Mobile health apps: the privacy and store rules to check first

A step counter, a cycle tracker, a breathing timer and an app that suggests insulin doses can sit in the same store category, yet they live under very different rules. What decides which rules apply is rarely the code. It is what the app claims to do and what data it touches.

This is regulatory orientation for app makers, not medical or legal advice. Rules are stated as they stand at the time of writing (October 2026); check each at its source before you submit.

Contains affiliate links. As an Amazon Associate I earn from qualifying purchases.

Start with the claim, not the code

Regulators look first at intended purpose. The EU Medical Device Regulation defines it by the label, the instructions for use and promotional or sales materials, so your store description, onboarding screens and launch blog post all count. The FDA's general wellness guidance takes a similar line: it expects marketing to stay within a product's stated intended use, and for products that estimate body measurements, a reference to a specific disease or diagnostic threshold means the product is no longer a wellness product.

So two apps with the same sleep chart can land in different places. One helps you keep a regular bedtime; the other detects signs of sleep apnea, a medical claim whatever the code does. Write your claims down before anyone writes store copy.

Health data under the GDPR

Under the GDPR, data concerning health is one of the special categories in Article 9, alongside genetic and biometric data. Article 4(15) defines it as personal data about a person's physical or mental health that reveals information about their health status. Processing it is prohibited unless an exception in Article 9(2) applies, and for consumer apps that usually means explicit consent for specified purposes.

Consent for health data therefore needs its own clear moment in the app, not a line in the terms, and Article 35 requires a data protection impact assessment for large-scale processing of such data. Doing one early costs little.

The quieter risk sits in third-party code. An analytics event called "logged_migraine" sent to an advertising SDK is health data leaving the app. Keep health events out of ad and attribution tools, and collect only the fields a feature needs. If children may use the app, the stricter rules in our guide to apps in education apply on top.

Apple: the review guidelines and HealthKit

Apple's App Review Guidelines hold the rules most health apps meet first. At the time of writing:

• Guideline 1.4.1 says medical apps that could provide inaccurate data, or could be used to diagnose or treat patients, may be reviewed with greater scrutiny. Accuracy claims need disclosed data and methodology, and apps that claim to measure blood pressure, body temperature, blood glucose or blood oxygen with only the device's sensors are not permitted. Apps should remind users to check with a doctor, and an app with regulatory clearance should link to that documentation.
• Guideline 5.1.1(ix) says apps that provide services in highly regulated fields, healthcare among them, should be submitted by the legal entity that provides the services, not by an individual developer.
• Guideline 5.1.3 bars using HealthKit and related data for advertising, marketing or data mining, other than improving health management or health research with permission. Apps may not write false data into HealthKit or store personal health information in iCloud, and research with human subjects needs informed consent and ethics board approval.

Mind the gap between platform and regulator: an app estimating blood pressure from the phone's camera alone could fail App Review under 1.4.1 whatever its regulatory status.

HealthKit needs the HealthKit capability and two Info.plist strings, NSHealthShareUsageDescription for reading and NSHealthUpdateUsageDescription for writing. Permission is requested per data type, separately for reading and sharing, ideally when a feature first needs it. Your app can't tell whether someone denied read access: a denied type simply returns nothing beyond what your app saved, and people can also grant only a recent window of history. Design every chart for an empty or short record.

Google Play: the declaration and Health Connect

Google Play's health content and services policy asks for more paperwork. At the time of writing, every developer must complete the Health apps declaration form on the App content page in Play Console, and apps with health features need a privacy policy link both in Play Console and inside the app.

Apps regulated as medical devices declare that status, are labeled "Medical Device" on Google Play, and must provide proof of approval, clearance or certification on request. Other health and medical apps need a disclaimer in the app description stating that the app is "not a medical device and does not diagnose, treat, cure, or prevent any medical condition," plus a reminder to consult a healthcare professional.

Health Connect, Android's shared store for health and fitness data, is part of the framework from Android 14; on Android 13 and lower, people install the Health Connect app from Google Play. Each read and write permission in your manifest must match the data types you declare in Play Console, and the app needs an activity that shows your privacy policy from the Health Connect permission screen. By default an app can read data from up to 30 days before permission was granted; older history needs a separate permission.

When an app counts as a medical device

In the EU

The Medical Device Regulation, Regulation (EU) 2017/745, includes software in its definition of a medical device when the manufacturer intends it for purposes such as diagnosis, prevention, monitoring, prediction, prognosis, treatment or alleviation of disease. Guidance document MDCG 2019-11, revised in June 2025 and listed on the Commission's guidance page, states that wellness and fitness apps do not qualify as medical device software.

If it does qualify, Rule 11 in Annex VIII sets the class. Software that informs diagnostic or therapeutic decisions starts at class IIa, rising to IIb or III when a wrong decision could cause serious or irreversible harm; monitoring software is IIa, or IIb for vital parameters. Other medical device software is class I. From class IIa up, a notified body is involved before the CE mark, which changes budgets and timelines more than any line of code. A newer document, MDCG 2025-4, recommends that app platforms keep medical device apps apart from other health apps and show details such as the manufacturer, intended purpose and device identifier.

In the US

The FDA focuses its oversight on device software functions that could put patients at risk if they don't work as intended. Its guidance on device software functions, last revised in September 2022, lists low-risk functions where it intends to exercise enforcement discretion, such as helping people self-manage a condition without specific treatment suggestions. The general wellness guidance, updated in January 2026, covers low-risk products intended only for uses such as weight management, physical fitness, stress management, sleep management and mental acuity. It says products that use non-invasive sensing to estimate values such as heart rate variability may stay in that category if they make no disease claims and don't prompt clinical action.

Where common claims tend to land

A rough orientation, not a ruling; the exact wording decides.

Before you submit

1. A written intended purpose and claims list, checked against store copy, screenshots and onboarding.
2. A separate, explicit consent step for health data, and no health events in analytics or ad tools.
3. A data protection impact assessment, or a written note on why one isn't needed yet.
4. App Store: both HealthKit strings, the reminder to check with a doctor where 1.4.1 applies, and the right legal entity as account holder.
5. Google Play: the Health apps declaration, privacy policy links, and the disclaimer or the medical device declaration.
6. One named person who rereads the store rules before each major release.

Questions

Is a step count health data under the GDPR?

It can be. The definition turns on whether data reveals someone's health status, and a step count stored next to a recovery plan says more than one alone. Many teams treat everything a health app stores as special category data, since one careful pipeline beats arguing about each field.

Can a solo developer publish a health app on the App Store?

For a workout log, usually yes. Guideline 5.1.1(ix) targets apps that provide healthcare services. If the app connects people with clinicians or handles treatment, publish from an organization account; our guide to registering as an app developer explains the difference.

Where should a team start if it isn't sure the app is a medical device?

Write the intended purpose in two sentences, list every claim, and work through the decision steps in MDCG 2019-11 with someone who has prepared a medical device submission before. Do it before the design is final, because dropping one feature costs far less than adding a quality management system to an app that has already shipped.