Every question the Compliance pages answer
The 23 compliance pages answer 103 named questions between them. Every one is listed below, and every link lands on the paragraph that answers it rather than the top of the page.
Does My Fitness App Need to Be HIPAA Compliant?
- Is a consumer fitness app automatically covered by HIPAA because it handles health data?No. HIPAA is tied to covered entities and business associates, not to the sensitivity of the data. Per HHS guidance, an app that collects…
- When would my fitness app actually fall under HIPAA?Typically when you build or offer the app on behalf of a covered entity, or in B2B2C deployments where a provider or health plan sponsors…
- If HIPAA doesn't apply, is my app unregulated?No. Non-HIPAA health apps still face the FTC Health Breach Notification Rule (updated in 2024 to cover health apps and connected devices),…
- Can I advertise my consumer app as HIPAA compliant?It is usually the wrong claim for a standalone consumer app and can mislead users, since HIPAA typically does not apply. There is also no…
- Is an app built for a hospital or health insurer a HIPAA covered entity?Usually the hospital or insurer is the covered entity, not the app company. HIPAA's regulation defines covered entities as health plans,…
GDPR for Fitness Apps: What Developers Need to Know
- Does GDPR apply to a US fitness app with EU users?Generally yes. GDPR's territorial scope (Article 3) reaches non-EU companies that offer goods or services to people in the EU or monitor…
- Is fitness or wearable data considered health data under GDPR?Usually. GDPR Article 9 treats 'data concerning health' as a protected special category, and EU regulators read that broadly. Fitness,…
- Is explicit consent always required for health data?Explicit consent is the usual route for a consumer fitness app, but it is not the only one. For special-category health data you generally…
- Is an iOS or Android health permission the same as GDPR consent?No. A HealthKit authorization sheet or a Health Connect permission grant is a device-level access control that decides whether your app can…
- How quickly must I report a data breach under GDPR?Under Article 33 you must notify the relevant supervisory authority without undue delay and, where feasible, within 72 hours of becoming…
Is Fitness Data PHI? PII, PHI, and Health Data Untangled
- Is heart-rate or step data PHI?It depends on the context. Held by a health care provider's app or a vendor working for one, it is PHI and HIPAA applies. The identical…
- What is the difference between PII and PHI?PII (personally identifiable information) is a broad umbrella for any data that identifies a person, used across US privacy law generally.…
- If my fitness data is not PHI, is it unregulated?No. Non-PHI fitness data is often heavily regulated by other frameworks: GDPR treats it as special-category health data for EU users, and…
- What counts as consumer health data under Washington MHMDA?Washington's My Health My Data Act defines consumer health data very broadly: personal information linked or reasonably linkable to a…
- How should a fitness app treat this data in practice?Treat wearable, workout, biometric, and inferred-health data as sensitive by default, whether or not it is technically PHI. Apply clear…
Does the FDA Regulate Fitness Apps?
- Does the FDA regulate fitness apps?Usually not. Low-risk apps intended for general wellness use — step counting, calorie and sleep tracking, general-fitness coaching,…
- What is the difference between general wellness and Software as a Medical Device (SaMD)?General wellness covers claims about maintaining or encouraging a general state of health or a healthy activity, with no reference to a…
- Does calling my app 'for wellness only' keep it out of FDA regulation?No. A 'wellness only' disclaimer does not cure a disease claim. The FDA infers intended use from what you actually claim and how you market…
- Does the FDA regulate how my fitness app stores or shares data?No. The FDA's concern is the safety and effectiveness of medical claims, not data privacy. Privacy and security obligations come from other…
- My app detects AFib or analyzes ECG data — is that a medical device?Likely yes. A claim to detect a specific condition such as atrial fibrillation is a disease-detection claim, which generally makes the…
Apple App Store Health Data Rules: What You Need to Ship a HealthKit App
- Do I need a privacy policy to use HealthKit?Yes. Under App Review Guideline 5.1.1(i), every app must link a privacy policy in App Store Connect metadata and within the app. It must…
- Can I use HealthKit data for advertising or analytics?No. Data from HealthKit, the Clinical Health Records API, Motion and Fitness, and the MovementDisorder APIs may not be used for marketing,…
- Can I store health data in iCloud?No. Apple's guideline 5.1.3(ii) says apps may not store personal health information in iCloud (June 8, 2026 revision). This rule is easy to…
- Does my app need in-app account deletion?If your app supports account creation, yes. Guideline 5.1.1(v) requires offering account deletion within the app, and Apple's…
- Do Apple's rules make my app HIPAA or GDPR compliant?No. Apple's guidelines are contractual App Store rules enforced through app review; passing review does not satisfy HIPAA, GDPR, or state…
What does Google Play's health data policy require?
- Is Health Connect data treated differently from other data?Yes. Data accessed through Health Connect permissions is treated as personal and sensitive user data plus additional Health Connect rules —…
- Does the Health Connect permission prompt count as user consent?No. The permission prompt is an OS-level access control that decides whether your app can read a data type. Google separately requires an…
- What is the Data safety form and how strict is it?The Data safety section is mandatory for every Play listing and must accurately state what data you collect, how you use it, and whether…
- What deletion options does Google Play require?Apps that offer account creation generally must provide in-app account deletion, an option to request deletion of data without deleting the…
- Is Health Connect replacing Google Fit?Partly. Google's Fit migration guide, updated September 10, 2026, says the Google Fit API, including the REST API, "will only be supported…
How to Store Health Data Securely
- What encryption should I use for health data?The common baselines are TLS 1.2 or higher (TLS 1.3 recommended) for data in transit and AES-256 for data at rest, including databases,…
- Does encrypting health data make my app HIPAA or GDPR compliant?No. Encryption is one important control, not compliance in itself. Both GDPR Article 32 and the HIPAA Security Rule are outcome-based and…
- Should I store health data on the device or in the cloud?It's a trade-off. On-device storage (using iOS Keychain or Android Keystore) keeps data off your servers and shrinks the attack surface,…
- How should I manage encryption keys?Generate, store, rotate, and destroy keys using a dedicated key management service (KMS) or hardware security module (HSM), ideally with…
- Why does data minimization matter for security?Data you never collect can't be breached, and it stays out of regulatory scope entirely. Applying the 'collect less' principle shrinks both…
How to Get Valid User Consent for Health Data
- Is an iOS HealthKit or Android Health Connect permission the same as GDPR consent?No. An OS permission grant is a device-level access control that decides whether your app can read or write those data types. It is not…
- What makes consent valid under GDPR?It must be freely given, specific, informed, and unambiguous — a clear affirmative opt-in, with no pre-ticked boxes, silence, or default-on…
- Do I need separate consent to sell or share health data?Under Washington's My Health My Data Act, yes — consent to collect or share is separate from a distinct, signed authorization to sell…
- What consent records do I need to keep?GDPR requires you to be able to demonstrate consent, so keep versioned logs of who consented, when, what they were told (the exact wording…
- What about consent for children's health data?In the US, COPPA requires verifiable parental consent to collect data from children under 13, usually via an age gate or neutral…
What Does a Fitness App Privacy Policy Need to Include?
- Do Apple and Google require a privacy policy for a health app?Yes. Apple requires a linked privacy policy under its App Store Review Guidelines, and Google requires one for any app handling personal…
- Can I use a privacy policy template for my fitness app?You can use one as a starting structure, but not as finished text. A template that misdescribes what your app actually collects, shares, or…
- Does having a privacy policy mean I have valid consent?No. A privacy policy is a transparency document, not a consent mechanism. It does not by itself satisfy Google's in-app prominent…
- Do I need a DPO contact in my privacy policy?Only if you are required to appoint a Data Protection Officer. Under GDPR that is generally expected where your core activities involve…
- What retention period should my policy state?GDPR sets no fixed number. You define, document, and justify a retention period for each data category, or state the criteria you use to…
Health Data Retention and Deletion: A Developer's Guide
- How long can a fitness app keep users' health data?There is no universal number. GDPR's storage limitation principle (Article 5(1)(e)) says keep personal data no longer than necessary for…
- Can a user always force me to delete all their data?Not always. The right to erasure (Article 17) lets users require deletion in defined situations, such as the data no longer being needed or…
- Do I have to let users delete their account inside the app?For the app stores, yes. Apple requires apps that support account creation to offer account and associated-data deletion from within the…
- Does deleting a database record satisfy a deletion request?Usually not on its own. Deletion has to propagate to backups, replicas, caches, logs, analytics, and any third-party processors or…
- Is data minimization the same as retention?They are related but distinct. Data minimization (Article 5(1)(c)) is about collecting and keeping less in the first place; storage…
App Store Guideline 5.1.3: Health and Health Research
- Does guideline 5.1.3 stop me from showing ads in a HealthKit app?Not by itself. Apple's HealthKit documentation says you may still serve advertising in an app that uses HealthKit, but you cannot use data…
- What is the insurance-premium exception in guideline 5.1.3(i)?Guideline 5.1.3(i) lets an app use a user's health or fitness data to provide a benefit directly to that user, with a reduced insurance…
- Does guideline 5.1.3 apply if my app only reads step count from HealthKit?Yes. The guideline covers data gathered in the health, fitness and medical research context and names the HealthKit API, so step count read…
- Does a fitness app need ethics board approval under guideline 5.1.3?Only if it conducts health-related human subject research. Guidelines 5.1.3(iii) and (iv) require participant consent covering five listed…
App Store Guideline 5.1.1: Data Collection and Storage
- Does guideline 5.1.1(v) let me send users to a website to delete their account?Users must be able to start deletion inside the app. Apple's account-deletion guidance says that if people need to visit a website to…
- Can a fitness app require a login under guideline 5.1.1?Only if it has significant account-based features. Guideline 5.1.1(v) says that if your app does not include significant account-based…
- Can I lock premium features until the user grants HealthKit access?Guideline 5.1.1(ii) says paid functionality must not depend on or require a user to grant access to the data the app collects. A…
- Does guideline 5.1.1(ix) stop individual developers from publishing health apps?It says apps that provide services in highly regulated fields, with healthcare named among them, should be submitted by a legal entity that…
App Store Guideline 5.1.2: Data Use and Sharing
- Does guideline 5.1.2(i) cover sending health data to an LLM API?Yes. Guideline 5.1.2(i) says you must clearly disclose where personal data will be shared with third parties, including with third-party…
- Is the App Tracking Transparency prompt enough to satisfy guideline 5.1.2?Not on its own. The guideline lists App Tracking Transparency as the way to get permission to track users' activity, and separately…
- Can I reuse workout data collected for one feature to train a model?Guideline 5.1.2(ii) says data collected for one purpose may not be repurposed without further consent unless the law explicitly permits it.…
- Can my app require push notifications or location to unlock features?No. Guideline 5.1.2(i) says your app may not require users to enable system functionalities such as push notifications, location services…
App Store Guideline 1.4.1: Physical Harm and Medical Apps
- Can my app measure heart rate with the iPhone camera under guideline 1.4.1?Guideline 1.4.1 does not name heart rate. Its named examples of sensor-only claims that are not permitted are x-rays, blood pressure, body…
- Does a fitness app need a check-with-your-doctor reminder?Guideline 1.4.1 says apps should remind users to check with a doctor in addition to using the app and before making medical decisions. The…
- What should I submit if my health app has regulatory clearance?Guideline 1.4.1 says that if your medical app has received regulatory clearance, you should submit a link to that documentation with your…
- Do Apple's physical-harm rules cover fitness challenges?Guideline 1.4.5 says apps should not urge customers to take part in activities, including bets and challenges, or use their devices in a…
App Store Guideline 2.5.1: Software Requirements and HealthKit
- Do I have to mention Apple Health in my App Store description?Guideline 2.5.1 says apps should indicate their use of frameworks such as HealthKit in the app description, and Apple's HealthKit…
- Can I enable the HealthKit capability now for a feature I will ship later?Guideline 2.5.1 asks that frameworks be used for their intended purposes and that the integration be visible, so a HealthKit entitlement…
- Does enabling HealthKit limit which devices can install my app?It can. Apple documents that enabling the HealthKit capability on an iOS app adds HealthKit to the required device capabilities, which…
Publishing a Health Connect App on Google Play: What's Required
- Do I need to refile the Health apps declaration for every app update?No, not for a version change alone. Google's publishing guide says Health Connect data type access is allow-listed per package name…
- What happens if I publish a Health Connect app without declaring data types?Google's publishing guide says that if your app is published and released to the public but you did not request data type access, end users…
- Does the privacy policy in Health Connect have to match my Play listing?Yes. Google's publishing guide says the privacy policy on your Play store page must be the same one shown when users click the privacy…
- What do I select if my app has no health features?Google's publishing guide says that if your app does not access any health or fitness information, you select the checkbox labelled My app…
App Store Guideline 3.1.3(d): Person-to-Person Fitness Training
- Can a personal training app take payments outside Apple's in-app purchase?For live one-to-one sessions, guideline 3.1.3(d) says yes. It covers real-time person-to-person services between two individuals, names…
- Do live group workout classes qualify for the 3.1.3(d) exception?No. The last sentence of guideline 3.1.3(d) says one-to-few and one-to-many real-time services must use in-app purchase. A live session…
- Does guideline 3.1.3(d) cover recorded workouts or training plans?No. 3.1.3(d) is limited to real-time services. Guideline 3.1.1 says that unlocking features or functionality in the app, including…
- What about in-person training sessions booked through the app?Guideline 3.1.3(e) says that if your app lets people buy physical goods or services that will be consumed outside of the app, you must use…
App Store Guideline 2.5.4: Background Modes for Workout Apps
- Does guideline 2.5.4 allow the workout processing background mode?Guideline 2.5.4 doesn't name it: its list of intended purposes is VoIP, audio playback, location, task completion and local notifications,…
- Can an Apple Watch workout app play coaching audio in the background?Apple's HealthKit documentation says workout apps can use AVFoundation to play short audio clips in the background, such as coaching or…
- When does a running or cycling app need background location?When it needs location updates in real time while in the background. Apple's Core Location documentation names tracking the precise path…
App Store Guideline 2.5.11: SiriKit and Shortcuts in Fitness Apps
- Can a nutrition app offer a Siri intent to start a workout?Guideline 2.5.11(i) uses almost exactly this case as its example: a meal planning app should not incorporate an intent to start a workout,…
- Can I show a promotion before a Siri-started workout begins?Guideline 2.5.11(iii) says to resolve the Siri request or shortcut in the most direct way possible and not to insert ads or other marketing…
- When may a workout intent ask the user a follow-up question?Only when the answer is needed to complete the task. Guideline 2.5.11(iii) gives asking the user to specify a particular type of workout as…
- Which Apple APIs receive a request to start a workout?Apple documents SiriKit's INStartWorkoutIntent, which SiriKit creates when the user asks to start a workout using your app, and the App…
Apple Health Icon, Badge and Naming Rules for HealthKit Apps
- Can I use the Apple Health icon as a Connect button?No. Apple's Human Interface Guidelines say not to use the Apple Health icon as a button and to use it only to indicate compatibility with…
- Should my app's interface say HealthKit or Apple Health?Apple Health. The HIG's editorial guidelines say not to use the term HealthKit, which Apple describes as a developer-facing term naming the…
- Can I post the Works with Apple Health badge on social media?Not according to Apple's Works with Apple Health page, which says not to use the badge or Apple product images in social media promotions…
- Is the Apple Health icon the same thing as the Works with Apple Health badge?No. The icon goes in your app's interface and its rules are in the HIG, including clear space of 1/10 of its height. The badge is for…
The FTC Health Breach Notification Rule for Health and Fitness Apps
- Does the FTC Health Breach Notification Rule cover a fitness app if most users never connect a wearable?The FTC's guidance says it likely does. Asked about a fitness app where users enter their height, weight and age and only some sync a…
- Is sending health data to an advertising SDK a breach under the FTC rule?It can be. The rule says a breach of security includes an unauthorized acquisition that results from an unauthorized disclosure, and the…
- How many days does a health app have to notify users after a breach under the FTC rule?No more than 60 calendar days after the breach is discovered, and without unreasonable delay before that. The FTC's guidance says a company…
- Does the FTC breach rule apply to a HIPAA business associate?Not to the extent the company acts as a business associate. The rule excludes HIPAA-covered entities and entities acting as business…
- What did the FTC rescind about health app breaches in September 2026?On September 9, 2026, the FTC rescinded its 2021 Policy Statement on Breaches by Health Apps and Other Connected Devices. The FTC said the…
Washington's My Health My Data Act for Fitness and Health Apps
- Does Washington's My Health My Data Act apply to an app company based outside Washington?It can. A regulated entity is any legal entity that conducts business in Washington or produces or provides products or services targeted…
- Is heart-rate data from a fitness app consumer health data in Washington?In our reading, usually, when it is linked or reasonably linkable to a user. The statute's list of what counts as physical health status…
- How long does a company have to act on a My Health My Data Act deletion request?45 days from receiving the request, extendable once by another 45 days if the company tells the consumer why within the first 45. Deletion…
- Can an app sell consumer health data under Washington law?Only with a valid authorization the consumer signs, separate from any consent to collect or share. It must name the data, the seller, the…
- Who can sue under Washington's My Health My Data Act?Washington's Attorney General says any violation is a per se violation of the state Consumer Protection Act, enforced by the Attorney…
Remote Patient Monitoring Devices: What Medicare Requires of the Data
- Can a consumer fitness tracker be used for Medicare remote patient monitoring?CMS's eligibility conditions call for an internet-connected device that meets the FDA's definition of a medical device and digitally…
- How many days of readings does Medicare require for remote patient monitoring?CMS's page, last modified May 13, 2026, lists a device that collects and transmits health data at least 2 days every 30 days among the…
- Does Medicare pay differently for different remote monitoring devices?No, according to CMS. It pays for each of the three components, education and setup, device supply, and treatment and management,…
- Is a company that runs remote patient monitoring for a clinic a HIPAA business associate?Likely, according to the FTC's Mobile Health Apps Interactive Tool, which says a developer operating an app on behalf of a HIPAA covered…
- Do these device rules apply to remote therapeutic monitoring?We could not verify that. CMS's telehealth section has a remote patient monitoring page but, as of October 17, 2026, no remote therapeutic…
Back to the Compliance hub, or see every question this site answers.