Health and medical app compliance — HealthKit/Health Connect rules, no health data mining
Why it matters
Apple guideline 5.1.3 (HealthKit) and Google Play's Health Connect policy prohibit transmitting health data to advertising or analytics platforms — a prohibition that is routinely violated by apps that include general analytics SDKs like Mixpanel or Amplitude without filtering health data from event properties. GDPR Article 9 classifies health data as a special category requiring explicit consent separate from general ToS acceptance. HIPAA §164.514 applies if the app is used in a clinical context. Over-permissioning HealthKit data types (requesting menstrual cycle data for an app that has no tracking feature) is flagged automatically by Apple's review tooling.
Severity rationale
Medium because health data policy violations trigger Apple rejection and can simultaneously create GDPR Article 9 exposure in the EU — two independent enforcement regimes with separate penalties and separate legal bases for action.
Remediation
Audit every HKObjectType (iOS) or HealthPermission (Android) requested and remove any type not mapped to a visible user-facing feature:
// Only request types you visibly use
let typesToRead: Set<HKObjectType> = [
HKObjectType.quantityType(forIdentifier: .stepCount)! // used in step tracker screen
// Remove: HKObjectType.quantityType(forIdentifier: .heartRate) — no heart rate screen exists
]
For analytics calls, ensure no health variable appears as an event property:
// Wrong — health data in analytics event
mixpanel.track('workout_completed', { duration_min: 30, heart_rate_avg: 142 });
// Correct — anonymous aggregate only
mixpanel.track('workout_completed', { duration_min: 30 });
Add a dedicated health data consent screen (separate from ToS) before the first HealthKit read.
DetectionPro
The detection method for this pattern is part of AuditBuffet Pro.
The full method (what to look for, pass and fail conditions, and how results get reported) ships inside the App Store Policy & Content Compliance Audit. The pattern definition, severity rationale, and remediation remain openly licensed under CC-BY-4.0.
External references
- external · apple-guideline-5.1.3-healthkit — App Store Review Guidelines 5.1.3 — HealthKit and Health Research
- gdpr · Art. 9 — GDPR Art. 9 — Processing of special categories of data (health data)
- hipaa · §164.514 — HIPAA — De-identification of Protected Health Information
- ccpa · §1798.140(o) — CCPA — Definition of sensitive personal information including health data
- external · google-play-health-connect — Android Health Connect Developer Policy
Taxons
History
- 2026-04-18·v1.0.0·Initial import from app-store-policy-compliance·automated