Does my fitness app have to be HIPAA-compliant?

Not automatically. HIPAA applies when you're a covered entity (a healthcare provider, health plan, or clearinghouse) or a business associate handling protected health information on one's behalf. A direct-to-consumer fitness app that a user installs themselves is usually not covered by HIPAA — but it is still subject to other rules (GDPR, state privacy laws, the FTC Health Breach Notification Rule, and app-store policy). Where you sit determines everything else, so start with the HIPAA and 'is this data PHI' pages.

Is heart rate or step data considered sensitive?

Often, yes. Under GDPR, data 'concerning health' is a special category needing a stronger legal basis, and regulators have treated fitness and wearable data as health data in many contexts. Under HIPAA the label 'PHI' depends on who holds it and why, not just what it is. The practical takeaway: treat wearable and workout data as sensitive by default, and read the 'is fitness data PHI or PII' page for the distinctions.

What's the minimum I need before launch?

At a minimum, most health apps need: a clear, accurate privacy policy; a lawful basis and genuine consent for collecting health data; secure storage (encryption in transit and at rest, access controls); a way for users to export and delete their data; and compliance with Apple's and Google's health-data rules if you ship on their stores. Each is covered in its own page below. This is general guidance, not legal advice — confirm specifics for your jurisdiction and product.

Compliance

Health-Data Compliance & Privacy for Fitness Apps

Most consumer fitness apps are not covered by HIPAA, but they still have real obligations: GDPR and state privacy laws treat fitness and wearable data as sensitive, app stores impose their own health-data rules, and the FDA regulates a narrow slice of apps that make medical claims. This hub maps which rules apply to you, what counts as health data, and how to build for consent, secure storage, retention, and deletion. It is general engineering guidance, not legal advice.

Start with the rules that apply to your situation, then move to the build practices. If you’re still choosing infrastructure, an aggregator or an on-device approach can change how much regulated data you touch in the first place. For the consent mechanics, see OAuth for health data.

Which rules apply to you

Figure out your obligations before you write a line of code.

Platform requirements

What Apple and Google require to ship a health app.

Building it right

Consent, storage, retention, and the policy users actually read.

Frequently asked questions

Does my fitness app have to be HIPAA-compliant?: Not automatically. HIPAA applies when you're a covered entity (a healthcare provider, health plan, or clearinghouse) or a business associate handling protected health information on one's behalf. A direct-to-consumer fitness app that a user installs themselves is usually not covered by HIPAA — but it is still subject to other rules (GDPR, state privacy laws, the FTC Health Breach Notification Rule, and app-store policy). Where you sit determines everything else, so start with the HIPAA and 'is this data PHI' pages.
Is heart rate or step data considered sensitive?: Often, yes. Under GDPR, data 'concerning health' is a special category needing a stronger legal basis, and regulators have treated fitness and wearable data as health data in many contexts. Under HIPAA the label 'PHI' depends on who holds it and why, not just what it is. The practical takeaway: treat wearable and workout data as sensitive by default, and read the 'is fitness data PHI or PII' page for the distinctions.
What's the minimum I need before launch?: At a minimum, most health apps need: a clear, accurate privacy policy; a lawful basis and genuine consent for collecting health data; secure storage (encryption in transit and at rest, access controls); a way for users to export and delete their data; and compliance with Apple's and Google's health-data rules if you ship on their stores. Each is covered in its own page below. This is general guidance, not legal advice — confirm specifics for your jurisdiction and product.

General engineering guidance, last reviewed July 14, 2026. This is not legal, medical, or regulatory advice. Health-data laws (HIPAA, GDPR, state privacy laws) and platform policies vary by jurisdiction and change often, and how they apply depends on your specific product, users, and data. Confirm your obligations with a qualified attorney or compliance professional and check the current official sources before you ship.