Guidance for sniffing a Medtronic BLE loop recorder

[Digital Corpus]

I have a close friend with a curiosity streak who’s approached me about a unique topic. They have a loop recorder, aka an ICM or insertable cardiac monitor. Specifically the LINQ II manufactured by Medtronic. It has a 4.5 yr rated battery life, 1 mW antenna, iirc, and connects to a base station or phone to upload once a day. Additionally, a neck worn dongle allows for live output of the patient’s ECG, though company reps are the only ones in possession of the device.

He’s not so much interested in the live output but the daily reports if any events are reported. As such, I’m only looking on how to sniff these packets and determine if the data is able to be interpreted as it isn’t available to the patient directly. Currently his ICM is setup through pairing with a bedside base station connected through a mobile/cellular uplink to Medtronic. The pairing is controlled by Medtronic and no SIM card is accessible. Theoretically the station can be connected to the home WiFi, but these instructions haven’t been attempted or inquired as to if the patient can do so w/o speaking to the company rep.

Looking for advice or guidance on helping him out. I visit him at least once a week and doesn’t mind some experimentation, so as long as it’s passive. At the time, please consider the base station as tamper evident though I’ve not looked up FCC filings for it directly just yet.

I’m not aware of if this is in violation of forum policies, but again, just looking to passively read/copy the nightly upload for my friend. I do realize personally identifiable information may be contained in the transmissions.