--- title: "App Store and Google Play submission checklist for health apps" canonical: "https://aifitnessapi.com/tools/store-submission-checklist" markdown: "https://aifitnessapi.com/tools/store-submission-checklist.md" type: "tool" last_reviewed: "2026-11-05" description: "Every App Store and Google Play rule a health or fitness app is reviewed against, quoted from Apple's guidelines and Google's policies, as a checklist." publisher: "AIFitnessAPI — funded by KinesteX; first-party pages disclose it" cite_as: "\"App Store and Google Play submission checklist for health apps\", AIFitnessAPI, https://aifitnessapi.com/tools/store-submission-checklist" --- # App Store and Google Play submission checklist for health apps > This checklist holds the App Store and Google Play rules a health or fitness app is reviewed against, each in the store's own words: 20 items from Apple's App Review Guidelines (1.4.1, 2.5.1, 2.5.18, 3.1.3(d), 5.1.1, 5.1.2 and 5.1.3) and 27 from Google Play's Health apps, User Data and Health Connect policies and Google's Health Connect publishing guide. Pick your stores and what the app does, and the list narrows to the items that apply; your ticks are saved in this browser. Read on November 5, 2026. It is not legal advice and not a guarantee of approval. - Canonical: https://aifitnessapi.com/tools/store-submission-checklist - Last reviewed: 2026-11-05 - Publisher: AIFitnessAPI (https://aifitnessapi.com) - Cite as: "App Store and Google Play submission checklist for health apps", AIFitnessAPI, https://aifitnessapi.com/tools/store-submission-checklist --- *[Interactive: the store and feature filters, progress saved in your browser, in the browser at https://aifitnessapi.com/tools/store-submission-checklist; not reproduced in this mirror.]* ### Apple App Store - **Link the privacy policy in App Store Connect and inside the app** (5.1.1(i)) > All apps must include a link to their privacy policy in the App Store Connect metadata field and within the app in an easily accessible manner. [Apple, App Review Guidelines](https://developer.apple.com/app-store/review/guidelines/) - **Say in the policy how long you keep data and how users revoke consent or delete it** (5.1.1(i)) > Explain its data retention/deletion policies and describe how a user can revoke consent and/or request deletion of the user’s data. [Apple, App Review Guidelines](https://developer.apple.com/app-store/review/guidelines/) - **Get consent before collecting user or usage data** (5.1.1(ii)) > Apps that collect user or usage data must secure user consent for the collection, even if such data is considered to be anonymous at the time of or immediately following collection. [Apple, App Review Guidelines](https://developer.apple.com/app-store/review/guidelines/) - **Write purpose strings that describe the whole use of the data** (5.1.1(ii)) > Ensure your purpose strings clearly and completely describe your use of the data. [Apple, App Review Guidelines](https://developer.apple.com/app-store/review/guidelines/) - **Request only the data types the core features use** (5.1.1(iii)) > Apps should only request access to data relevant to the core functionality of the app and should only collect and use data that is required to accomplish the relevant task. [Apple, App Review Guidelines](https://developer.apple.com/app-store/review/guidelines/) - **Offer account deletion inside the app** (5.1.1(v)) > If your app supports account creation, you must also offer account deletion within the app [Apple, App Review Guidelines](https://developer.apple.com/app-store/review/guidelines/) - **Submit as the legal entity that provides a regulated healthcare service** (5.1.1(ix)) > Apps that provide services in highly regulated fields (such as banking and financial services, healthcare, gambling, legal cannabis use, air travel and crypto exchanges) or that require sensitive user information should be submitted by a legal entity that provides the services, and not by an individual developer. [Apple, App Review Guidelines](https://developer.apple.com/app-store/review/guidelines/) - **Disclose and get explicit permission before sharing personal data with a third-party AI** (5.1.2(i)) > You must clearly disclose where personal data will be shared with third parties, including with third-party AI, and obtain explicit permission before doing so. [Apple, App Review Guidelines](https://developer.apple.com/app-store/review/guidelines/) - **Keep HealthKit and camera-derived data out of marketing, advertising and data mining** (5.1.2(vi)) > Data gathered from the HomeKit API, HealthKit, Clinical Health Records API, MovementDisorder APIs, ClassKit or from depth and/or facial mapping tools (such as ARKit, Camera APIs, or Photo APIs) may not be used for marketing, advertising or use-based data mining, including by third parties. [Apple, App Review Guidelines](https://developer.apple.com/app-store/review/guidelines/) - **Use health and fitness data only to improve health management or for permitted research** (5.1.3(i)) > Apps may not use or disclose to third parties data gathered in the health, fitness, and medical research context—including from the Clinical Health Records API, HealthKit API, Motion and Fitness, MovementDisorder APIs, or health-related human subject research—for advertising, marketing, or other use-based data mining purposes other than improving health management, or for the purpose of health research, and then only with permission. [Apple, App Review Guidelines](https://developer.apple.com/app-store/review/guidelines/) - **Disclose the specific health data you collect from the device** (5.1.3(i)) > You must disclose the specific health data that you are collecting from the device. [Apple, App Review Guidelines](https://developer.apple.com/app-store/review/guidelines/) - **Never write false data to HealthKit, and keep personal health information out of iCloud** (5.1.3(ii)) > Apps must not write false or inaccurate data into HealthKit or any other medical research or health management apps, and may not store personal health information in iCloud. [Apple, App Review Guidelines](https://developer.apple.com/app-store/review/guidelines/) - **Get research consent that covers the five points Apple lists** (5.1.3(iii)) > Apps conducting health-related human subject research must obtain consent from participants or, in the case of minors, their parent or guardian. [Apple, App Review Guidelines](https://developer.apple.com/app-store/review/guidelines/) - **Have ethics review board approval ready to show** (5.1.3(iv)) > Apps conducting health-related human subject research must secure approval from an independent ethics review board. Proof of such approval must be provided upon request. [Apple, App Review Guidelines](https://developer.apple.com/app-store/review/guidelines/) - **Use HealthKit for health and fitness, integrated with the Health app, and say so in the description** (2.5.1) > Apps should use APIs and frameworks for their intended purposes and indicate that integration in their app description. For example, the HomeKit framework should provide home automation services; and HealthKit should be used for health and fitness purposes and integrate with the Health app. [Apple, App Review Guidelines](https://developer.apple.com/app-store/review/guidelines/) - **Back every health-measurement accuracy claim with data and methodology** (1.4.1) > Apps must clearly disclose data and methodology to support accuracy claims relating to health measurements, and if the level of accuracy or methodology cannot be validated, we will reject your app. [Apple, App Review Guidelines](https://developer.apple.com/app-store/review/guidelines/) - **Remind users to check with a doctor before medical decisions** (1.4.1) > Apps should remind users to check with a doctor in addition to using the app and before making medical decisions. [Apple, App Review Guidelines](https://developer.apple.com/app-store/review/guidelines/) - **Attach your regulatory clearance documentation, if you have one** (1.4.1) > If your medical app has received regulatory clearance, please submit a link to that documentation with your app. [Apple, App Review Guidelines](https://developer.apple.com/app-store/review/guidelines/) - **No targeted or behavioral ads based on health data** (2.5.18) > may not engage in targeted or behavioral advertising based on sensitive user data such as health/medical data (such as from the HealthKit APIs) [Apple, App Review Guidelines](https://developer.apple.com/app-store/review/guidelines/) - **One-to-one live training may skip in-app purchase; group live sessions may not** (3.1.3(d)) > One-to-few and one-to-many real-time services must use in-app purchase. [Apple, App Review Guidelines](https://developer.apple.com/app-store/review/guidelines/) ### Google Play - **Complete the Health apps declaration in Play Console** (Health apps: Console Declaration) > All developers must complete the Health apps declaration form on the App content page [Google Play, Health Content and Services](https://support.google.com/googleplay/android-developer/answer/16679511?hl=en) - **Treat the app as a health app even if health is not its main purpose** (Health apps: Privacy Policy and Prominent Disclosure) > If your app is not primarily a health app, but has health-related features and accesses health data, it is still in scope of the Health App policy. [Google Play, Health Content and Services](https://support.google.com/googleplay/android-developer/answer/16679511?hl=en) - **Put the privacy policy link in Play Console and inside the app** (Health apps: Privacy Policy and Prominent Disclosure) > Your app must post a privacy policy link in the designated field within Play Console, and a privacy policy link or text within the app itself. [Google Play, Health Content and Services](https://support.google.com/googleplay/android-developer/answer/16679511?hl=en) - **Host the policy at a public, non-geofenced URL, not a PDF** (Health apps: Privacy Policy and Prominent Disclosure) > Please make sure your privacy policy is available on an active, publicly accessible and non-geofenced URL (no PDFs) and is non-editable [Google Play, Health Content and Services](https://support.google.com/googleplay/android-developer/answer/16679511?hl=en) - **Remove every permission the core function does not need** (Health apps: Privacy Policy and Prominent Disclosure) > Permissions that are not required for a health app to perform its core functionality should not be requested and unused permissions must be removed. [Google Play, Health Content and Services](https://support.google.com/googleplay/android-developer/answer/16679511?hl=en) - **Show a prominent disclosure and get affirmative consent for in-scope permissions (activity recognition, body sensors, Bluetooth, camera, location and others)** (What permissions are in scope of the health apps policy?) > If your app requires any of these permissions, it must prominently disclose how user data will be used, describe the type of data being accessed, and have the user provide affirmative consent for such use. [Google Play, Health app categories and additional information](https://support.google.com/googleplay/android-developer/answer/13996367?hl=en) - **If a medical function needs external hardware, say so in the description** (Health apps: Health and Medical Functionalities) > Apps that connect to external hardware or devices (e.g., blood glucose monitors) to perform their medical function, must clearly disclose these external hardware requirements in the app description. [Google Play, Health Content and Services](https://support.google.com/googleplay/android-developer/answer/16679511?hl=en) - **List device compatibility for health functions that use the camera or other sensors** (Health apps: Health and Medical Functionalities) > Apps that use device sensors (e.g., camera) for health functions must clearly state device compatibility information in the app description. [Google Play, Health Content and Services](https://support.google.com/googleplay/android-developer/answer/16679511?hl=en) - **Declare a regulated medical device, and have proof of clearance ready** (Health apps: Health and Medical Functionalities) > Apps that are regulated as a medical device must provide proof of approval, clearance or certification by the relevant authority upon request. [Google Play, Health Content and Services](https://support.google.com/googleplay/android-developer/answer/16679511?hl=en) - **Otherwise, carry the not-a-medical-device disclaimer in the description** (Health apps: Health and Medical Functionalities) > Other health and medical apps must include a clear disclaimer in their app description indicating that the app is “not a medical device and does not diagnose, treat, cure, or prevent any medical condition.” [Google Play, Health Content and Services](https://support.google.com/googleplay/android-developer/answer/16679511?hl=en) - **Remind users to consult a healthcare professional** (Health apps: Health and Medical Functionalities) > Apps must also remind users to consult a healthcare professional for medical advice, diagnosis, or treatment. [Google Play, Health Content and Services](https://support.google.com/googleplay/android-developer/answer/16679511?hl=en) - **Get informed consent and IRB or ethics approval for health research** (Health apps: Additional requirements) > Health Research apps should also secure approval from an Institutional Review Board (IRB) and/or equivalent independent ethics committee unless otherwise exempt. [Google Play, Health Content and Services](https://support.google.com/googleplay/android-developer/answer/16679511?hl=en) - **Do not bill regulated clinical services through Play billing** (Payments - Clinical Services) > Transactions involving regulated clinical services should not use Google Play’s billing system. [Google Play, Health Content and Services](https://support.google.com/googleplay/android-developer/answer/16679511?hl=en) - **Never sell personal and sensitive user data** (User Data) > Not sell personal and sensitive user data. [Google Play, User Data](https://support.google.com/googleplay/android-developer/answer/10144311?hl=en) - **Offer a way to delete the account and its data** (User Data) > Additionally, you must offer users a way to delete their accounts and associated data. [Google Play, User Data](https://support.google.com/googleplay/android-developer/answer/10144311?hl=en) - **Complete the required Play Console steps: policies, Data safety, Health apps declaration** (Health Connect: publish guide) > To get your health app published on Google Play, you must complete a few required steps in the Play Console. [Android Developers, Publish your health app on Google Play](https://developer.android.com/health-and-fitness/health-connect/publish?hl=en) - **Fill in the Data safety section** (Health Connect: publish guide) > As part of your app publishing process, you must provide information for Google Play's Data safety section [Android Developers, Publish your health app on Google Play](https://developer.android.com/health-and-fitness/health-connect/publish?hl=en) - **Declare the Health Connect data types again whenever the set changes** (Health Connect: publish guide) > This process must be completed for all publishing requests, both for a new app that has not been published yet, or when updating an existing, already published app that now uses a different set of data types. [Android Developers, Publish your health app on Google Play](https://developer.android.com/health-and-fitness/health-connect/publish?hl=en) - **Use the same privacy policy on the Play listing and in Health Connect** (Health Connect: publish guide) > This must be the same privacy policy that is displayed to users when they click the privacy policy link in Health Connect [Android Developers, Publish your health app on Google Play](https://developer.android.com/health-and-fitness/health-connect/publish?hl=en) - **Fit one of Health Connect's approved use cases** (Health Connect: Appropriate Access) > Approved use cases include: fitness and wellness, rewards, fitness coaching, corporate wellness, medical care, health research, and games. [Google Play, Permissions and APIs that Access Sensitive Information (Health Connect by Android Permissions)](https://support.google.com/googleplay/android-developer/answer/16324062?hl=en) - **Request only the Health Connect permissions your features need** (Health Connect: Minimum Scope) > You must only request access to the permissions that are necessary to implementing your product's features or services. [Google Play, Permissions and APIs that Access Sensitive Information (Health Connect by Android Permissions)](https://support.google.com/googleplay/android-developer/answer/16324062?hl=en) - **Never use Health Connect data to serve ads** (Health Connect: Limited Use) > Transferring, selling, or using user data for serving ads, including personalized or interest-based advertising. [Google Play, Permissions and APIs that Access Sensitive Information (Health Connect by Android Permissions)](https://support.google.com/googleplay/android-developer/answer/16324062?hl=en) - **Never transfer or sell Health Connect data to ad platforms or data brokers** (Health Connect: Limited Use) > Transferring or selling user data to third parties like advertising platforms, data brokers, or any information resellers. [Google Play, Permissions and APIs that Access Sensitive Information (Health Connect by Android Permissions)](https://support.google.com/googleplay/android-developer/answer/16324062?hl=en) - **No headless apps: the app needs a visible icon** (Health Connect: Appropriate Access) > Do not access data obtained through Health Connect using headless apps. [Google Play, Permissions and APIs that Access Sensitive Information (Health Connect by Android Permissions)](https://support.google.com/googleplay/android-developer/answer/16324062?hl=en) - **Do not connect Health Connect to features that solely target children** (Health Connect: Appropriate Access) > Do not use Health Connect to connect to applications, services, or features that solely target children. [Google Play, Permissions and APIs that Access Sensitive Information (Health Connect by Android Permissions)](https://support.google.com/googleplay/android-developer/answer/16324062?hl=en) - **Publish help explaining how users manage and delete their data** (Health Connect: Transparent and Accurate Notice) > User help documentation explaining how users can manage and delete their data from the app, and what happens to the data when an account is deactivated and/or deleted. [Google Play, Permissions and APIs that Access Sensitive Information (Health Connect by Android Permissions)](https://support.google.com/googleplay/android-developer/answer/16324062?hl=en) - **Say how you secure data, including HTTPS in transit** (Health Connect: Transparent and Accurate Notice) > Information regarding handling all personal and sensitive user data securely, including transmitting it using modern cryptography (for example, over HTTPS). [Google Play, Permissions and APIs that Access Sensitive Information (Health Connect by Android Permissions)](https://support.google.com/googleplay/android-developer/answer/16324062?hl=en) ## How the list is built Each item is one sentence a store publishes, quoted as it appears, with the section it sits in and a link to the page. The bold line above each quote is our summary of what to do; where the two differ, the quote is the rule. Items marked with a condition, such as user accounts, HealthKit, Health Connect, medical claims or health research, appear only when you pick it. The rest apply to every health or fitness app on that store. Items your answers do not trigger stay on the page, folded under each store, so nothing is hidden. Your answers live in the page's address, so a copied link reproduces the list. Your ticks are kept in this browser's local storage and nowhere else; this site has no server code behind the page. ## Sources - [Apple, App Review Guidelines](https://developer.apple.com/app-store/review/guidelines/): Last Updated: October 16, 2026; read November 5, 2026. - [Google Play, Health Content and Services](https://support.google.com/googleplay/android-developer/answer/16679511?hl=en): read November 5, 2026. - [Google Play, Health app categories and additional information](https://support.google.com/googleplay/android-developer/answer/13996367?hl=en): read November 5, 2026. - [Google Play, User Data](https://support.google.com/googleplay/android-developer/answer/10144311?hl=en): read November 5, 2026. - [Google Play, Permissions and APIs that Access Sensitive Information (Health Connect by Android Permissions)](https://support.google.com/googleplay/android-developer/answer/16324062?hl=en): read November 5, 2026. - [Android Developers, Publish your health app on Google Play](https://developer.android.com/health-and-fitness/health-connect/publish?hl=en): read November 5, 2026. ## What the checklist cannot tell you Whether your app will be approved. Review applies these rules to your binary, metadata and behavior, and the stores change them: Apple dates its guidelines, and the Google Play pages carry no date, so check the live text before you submit. The page-by-page explanations are in the compliance section: [Apple's health data rules](https://aifitnessapi.com/compliance/app-store-health-data-rules), [Google Play's health data policy](https://aifitnessapi.com/compliance/google-play-health-data-policy) and [the Health Connect publishing requirements](https://aifitnessapi.com/compliance/google-play-health-connect-publishing-requirements). For the laws behind them, use the [compliance wizard](https://aifitnessapi.com/tools/compliance-wizard). A free tool from AIFitnessAPI. More at [free tools for health-app builders](https://aifitnessapi.com/tools). ## Next step Turning this into a choice of API: - [Apple App Store Health Data Rules: What You Need to Ship a HealthKit App](https://aifitnessapi.com/compliance/app-store-health-data-rules) - [Publishing a Health Connect App on Google Play: What's Required](https://aifitnessapi.com/compliance/google-play-health-connect-publishing-requirements) - [Apple HealthKit vs Google Health Connect (2026)](https://aifitnessapi.com/fitness-apis/apple-healthkit-vs-google-health-connect)