---
title: "App Store Guideline 5.1.2: Data Use and Sharing"
canonical: "https://aifitnessapi.com/compliance/app-store-guideline-5-1-2-data-use-sharing"
cluster: "Compliance"
primary_query: "app store guideline 5.1.2"
last_reviewed: "2026-10-03"
description: "Guideline 5.1.2 for health apps: permission before sharing, the third-party AI clause, no repurposing, and the HealthKit ad ban, quoted with a checklist."
publisher: "AIFitnessAPI — independent, not sponsored"
cite_as: "\"App Store Guideline 5.1.2: Data Use and Sharing\", AIFitnessAPI, https://aifitnessapi.com/compliance/app-store-guideline-5-1-2-data-use-sharing"
---

# App Store Guideline 5.1.2: Data Use and Sharing

> App Store Review Guideline 5.1.2, Data Use and Sharing, requires permission before you use or share personal data, plus clear disclosure and explicit permission before sharing with any third party, explicitly including third-party AI. Data collected for one purpose can't be repurposed without new consent. Data from HealthKit, the Clinical Health Records API and the MovementDisorder APIs can't be used for marketing, advertising or use-based data mining. Quoted from the guidelines as last updated June 8, 2026, checked October 3, 2026; this is general guidance, not legal advice.

- Canonical: https://aifitnessapi.com/compliance/app-store-guideline-5-1-2-data-use-sharing
- Last reviewed: 2026-10-03
- Publisher: AIFitnessAPI (https://aifitnessapi.com) — independent, not sponsored
- Cite as: "App Store Guideline 5.1.2: Data Use and Sharing", AIFitnessAPI, https://aifitnessapi.com/compliance/app-store-guideline-5-1-2-data-use-sharing

---

## The guideline text

Quoted verbatim from Apple's [App Review Guidelines](https://developer.apple.com/app-store/review/guidelines/#5.1.2), which the page states were last updated June 8, 2026. We checked the text on October 3, 2026. Apple revises the guidelines and sometimes renumbers sub-items, so compare this against the live page before you cite it in a reply to App Review.

Guideline 5.1.2 has seven sub-items. The four most relevant to a health or fitness app are quoted below. The others cover contact databases, messaging contacts and Apple Pay data.

> **5.1.2 Data Use and Sharing**
>
> (i) Unless otherwise permitted by law, you may not use, transmit, or share someone’s personal data without first obtaining their permission. You must provide access to information about how and where the data will be used. You must clearly disclose where personal data will be shared with third parties, including with third-party AI, and obtain explicit permission before doing so. Data collected from apps may only be shared with third parties to improve the app or serve advertising (in compliance with the Apple Developer Program License Agreement). You must receive explicit permission from users via the App Tracking Transparency APIs to track their activity. Learn more about tracking. Your app may not require users to enable system functionalities (e.g. push notifications, location services, tracking) in order to access functionality, content, use the app, or receive monetary or other compensation, including but not limited to gift cards and codes. Apps that share user data without user consent or otherwise complying with data privacy laws may be removed from sale and may result in your removal from the Apple Developer Program.
>
> (ii) Data collected for one purpose may not be repurposed without further consent unless otherwise explicitly permitted by law.
>
> (iii) Apps should not attempt to surreptitiously build a user profile based on collected data and may not attempt, facilitate, or encourage others to identify anonymous users or reconstruct user profiles based on data collected from Apple-provided APIs or any data that you say has been collected in an “anonymized,” “aggregated,” or otherwise non-identifiable way.
>
> (vi) Data gathered from the HomeKit API, HealthKit, Clinical Health Records API, MovementDisorder APIs, ClassKit or from depth and/or facial mapping tools (e.g. ARKit, Camera APIs, or Photo APIs) may not be used for marketing, advertising or use-based data mining, including by third parties. Learn more about best practices for implementing CallKit, HealthKit, ClassKit, and ARKit.

## What it means for a fitness or health app

- **5.1.2(i): permission before use, and disclosure before sharing.** You need permission before you "use, transmit, or share" personal data. Users need access to information about how and where it will be used. Sharing with third parties needs clear disclosure and explicit permission first. The guideline names "third-party AI" alongside other third parties.
- **5.1.2(i) also limits sharing and requirements.** Apple allows sharing with third parties only "to improve the app or serve advertising (in compliance with the Apple Developer Program License Agreement)". Tracking needs App Tracking Transparency. You can't require users to enable push notifications, location services or tracking to use the app.
- **5.1.2(ii): no repurposing without new consent,** unless the law explicitly permits it.
- **5.1.2(iii): no profile building or re-identification** from data you collected, including data you describe as anonymized or aggregated.
- **5.1.2(vi): HealthKit data is off-limits for marketing, advertising and use-based data mining,** and so are the Clinical Health Records API and the MovementDisorder APIs. The ban includes third parties. [Guideline 5.1.3](/compliance/app-store-guideline-5-1-3-health-research) repeats and extends it for health, fitness and medical research data.

## The third-party AI clause and AI coaching features

If your app sends a user's workouts, heart rate or sleep to an external model API to generate coaching, the text of 5.1.2(i) applies directly. Disclose that personal data goes to a third-party AI and get explicit permission before the first request.

For HealthKit-derived data, Apple's ["Protecting user privacy"](https://developer.apple.com/documentation/healthkit/protecting-user-privacy) article adds a condition: "Even with permission, you can only share information to a third party if they also provide a health or fitness service to the user." Apple doesn't say whether a general-purpose model provider called by your coaching feature meets that condition, and we couldn't verify an official reading. Until Apple clarifies, treat it as an open question to raise with App Review. Don't assume the answer. For the engineering side of sending wearable data to a model, see [personalizing an app with wearable data](/ai/personalize-with-wearable-data).

## What typically triggers it in a health app

These come from the guideline text and Apple's HealthKit documentation, not from a log of rejections.

- **An AI or analytics vendor nobody disclosed.** Personal data goes to a third party, AI or not, with no in-app disclosure and no explicit permission beforehand.
- **Health values in ad or marketing tooling.** HealthKit-derived values reach an ad, attribution or marketing SDK. Apple's HealthKit documentation adds that "you can’t use data from the HealthKit store to serve ads".
- **Features gated on system permissions.** For example, workout history that unlocks only after the user enables notifications, or a reward that requires allowing tracking.
- **Quiet repurposing.** Data collected for one feature is reused for another purpose, such as model training or a partner program, without new consent.

## Checklist before you resubmit

1. **List every third party that receives personal data.** Include analytics, crash reporting, ad and attribution SDKs, your own vendors, and any AI or LLM API that receives user data in a prompt or as context. Guideline 5.1.2(i) names third-party AI explicitly.
2. **Disclose each recipient and get explicit permission before sharing.** Before the first transfer, tell users in the app where their personal data will go and ask for explicit permission. Guideline 5.1.2(i) requires both the disclosure and the permission before sharing.
3. **Remove HealthKit data from marketing, advertising and data mining.** Guideline 5.1.2(vi) bars using data from HealthKit, the Clinical Health Records API and the MovementDisorder APIs for marketing, advertising or use-based data mining, including by third parties. Check SDK event payloads as well as your own code.
4. **Use App Tracking Transparency for any tracking.** If the app tracks users as Apple defines tracking, ask through the App Tracking Transparency APIs, and don't make features or rewards depend on the user allowing it.
5. **Get new consent before using data for a new purpose.** If you now want to use data for something the user didn't agree to, such as a new feature or model training, ask again unless the law explicitly permits the new use. Guideline 5.1.2(ii) requires it.
6. **Don't make features depend on push, location or tracking.** Users must be able to use the app's functionality without enabling system features such as push notifications, location services or tracking. Guideline 5.1.2(i) bars requiring them.

## Related

- Guideline 2.5.18 also bars ads that "engage in targeted or behavioral advertising based on sensitive user data such as health/medical data (e.g. from the HealthKit APIs)".
- For collection-side rules (privacy policy, consent, deletion), see [guideline 5.1.1](/compliance/app-store-guideline-5-1-1-data-collection-storage). For consent from a legal rather than App Store angle, see [user consent for health data](/compliance/health-data-user-consent). For all of Apple's rules in one place, see the [App Store health data rules overview](/compliance/app-store-health-data-rules).

## A note on limits

Apple doesn't define "use-based data mining" in the guidelines, and the guideline text doesn't address whether training a model counts. Where your design depends on those readings, ask App Review or a qualified professional. App Store rules are contractual, not law. This page is general guidance, not legal advice.


## Sources

- [developer.apple.com/app-store/review/guidelines/](https://developer.apple.com/app-store/review/guidelines/) — guideline 5.1.2(i)–(iii) and (vi), 2.5.18; last updated June 8, 2026 (checked 2026-10-03)
- [developer.apple.com/documentation/healthkit/protecting-user-privacy](https://developer.apple.com/documentation/healthkit/protecting-user-privacy) — third-party sharing condition and the ad-serving rule for HealthKit data (checked 2026-10-03)

## FAQ

### Does guideline 5.1.2(i) cover sending health data to an LLM API?

Yes. Guideline 5.1.2(i) says you must clearly disclose where personal data will be shared with third parties, including with third-party AI, and obtain explicit permission before doing so. For HealthKit data, Apple's HealthKit documentation adds that a third party must also provide a health or fitness service to the user, and Apple does not say how that applies to model providers.

[Permalink](https://aifitnessapi.com/compliance/app-store-guideline-5-1-2-data-use-sharing#faq-1)

### Is the App Tracking Transparency prompt enough to satisfy guideline 5.1.2?

Not on its own. The guideline lists App Tracking Transparency as the way to get permission to track users' activity, and separately requires permission before using or sharing personal data and explicit permission before sharing with third parties. Treat ATT as one requirement among several.

[Permalink](https://aifitnessapi.com/compliance/app-store-guideline-5-1-2-data-use-sharing#faq-2)

### Can I reuse workout data collected for one feature to train a model?

Guideline 5.1.2(ii) says data collected for one purpose may not be repurposed without further consent unless the law explicitly permits it. Apple does not define use-based data mining, and the text does not address model training. Ask for consent for the new use, and keep HealthKit data out of any use the guideline names.

[Permalink](https://aifitnessapi.com/compliance/app-store-guideline-5-1-2-data-use-sharing#faq-3)

### Can my app require push notifications or location to unlock features?

No. Guideline 5.1.2(i) says your app may not require users to enable system functionalities such as push notifications, location services or tracking in order to access functionality or content, use the app, or receive monetary or other compensation.

[Permalink](https://aifitnessapi.com/compliance/app-store-guideline-5-1-2-data-use-sharing#faq-4)