Apple App Store Health Data Rules: What You Need to Ship a HealthKit App

Does this apply to you?#

If your iOS app touches health or fitness data, yes. The rules bite hardest on apps that use these Apple frameworks:

• HealthKit (steps, heart rate, workouts, sleep, and everything else in the Health app)
• Clinical Health Records API
• Motion & Fitness and the MovementDisorder APIs

Data from these sources gets the strictest treatment. But even a fitness app that never touches HealthKit — say, one that only stores workouts you type in — still needs a privacy policy and still faces the general privacy rules in Section 5.1 of the guidelines. There is essentially no version of "health app" that escapes these requirements.

One more scoping point: guideline 5.1.1(ix) lists healthcare among the "highly regulated fields" whose apps "should be submitted by a legal entity that provides the services, and not by an individual developer."

What Apple's rules actually require#

The subsection numbers below match the App Review Guidelines as last updated June 8, 2026, checked on October 2, 2026. Apple revises the guidelines, so confirm the live subsection before you cite a number; the rules matter more than the numbering.

The narrow "direct benefit" carve-out#

There is one limited exception to the no-sharing rule: an app may share health data for a direct user benefit — the classic example is a reduced insurance premium — but only if the app is submitted by the benefit provider itself AND the data is not shared with any other third party. Do not read this as a general "you can share health data if the user gets something." It is deliberately narrow and conditional.

If you run research#

Human-subject research raises the bar. Under guidelines 5.1.3(iii) and (iv), you need:

• Informed consent covering the nature, purpose, and duration of the study; procedures, risks, and benefits; confidentiality and any third-party sharing; a contact; and how to withdraw. Minors need parent or guardian consent.
• Approval from an independent ethics review board, which Apple can ask you to prove on request.

App Privacy labels and privacy manifests#

Two more Apple requirements live outside the review guidelines proper:

• App Privacy "nutrition labels." Apple requires you to describe your app's privacy practices in App Store Connect to submit new apps and updates — including the practices of third-party partners whose code you integrate — and to identify all the data you or those partners collect, unless it meets Apple's criteria for optional disclosure. Health and Fitness are their own data types, and Apple's definitions name HealthKit, Clinical Health Records, Movement Disorder and Motion and Fitness data. You are responsible for keeping the answers accurate and up to date.
• Privacy manifests and required-reason APIs. Apple's documentation says that starting May 1, 2024, App Store Connect stopped accepting apps that use a "required reason" API without describing why in their privacy manifest (PrivacyInfo.xcprivacy). Separately, when a new app — or an update that adds it — includes one of the commonly used SDKs on Apple's list, that SDK must carry its own privacy manifest, plus a signature when it is a binary dependency. Confirm the current list before you submit.

What this means for a fitness app#

• Ship a privacy policy first. Guideline 5.1.1(i) makes it mandatory for every app, HealthKit or not, and it is cheap to get right. Cover collection, use, sharing, retention, and deletion. See the health app privacy policy guide for what to include.
• Wall off health data from your ad stack. Don't pipe HealthKit data into advertising, marketing or data-mining tools — that is a hard prohibition, not a preference — and we would treat values derived from it the same way.
• Build in-app account deletion before launch. Retrofitting it later is painful. Apple's guidance says deletion should reach the associated personal data too, not just the login row.
• Don't lean on iCloud for health data. Keep personal health information out of iCloud storage; verify the current guideline wording as you architect sync.
• Remember Apple's rules are not the whole picture. An App Store approval does not make you GDPR- or state-law-compliant. A HealthKit permission prompt is an OS access control, not a legal consent. See health data user consent for the distinction.

For the implementation details of requesting HealthKit permissions and handling the authorization sheet, see the HealthKit integration guide. Building for Android too? The equivalent rules live on the Google Play health data policy page — they overlap heavily but differ in the specifics.

Guideline-by-guideline pages#

If App Review cited a specific guideline, these pages quote it in full with a checklist:

• App Store guideline 5.1.1: Data Collection and Storage
• App Store guideline 5.1.2: Data Use and Sharing
• App Store guideline 5.1.3: Health and Health Research
• App Store guideline 1.4.1: Physical Harm and medical apps
• App Store guideline 2.5.1: Software Requirements and HealthKit
• Shipping on Android too: Health Connect publishing requirements on Google Play

A note on limits#

Apple's guidelines are contractual App Store rules, enforced through app review — they are not a substitute for HIPAA, GDPR, or state consumer-health laws, and passing review does not mean you've met those legal obligations. Apple also revises the guidelines — this page matches the June 8, 2026 revision — so the exact subsection numbers may shift; always read the live guideline text at the time you submit. For anything with legal consequences, confirm your obligations with a qualified professional.