That fitness-tracking device on your wrist may soon be charting your bottom line as well as your health, as a growing number of insurance companies and employers offer financial incentives to people who use the gadgets.

The conversation about data privacy has become more intense over the past year, following a series of high-profile data breaches from companies such as The Home Depot, JP Morgan Chase, Kmart and Staples. The massive theft of data from some 78 million customers of insurance company Anthem, revealed in February, has put the spotlight on the security of medical data, just as wearable technology is growing ever more mainstream.

“These companies do actually try quite hard to keep the data private and safe, to the extent that you can,” said Sonny Vu, CEO of fitness-tracker company Misfit.

Others are less sanguine.

“You should be very, very worried,” said Deborah C Peel, founder of Patient Privacy Rights, a privacy advocacy organization based in Austin, Texas.

Wearable fitness technology includes devices that capture user information such as heart rate, steps taken and sleep patterns. The most recognizable brands include Fitbit, Jawbone and Misfit.

The market for these devices is small but growing. As of November, just 10% of US consumers report owning such a device, according to research firm NPD Group, with ownership numbers doubling since 2013.

Health insurance companies are helping to drive this growth.

New York-based Oscar, a new health insurance company focused on using technology to communicate with customers, announced in February that it would be giving all of its patrons Misfit fitness trackers. Users will receive $1 each time they hit their daily goal for steps taken – up to an annual total of $240 – distributed each month in an Amazon gift card. And consumers have been responsive.

“Twenty dollars a month? That’s awesome – that’s motivation for me,” said Heath Brockwell, an apprentice barber from New York City, one of the first recipients of a Misfit from Oscar.

Insurance company UnitedHealthcare offers a health management app that connects to Fitbit devices. Insurers Aetna and Cigna report that many employers they work with are providing discounts or rewards to employees who use wearable fitness technology.

Responding to this growing demand, Jawbone, maker of the Up device, last month released Up for Groups, a program that allows employers to buy the gadgets in bulk for their staffs. After announcing its collaboration with Oscar, Misfit saw “a bunch of people come out of the woodwork” – individuals, employers and insurance companies – interested in similar partnerships, Vu said.

Insurers haven’t yet started using data from these devices to calculate individual premiums. Rather, in many cases, employees can earn rewards or discounts on their insurance payments for using the tracking devices. For other employers, the goal is simply to improve employees’ health, thus lowering their heath care costs and, ultimately, the price of insurance.

“By reducing the risk profile, the expected claims payment is lowered, and therefore the employers’ future premiums are lowered,” said Joseph Mondy, spokesman for insurer and health services company Cigna, which incorporates wearables into the wellness programs it designs for clients.

As these partnerships develop and more data flows from consumers to third parties, however, questions of security and privacy become more pressing.

“As soon as insurers are incentivizing you to wear something because it’s going to save money, it becomes a bigger target for the attackers,” said Greg Dracon, head of the security practice at .406 Ventures, a venture capital firm in Boston.

If future devices start recording and transmitting more detailed data, cyber-criminals might be increasingly tempted, Dracon warned. The sale online of personally identifiable information (PII) has become very big business, he said. The price might go up, he said, if hackers can offer more than just a name and a social security number: such as what time a person is likely to be out running or what medications she takes, for example.

“The issue of wearables just expands what PII means,” he said. “It’s just going to sweeten the amount of money PII brings.”

Misfit head Vu admits that determined hackers could indeed get at some information, but he simply doesn’t believe fitness data will be much of a lure.

“You don’t know it’s safe – if someone really wanted to hack in and get this data, they could,” said Vu. “At the same time we have to consider the amount of work and expertise it takes to be able to do that – I’m just not worried about people breaking into my account and stealing my step count.”

Privacy is still a concern for many. A report made last year by the Federal Trade Commission looked at a selection of health apps and devices and found that many of those surveyed were sharing or selling data to third parties. Democratic Senator Chuck Schumer has called for tightening the privacy rules regulating these programs and gadgets.

Prominent wearables companies, however, deny that they ever sell or share user data without explicit customer permission. Spokeswomen from both Misfit and Jawbone say that customer data is never sold to third parties. Both sometimes share data with partners, but only when specifically requested or allowed by the accountholder, the spokeswomen said. Users, for example, may ask that their data be shared with another fitness or health app.

Vu says that Misfit’s terms and conditions state explicitly that users have ownership over their own data: that they have the right to choose when their data is accessed, moved and deleted. Before forming partnerships like the deal with Oscar, Misfit must be satisfied that its collaborator has similarly firm data privacy policies, Vu said.

Similarly, Jawbone has designed its system to require the explicit permission of the user before any data can be shared with a third party, said Andrew Rosenthal, Group Director for Wellness and Platform at Jawbone. And when new features are added, users are again asked to confirm whether they would like to share their data. In fact, Jawbone has frustrated several potential partners by refusing to set up programs that automatically feed data to insurance companies, Rosenthal said.

“There’s nothing that gets shared without your consent,” he said. “It’s 100% in the control of the consumer.”

On the insurer side, Cigna also requires employees’ consent for every type of data that is reported from their trackers, Mondy said. A third-party administrator reviews the data to determine who is eligible for rewards or discounts, he said. Employers receive aggregated data, but never see numbers attached to individual names.

Privacy advocate Peel, however, is not ready to put her faith in these corporations. The market for health data is sprawling and lucrative, she said, and there is simply too little information about how information moves through it for consumers to fully understand what they are agreeing to. Furthermore, she said, corporate terms and conditions are often too dense and confusing for the average user to understand.

“Our system in the US is totally opaque – there’s no transparency and no accountability,” she said. “It’s very hard, unless you’re a lawyer, to really know what that privacy policy means.”

Allowing consumers enough information to be able to choose how to share their data is key.

“The general move in this direction is good, but it does raise some questions about privacy and transparency,” said Robert Hunter, director of insurance for the Consumer Federation of America. “Consumers should make that choice.”

For now, Dracon said, the growing integration of wearables into insurance practices probably offers a net benefit to consumers, especially given rising health care costs and the proliferation of high-deductible insurance plans. But he’s paying attention as the data moves from simple step counts to more complex information like heart rates and medication usage.

“It does become more [disconcerting] when it’s really information about health,” he said. “Then they start to tread that line.”