Yeah sadly it is paywalled, but I have been lucky enough to get access to it through my university.

Heres what I found regarding your question in the article:

Fig 1 illustrates Pulse-Fi's system architecture which consists of three main components: data collection using commodity Wi-Fi devices, a CSI signal processing pipeline, and a custom lightweight Long Short Term Memory neural network for heart rate estimation.

Fig 1:

And this is the Setup they used to collect the ESP-HR-CSI Dataset (left site) and the one that other researchers used to collect the E-Health Dataset (right side):

The parts on how they collected the data:

A. ESP-HR-CSI Dataset
We collected the ESP-HR-CSI dataset from seven participants (5 male, 2 female) in a room of a public indoor library. It was collected using two ESP32 devices, one as the transmitter and the other as the receiver. The sampling rate is 80 Hz, with a 20 MHz bandwidth with 64 subcarriers positioned at different distances. Each participant was measured at distances of 1,2 and 3 m for 5 minutes each. The participants sat in a chair between the devices and wore a pulse oximeter on their finger to collect ground-truth information as seen in

B. E-Health Dataset
The E-Health dataset [20] contains CSI collected from 118 participants (88 men, 30 women) in a controlled indoor environment measuring 3 m×4 m (Fig 4). The setup consists of a router set in the 5 GHz band at 80 MHz bandwidth as a transmitter, a laptop as receiver and a single-antenna Raspberry Pi 4B with NEXMON firmware for CSI data collection (234 subcarriers). Participants wore a Samsung Galaxy Watch 4 for the ground truth.

Each participant performed 17 standardized positions or activities, with each position held for 60 seconds.

To me it sounds like, that they really just used standard WIFI to collect the data (this is especially true for the E-Health Dataset), since all the processing gets done on the Raspberry Pi.

All these Wifi for tracking people methods use the channel state information (CSI) that is used to help decode the transmitted data. CSI is obtained from pilot signals that are transmitted as part of a regular transmission. This is done in basically all digital communication standards, so you could do this not just with Wifi but also with 4G or 5G or older mobile communication standards. This is all not very surprising, there is a lot of research in contactless radio based heart rate monitoring, they usually build on radar systems not communication systems though. The buzzword for 6G for all this is joint communication and sensing.

Let's try again: someone is getting spied on by someone because someone is so damned important to someone. And there's a lot of someones.

Health data is extremely valuable. You can use it to serve more personalised ads or even use it to, as example, define prices for health insurance. When you combine it with lots of other data it becomes even more valuable. Also never forget, big corporations track literally everything. Why not add your heart rate.

Not everyone, just Americans and other surveillance states. I have no idea about Canada but probably you too.