Fitness & Health API Glossary

Every term you hit building a health or fitness product, in one or two honest sentences — each linked to the page that treats it properly. 33terms and counting; nothing here is a claim we don’t back on its own page.

Health data & metrics

HRV (heart rate variability): Beat-to-beat variation in heart rhythm, used as a recovery signal — but not one number: Apple stores SDNN while Health Connect stores RMSSD, and the two are not interconvertible.
SDNN: The HRV statistic Apple HealthKit stores — the standard deviation of intervals between normal heartbeats. Do not mix it with RMSSD in one column.
RMSSD: The HRV statistic Health Connect stores — the root mean square of successive interval differences. A different measure from SDNN, not a unit conversion away.
VO2 max: An estimate of aerobic capacity. On consumer devices it is modeled from heart rate and pace, not measured — treat it as a trend, not a lab value.
SpO2 (blood oxygen): Peripheral oxygen saturation from an optical sensor. A data type existing does not mean data will be there — it needs a device that measures it.
Sleep stages: Light, deep, REM and awake segments a device infers from movement and heart rate. Definitions and boundaries differ by vendor, so they do not compare one-to-one.
Active vs total calories: Active calories are the burn above rest; total adds basal metabolic rate. Providers disagree on which they report, which is a normalization trap.
Measured vs estimated: Some metrics are sensed (steps, heart rate); others are modeled (VO2 max, calories, some sleep). Storing the distinction keeps you from presenting a guess as a reading.

Platforms & providers

HealthKit: Apple's on-device health store. Not a cloud API — there is no server endpoint; your app reads it locally with permission and syncs itself.
Health Connect: Android's on-device health store — Google's counterpart to HealthKit. Also local-only, and it deduplicates only Activity and Sleep, via its aggregate API.
Health-data aggregator: A third party (Terra, Rook, and others) that normalizes many wearable and health sources behind one API — often the right buy instead of building integrations yourself.
Exercise database API: A catalogue of exercises with metadata and media. Watch the licensing — some open options are AGPL copyleft, which matters for closed-source apps.
Fitness API: Any API a developer uses to get fitness or health data or content — wearables, aggregators, exercise or nutrition catalogues, or AI motion tracking. Choose by job.

Integration & auth

OAuth (for health data): The delegated-access handshake that lets a user grant your app read access to their provider account without sharing a password. The token lifecycle is where it breaks in production.
Webhook: A provider-initiated callback telling you something changed. Most fitness webhooks are thin change-pointers, so the handler's job is usually to enqueue a fetch, not to trust the payload.
401 vs 403: A 401 means your token is bad, missing, expired or revoked; a 403 means the token is valid but lacks the scope. They point at different fixes.
Rate limit / 429: A provider capping your request volume. 429 is defined in RFC 6585, where the Retry-After header is optional — so design to back off even when it is absent.
Refresh token rotation: When a provider issues a new refresh token on every refresh. Lose the new one and the user is disconnected permanently — a case worth testing explicitly.

AI motion & camera

Pose estimation: Finding body keypoints in each camera frame. A normal RGB phone camera is enough for 2D and even monocular 3D — no depth sensor required.
2D vs 3D pose: 2D gives pixel coordinates; monocular 3D adds an estimated depth that is less reliable for occluded and out-of-plane joints. Say which you need.
Rep counting: Turning a keypoint stream into a count — a classification problem, tested with precision and recall against a labelled corpus, not a demo of ten push-ups.
Form feedback: Comparing joint angles and range of motion to a target. A coaching aid, not medical or physical-therapy advice — a distinction worth stating in the product.
On-device vs cloud inference: Running the model on the phone (low latency, private, no per-frame cost) versus in the cloud (heavier models, consistent, but latency and streaming-video privacy weight).

Architecture & data quality

Deduplication: Resolving the same activity written by several apps or devices. Neither platform does it for raw reads the way people assume — it is a resolution layer you design.
Day boundary problem: “Today's steps” is a civil-date question, not a UTC range. DST days aren't 24 hours, so a fixed window silently drops or double-counts an hour twice a year.
Late-arriving data: Health samples are not append-only — a watch syncs hours late, a user edits yesterday, a provider revises last night's sleep. Any total computed once and considered final will be wrong.
Idempotent ingestion: Making a duplicated event a no-op. In health data a doubly-processed event silently doubles a user's calories rather than throwing, so the dedupe key is load-bearing.
Backfill: Importing a user's history as a budgeted, resumable job — recent-first so the app is useful immediately, and chunked so a crash resumes rather than restarts.
Metric versioning: Recording which formula produced a derived value, so improving a calorie or readiness formula doesn't silently rewrite a user's history.

Compliance & AI

PHI (protected health information): The HIPAA category. Whether your fitness data is PHI depends on who you are and who you share it with — a consumer app is often outside HIPAA entirely, but not always.
General wellness policy: The FDA position that it does not intend to examine low-risk wellness products. There is no approval to claim — and diagnosis or treatment claims can push you out of it.
RAG / grounding: Constraining an LLM to a vetted catalogue instead of free-generating. For a few-thousand-row exercise table, plain retrieval usually beats vector search.
Guardrails (health advice): The deterministic gate in front of an LLM giving exercise or nutrition guidance. A model asked to police itself in the same call gets talked out of it.

Missing a term? Tell us what tripped you up and we’ll add it — the definition will link to a page that earns it. Last reviewed 2026-07-31.