity is to reduce system switching, repetitive data entry, reconciliation, and the effort required to find information. More time spent doing intelligent work and less time finding the data that supports it. For members, it is to make insights more relevant and actionable without asking them to interpret dozens of separate signals.

The future capability I’m most excited about is personalized health intelligence: systems that understand an individual’s baseline and context over time, connect the right signals, and offer timely, explainable guidance under the member’s control. Some capabilities may eventually move closer to the device to improve privacy, latency, and reliability.

Invisible technology does not mean invisible accountability. Members should not have to see the complexity underneath, but they should be able to trust that it is secure and that the system is honest about what it knows and does not know