A smartwatch that does not send your data God knows where?

I do medical research involving wearables / smartwatches and I don't want patients to have to use an app that sends their data to some random, probably foreign, company's server. This is especially problematic within Europe and GDPR because fitness data can be seen as health-related information [1], especially in a medical context.

I am interested in the typical stuff: step counts, (24h) heart rate and possibly sleep detection. Nothing exotic. To conduct my research, I would need to access the data, either because the user sends it to me, or (better) I can build myself an app that retrieve the data via Bluetooth or a local file or a database of some sort (e.g. HealthKit).

So I am looking for a wearable that either a) has its own app, but keeps the data locally (and makes it accessible) or b) has a known Bluetooth protocol I can access with my app or c) is programmable. The device must be compatible with both Android and iOS, because we want to use patients' phones.

I am really struggling to find one.

[1] https://edps.europa.eu/sites/edp/files/publication/15-05-21_mhealth_en_0.pdf