How complicated it is depends on how their infrastructure is built. I know everything fitting in the phone app is unreasonable for the features of a modern tracker. With that constraint, the ideal privacy option for a health tracker in my mind is this.

They offer a docker container that emulates their server infrastructure.

When I log in I have the option to point to their cloud or my server.

I have the option to share with their cloud also if I want to for features that truly require their compute such as the AI assistant that Oura offers. Only features that truly can't be self hosted should be cloud only.

Existing customers should have the option to export their data from the cloud to their computer including deleting cloud data if desired.

Even if none of that is possible short term, more plain English disclosures and agreements with granular control over who saw my data would help.

I am a hesitant customer of Oura. It truly helped me with a long term health issue I was having and I believe that market can help others like me. I do have concerns about the privacy issues of giving them all that data but I chose to take the risk because I was having an issue I couldn't figure out. I'd be happy to help if I am able.