How to Get Valid User Consent for Health Data

Getting valid consent for health data is not the same as showing a permission prompt. If your fitness or wellness app relies on consent under GDPR, that consent has to clear a specific bar: it must be freely given, specific, informed, and unambiguous — a real opt-in, never a pre-ticked box or a buried line in your terms. Because fitness and wearable metrics are generally treated as special-category health data, you usually need explicit consent, which is a higher bar still. The single most important thing to understand: an iOS or Android health permission is a device access control, not a legal basis. This is general engineering guidance, not legal advice — confirm what your app actually needs with a qualified professional.

What makes consent "valid" under GDPR

Consent is only one of several lawful bases, but when you rely on it, it has to meet every one of these conditions at once. If any is missing, the consent is not valid.

Because health data is special-category data under GDPR Article 9, the usual route is explicit consent — an express opt-in statement, not something implied. And explicit consent typically has to sit on top of a separate general lawful basis. For how the two layers stack, see our GDPR for fitness apps page. Consent is not the only lawful basis, and it is not always the right one, so do not assume consent is always required or always the answer.

An OS permission grant is not legal consent

This is the distinction that trips up the most builders. When a user taps "Allow" on an iOS HealthKit authorization sheet or grants an Android Health Connect permission, that is a device-level access control. It decides whether your app is technically able to read or write those data types on that device. It is not automatically a GDPR lawful basis for what you subsequently do with the data.

In practice you often still need a separate, GDPR-valid consent (or another lawful basis) for your actual processing — storing it on your servers, running analytics on it, sharing it, and so on. Treating the OS grant as end-to-end legal cover is a mistake: a permission and a consent are different instruments doing different jobs. App-store rules reinforce this from their own side — both Apple and Google require in-app consent and disclosure independent of the OS prompt. See Apple's health-data rules and Google Play's health-data policy.

OAuth scopes: consent to access, not to everything

When a user authorizes your app through OAuth — for example, connecting a wearable or health platform — the scopes they grant define exactly what data access they consented to. This is a technical, auditable consent to access the data. It is a clean record of what the user allowed you to reach.

What it is not, on its own, is consent for downstream purposes like marketing or selling the data. Access authorization and purpose consent are separate. For how OAuth works in this context, see what is OAuth for health data.

Consent to sell or share is a separate thing (US state law)

Under Washington's My Health My Data Act (MHMDA), consent and authorization-to-sell are treated as different instruments:

• Consent to collect or share consumer health data (opt-in).
• A distinct, valid authorization to SELL that data — a separate, standalone, signed document with statutorily prescribed contents.

Under Washington's MHMDA, that sale authorization must be its own signed document, and both the seller and the purchaser have to retain it for six years. MHMDA has been in force since March 31, 2024 (small businesses June 30, 2024) and carries a notable private right of action, which makes it a real litigation risk. MHMDA is Washington-specific but reaches conduct affecting Washington residents wherever your company sits, and other states (Nevada, Connecticut expansions, and more) have similar-but-different rules. Verify the current state-law landscape for your users.

Keep records that prove consent

GDPR requires you to be able to demonstrate that a user consented. That means keeping versioned consent logs that capture:

• who consented,
• when they did,
• what they were told — the exact wording and version they saw, and
• how they can withdraw.

If you cannot show these, you effectively cannot show valid consent. Treat consent records as a first-class part of your data model, not an afterthought.

Children's data and age gates (briefly)

If children may use your app, extra rules apply. In the US, COPPA requires verifiable parental consent to collect data from children under 13; the usual mechanism is an age gate or neutral age-screen. Apple and Google add their own limits for kids (for example, restrictions on behavioral advertising). Under GDPR, the digital-consent age is 16, which member states may lower to as low as 13 — below that threshold, parental or guardian consent is required. Age thresholds vary by jurisdiction, so verify the current numbers for the markets you serve.

What this means for a fitness app

• Design consent as a real, granular opt-in for health data — separate per purpose, never pre-ticked, never bundled into your terms.
• Make withdrawal as easy as consent — ideally one step — and remember that prior lawful processing stays lawful.
• Do not treat the HealthKit or Health Connect prompt as your legal basis. Layer a proper consent (or other basis) on top for what you do with the data.
• Separate "share" from "sell." If you might sell consumer health data, treat the authorization to sell as its own signed, retained instrument.
• Log everything — who, when, what wording, and how to withdraw — in versioned records you can produce on demand.
• Gate for age if children may use the app, and check the threshold per jurisdiction.

A note on limits

Consent is one lawful basis among several, and for health data you generally need Article 9 explicit consent (or another Article 9 condition) on top of a general basis — do not read this page as saying consent is the only route. State laws differ, age thresholds move, and platform rules change. Use this as a starting map, not a compliance sign-off, and get advice from a qualified professional for your specific case.