App Store Guideline 5.1.3: Health and Health Research

The guideline text#

Quoted verbatim from Apple's App Review Guidelines, which the page states were last updated June 8, 2026. We checked the text on October 3, 2026. Apple revises the guidelines and sometimes renumbers sub-items, so compare this against the live page before you cite it in a reply to App Review.

5.1.3 Health and Health Research

Health, fitness, and medical data are especially sensitive and apps in this space have some additional rules to make sure customer privacy is protected:

(i) Apps may not use or disclose to third parties data gathered in the health, fitness, and medical research context—including from the Clinical Health Records API, HealthKit API, Motion and Fitness, MovementDisorder APIs, or health-related human subject research—for advertising, marketing, or other use-based data mining purposes other than improving health management, or for the purpose of health research, and then only with permission. Apps may, however, use a user’s health or fitness data to provide a benefit directly to that user (such as a reduced insurance premium), provided that the app is submitted by the entity providing the benefit, and the data is not shared with a third party. You must disclose the specific health data that you are collecting from the device.

(ii) Apps must not write false or inaccurate data into HealthKit or any other medical research or health management apps, and may not store personal health information in iCloud.

(iii) Apps conducting health-related human subject research must obtain consent from participants or, in the case of minors, their parent or guardian. Such consent must include the (a) nature, purpose, and duration of the research; (b) procedures, risks, and benefits to the participant; (c) information about confidentiality and handling of data (including any sharing with third parties); (d) a point of contact for participant questions; and (e) the withdrawal process.

(iv) Apps conducting health-related human subject research must secure approval from an independent ethics review board. Proof of such approval must be provided upon request.

What it means for a fitness or health app#

Guideline 5.1.3 sits inside section 5.1, Privacy, and adds rules on top of the general data rules in guideline 5.1.1 and guideline 5.1.2. Read item by item:

• 5.1.3(i) restricts what you do with the data. It covers data gathered in "the health, fitness, and medical research context" and names the Clinical Health Records API, the HealthKit API, Motion and Fitness, the MovementDisorder APIs and health-related human subject research. You may not use that data, or disclose it to third parties, for advertising, marketing or "other use-based data mining purposes". The exceptions are improving health management and health research, "and then only with permission".
• The benefit carve-out is narrow. You can use a user's health or fitness data to give that same user a benefit, and Apple's example is a reduced insurance premium. Two conditions apply: the app must be submitted by the entity providing the benefit, and the data must not be shared with a third party.
• 5.1.3(i) also requires disclosure. "You must disclose the specific health data that you are collecting from the device." In our reading, a generic line such as "we collect health data" falls short of "specific". Name the types.
• 5.1.3(ii) contains two separate rules. Don't write false or inaccurate data into HealthKit or into other health apps, and don't store personal health information in iCloud.
• 5.1.3(iii) and (iv) apply only to research. If your app runs health-related human subject research, you need informed consent with the five listed elements and approval from an independent ethics review board. A typical workout tracker doesn't run research and isn't affected.

What typically triggers it in a HealthKit app#

The patterns below come from the guideline text and from Apple's HealthKit documentation, not from a database of rejections. Apple doesn't publish one. In Apple's "Protecting user privacy" article, the rules for all HealthKit apps include:

• "Your app may not use information gained through the use of the HealthKit framework for advertising or similar services. Note that you may still serve advertising in an app that uses the HealthKit framework, but you can’t use data from the HealthKit store to serve ads."
• "You must not disclose any information gained through HealthKit to a third party without express permission from the user. Even with permission, you can only share information to a third party if they also provide a health or fitness service to the user."
• "You can’t sell information gained through HealthKit to advertising platforms, data brokers, or information resellers."
• "You must clearly disclose to the user how you and your app will use their HealthKit data."

In practice, these designs run into those rules:

• Health values in analytics or attribution events. A workout's heart rate or step total attached as an event property and sent to a marketing or ad SDK is a use the guideline names.
• A partner integration without a health or fitness purpose. Under Apple's HealthKit documentation, sending HealthKit data to a third party needs express permission, and the third party must provide a health or fitness service to the user.
• No specific disclosure. The privacy policy or the in-app explanation doesn't say which health data types you collect.
• Sync built on iCloud. Personal health information stored in any iCloud-backed storage your sync relies on is covered by 5.1.3(ii) as written.
• Writing samples you can't vouch for. Examples include demo or seed data left in a release build, or duplicates written on every launch. Our reading is that these fall under "false or inaccurate data".

Checklist before you resubmit#

1. Trace every path HealthKit data takes. List each place a HealthKit, Motion and Fitness or other health value goes after your app reads it: your backend, analytics, crash reporting, attribution and ad SDKs, and any partner API. Guideline 5.1.3(i) is about use and disclosure, so the audit has to cover destinations, not just the read call.
2. Cut health data out of advertising, marketing and data-mining tools. Remove health values from ad, attribution, marketing and data-mining pipelines, including event properties and user attributes that carry them. Apple's HealthKit documentation says you may still serve ads in a HealthKit app but cannot use data from the HealthKit store to serve them.
3. Check every third party that receives health data. For each recipient, confirm the user gave express permission and that the recipient provides a health or fitness service to the user, which is the condition Apple's HealthKit documentation sets. Remove any sale or transfer to advertising platforms, data brokers or information resellers.
4. Disclose the specific health data you collect. Name the health data types you collect from the device, in your privacy policy and in the app, and say how you use them. Guideline 5.1.3(i) requires disclosing the specific health data, and Apple's HealthKit documentation requires clearly disclosing how you use it.
5. Stop writing anything you cannot stand behind into HealthKit. Remove demo, test, placeholder and duplicate samples from production write paths, and check that units and timestamps are correct. Guideline 5.1.3(ii) bars writing false or inaccurate data into HealthKit.
6. Move personal health information out of iCloud. If your sync or backup stores personal health information in iCloud, redesign it before resubmitting. Guideline 5.1.3(ii) says apps may not store personal health information in iCloud.
7. If you run research, have the consent form and ethics approval ready. For health-related human subject research, make sure the in-app consent covers all five elements listed in 5.1.3(iii), with parent or guardian consent for minors, and keep the independent ethics review board approval on hand, because 5.1.3(iv) says Apple can ask for proof.

When you reply to App Review, a short list of what you changed is easier to check than a general statement that you comply.

Related guidelines#

• 5.1.2(vi) separately says data from HealthKit, the Clinical Health Records API and the MovementDisorder APIs "may not be used for marketing, advertising or use-based data mining, including by third parties". See guideline 5.1.2.
• 2.5.18 says ads "may not engage in targeted or behavioral advertising based on sensitive user data such as health/medical data (e.g. from the HealthKit APIs)".
• For an overview of all of Apple's health-data rules, see Apple App Store health data rules. For the permission flow itself, see the HealthKit integration guide.

A note on limits#

App Store guidelines are contractual rules enforced through App Review. They aren't law, and passing review doesn't make an app compliant with GDPR, HIPAA or state consumer-health laws. Apple doesn't define "use-based data mining" in the guideline, so where your design depends on how that phrase is read, ask App Review or a qualified professional. This page is general guidance, not legal advice.