Every question the Compliance pages answer
The 10 compliance pages answer 49 named questions between them. Every one is listed below, and every link lands on the paragraph that answers it rather than the top of the page.
Does My Fitness App Need to Be HIPAA Compliant?
- Is a consumer fitness app automatically covered by HIPAA because it handles health data?No. HIPAA is tied to covered entities and business associates, not to the sensitivity of the data. Per HHS guidance, an app that collects…
- When would my fitness app actually fall under HIPAA?Typically when you build or offer the app on behalf of a covered entity, or in B2B2C deployments where a provider or health plan sponsors…
- If HIPAA doesn't apply, is my app unregulated?No. Non-HIPAA health apps still face the FTC Health Breach Notification Rule (updated in 2024 to cover health apps and connected devices),…
- Can I advertise my consumer app as HIPAA compliant?It is usually the wrong claim for a standalone consumer app and can mislead users, since HIPAA typically does not apply. There is also no…
GDPR for Fitness Apps: What Developers Need to Know
- Does GDPR apply to a US fitness app with EU users?Generally yes. GDPR's territorial scope (Article 3) reaches non-EU companies that offer goods or services to people in the EU or monitor…
- Is fitness or wearable data considered health data under GDPR?Usually. GDPR Article 9 treats 'data concerning health' as a protected special category, and EU regulators read that broadly. Fitness,…
- Is explicit consent always required for health data?Explicit consent is the usual route for a consumer fitness app, but it is not the only one. For special-category health data you generally…
- Is an iOS or Android health permission the same as GDPR consent?No. A HealthKit authorization sheet or a Health Connect permission grant is a device-level access control that decides whether your app can…
- How quickly must I report a data breach under GDPR?Under Article 33 you must notify the relevant supervisory authority without undue delay and, where feasible, within 72 hours of becoming…
Is Fitness Data PHI? PII, PHI, and Health Data Untangled
- Is heart-rate or step data PHI?It depends on the context. Held by a health care provider's app or a vendor working for one, it is PHI and HIPAA applies. The identical…
- What is the difference between PII and PHI?PII (personally identifiable information) is a broad umbrella for any data that identifies a person, used across US privacy law generally.…
- If my fitness data is not PHI, is it unregulated?No. Non-PHI fitness data is often heavily regulated by other frameworks: GDPR treats it as special-category health data for EU users, and…
- What counts as consumer health data under Washington MHMDA?Washington's My Health My Data Act defines consumer health data very broadly: personal information linked or reasonably linkable to a…
- How should a fitness app treat this data in practice?Treat wearable, workout, biometric, and inferred-health data as sensitive by default, whether or not it is technically PHI. Apply clear…
Does the FDA Regulate Fitness Apps?
- Does the FDA regulate fitness apps?Usually not. Low-risk apps intended for general wellness use — step counting, calorie and sleep tracking, general-fitness coaching,…
- What is the difference between general wellness and Software as a Medical Device (SaMD)?General wellness covers claims about maintaining or encouraging a general state of health or a healthy activity, with no reference to a…
- Does calling my app 'for wellness only' keep it out of FDA regulation?No. A 'wellness only' disclaimer does not cure a disease claim. The FDA infers intended use from what you actually claim and how you market…
- Does the FDA regulate how my fitness app stores or shares data?No. The FDA's concern is the safety and effectiveness of medical claims, not data privacy. Privacy and security obligations come from other…
- My app detects AFib or analyzes ECG data — is that a medical device?Likely yes. A claim to detect a specific condition such as atrial fibrillation is a disease-detection claim, which generally makes the…
Apple App Store Health Data Rules: What You Need to Ship a HealthKit App
- Do I need a privacy policy to use HealthKit?Yes. Under App Review Guideline 5.1.1(i) (verify the current subsection), every app must link a privacy policy in App Store Connect…
- Can I use HealthKit data for advertising or analytics?No. Data from HealthKit, the Clinical Health Records API, Motion & Fitness, and the MovementDisorder APIs may not be used for marketing,…
- Can I store health data in iCloud?Apple's guidelines say you must not store personal health information in iCloud (guideline 5.1.3(ii) as of mid-2026, verify the current…
- Does my app need in-app account deletion?If your app supports account creation, yes. Guideline 5.1.1(v) (verify) requires letting users delete their account and associated data…
- Do Apple's rules make my app HIPAA or GDPR compliant?No. Apple's guidelines are contractual App Store rules enforced through app review; passing review does not satisfy HIPAA, GDPR, or state…
What does Google Play's health data policy require?
- Is Health Connect data treated differently from other data?Yes. Data accessed through Health Connect permissions is treated as personal and sensitive user data plus additional Health Connect rules —…
- Does the Health Connect permission prompt count as user consent?No. The permission prompt is an OS-level access control that decides whether your app can read a data type. Google separately requires an…
- What is the Data safety form and how strict is it?The Data safety section is mandatory for every Play listing and must accurately state what data you collect, how you use it, and whether…
- What deletion options does Google Play require?Apps that offer account creation generally must provide in-app account deletion, an option to request deletion of data without deleting the…
- Is Health Connect replacing Google Fit?Health Connect is Google's on-device successor as the older Google Fit APIs wind down. New Fit sign-ups reportedly closed in May 2024, and…
How to Store Health Data Securely
- What encryption should I use for health data?The common baselines are TLS 1.2 or higher (TLS 1.3 recommended) for data in transit and AES-256 for data at rest, including databases,…
- Does encrypting health data make my app HIPAA or GDPR compliant?No. Encryption is one important control, not compliance in itself. Both GDPR Article 32 and the HIPAA Security Rule are outcome-based and…
- Should I store health data on the device or in the cloud?It's a trade-off. On-device storage (using iOS Keychain or Android Keystore) keeps data off your servers and shrinks the attack surface,…
- How should I manage encryption keys?Generate, store, rotate, and destroy keys using a dedicated key management service (KMS) or hardware security module (HSM), ideally with…
- Why does data minimization matter for security?Data you never collect can't be breached, and it stays out of regulatory scope entirely. Applying the 'collect less' principle shrinks both…
How to Get Valid User Consent for Health Data
- Is an iOS HealthKit or Android Health Connect permission the same as GDPR consent?No. An OS permission grant is a device-level access control that decides whether your app can read or write those data types. It is not…
- What makes consent valid under GDPR?It must be freely given, specific, informed, and unambiguous — a clear affirmative opt-in, with no pre-ticked boxes, silence, or default-on…
- Do I need separate consent to sell or share health data?Under Washington's My Health My Data Act, yes — consent to collect or share is separate from a distinct, signed authorization to sell…
- What consent records do I need to keep?GDPR requires you to be able to demonstrate consent, so keep versioned logs of who consented, when, what they were told (the exact wording…
- What about consent for children's health data?In the US, COPPA requires verifiable parental consent to collect data from children under 13, usually via an age gate or neutral…
What Does a Fitness App Privacy Policy Need to Include?
- Do Apple and Google require a privacy policy for a health app?Yes. Apple requires a linked privacy policy under its App Store Review Guidelines, and Google requires one for any app handling personal…
- Can I use a privacy policy template for my fitness app?You can use one as a starting structure, but not as finished text. A template that misdescribes what your app actually collects, shares, or…
- Does having a privacy policy mean I have valid consent?No. A privacy policy is a transparency document, not a consent mechanism. It does not by itself satisfy Google's in-app prominent…
- Do I need a DPO contact in my privacy policy?Only if you are required to appoint a Data Protection Officer. Under GDPR that is generally expected where your core activities involve…
- What retention period should my policy state?GDPR sets no fixed number. You define, document, and justify a retention period for each data category, or state the criteria you use to…
Health Data Retention and Deletion: A Developer's Guide
- How long can a fitness app keep users' health data?There is no universal number. GDPR's storage limitation principle (Article 5(1)(e)) says keep personal data no longer than necessary for…
- Can a user always force me to delete all their data?Not always. The right to erasure (Article 17) lets users require deletion in defined situations, such as the data no longer being needed or…
- Do I have to let users delete their account inside the app?For the app stores, yes. Apple requires apps that support account creation to offer account and associated-data deletion from within the…
- Does deleting a database record satisfy a deletion request?Usually not on its own. Deletion has to propagate to backups, replicas, caches, logs, analytics, and any third-party processors or…
- Is data minimization the same as retention?They are related but distinct. Data minimization (Article 5(1)(c)) is about collecting and keeping less in the first place; storage…
Back to the Compliance hub, or see every question this site answers.