Wearable devices like EmotiBit are increasingly used to collect physiological data. However, their communication protocols often lack robust security mechanisms, exposing sensitive data to interception and manipulation. This paper analyses the vulnerabilities of EmotiBit and presents an application-layer security protocol that leverages pre-shared keys, symmetric encryption, and HMAC-based authentication. The solution has been implemented through modification to both the EmotiBit firmware and the Oscilloscope software, and validated via traffic analysis and simulated attack scenarios. Results demonstrate that the proposed scheme effectively ensures data confidentiality, integrity, and authenticity without compromising system performance.