Health and fitness features are disclosed if HealthKit or Health Connect is used
Why it matters
A missing NSHealthShareUsageDescription in Info.plist does not cause rejection — it causes a runtime crash the moment the app requests HealthKit permission on a user's device. This crash reaches production users if it somehow passes App Store review (possible if reviewers don't trigger the health flow). Under HIPAA §164.502 and GDPR Art. 13, health data has the highest protection tier; collecting it without a documented privacy policy describing the data type, purpose, and sharing parties exposes the developer to regulatory action by HHS (US) or a supervisory authority (EU), with fines up to 4% of global annual turnover under GDPR.
Severity rationale
Medium because the failure causes a confirmed runtime crash on health permission request and creates HIPAA/GDPR regulatory exposure for sensitive health data collection.
Remediation
Add both HealthKit usage strings to ios/[AppName]/Info.plist before submission:
<key>NSHealthShareUsageDescription</key>
<string>This app reads your step count to calculate personalized activity goals.</string>
<key>NSHealthUpdateUsageDescription</key>
<string>This app saves your workout sessions to help you track fitness progress.</string>
For Expo, configure in app.json under expo.ios.infoPlist. Ensure the privacy policy reachable from your store listing explicitly describes what health data types are collected, why they are collected, whether they are shared with third parties, and how users can request deletion. Complete the App Store Connect privacy nutrition label's health data section before uploading the binary.
DetectionPro
The detection method for this pattern is part of AuditBuffet Pro.
The full method (what to look for, pass and fail conditions, and how results get reported) ships inside the App Store Metadata & Listing Audit. The pattern definition, severity rationale, and remediation remain openly licensed under CC-BY-4.0.
External references
- hipaa · §164.502 — HIPAA Privacy Rule — Uses and Disclosures of Protected Health Information
- gdpr · Art. 13 — GDPR Article 13 — Information to be provided where personal data are collected from the data subject
- external · apple-healthkit-guidelines — Apple App Review Guideline 5.1.3 — Health & Health Research
Taxons
History
- 2026-04-18·v1.0.0·Initial import from app-store-metadata-listing·automated