Blocks submissionApp Store

Health, fitness or motion data is used only for the user's benefit, disclosed, never sold, never in iCloud

The question The app reads health, fitness or motion data. Is the specific data named in the purpose string and privacy manifest? Is it used only to serve the user, with no advertising, marketing or third-party sharing? Is none of it stored in iCloud? If it runs research, is there informed consent and ethics approval?

A person or a model answers it from the app's texts and screens; the answer is kept only while the facts it saw are unchanged.

Applies when capability:health; signal:healthkit

Checked from built, not yet uploaded, on a test track, submitted and in review, published

The rule, in our words

• App Review Guidelines: Health, fitness and medical data (including from Clinical Health Records, HealthKit, Motion and Fitness, MovementDisorder APIs or health research) may not be used or disclosed to third parties for advertising, marketing or other use-based data mining, other than for improving health management or for health research, and then only with permission; an app may use a user's health data to give that user a direct benefit if submitted by the entity providing the benefit and the data is not shared. The specific health data collected from the device must be disclosed. Apps may not write false data into HealthKit or other health apps and may not store personal health information in iCloud. Human-subject health research needs consent from participants, or from a parent or guardian for minors, covering the nature, purpose and duration of the research, procedures, risks and benefits, confidentiality and data handling including third-party sharing, a point of contact, and the withdrawal process; it also needs approval from an independent ethics review board, with proof available on request.

Okkok never stores the stores' text. Each item above is our paraphrase, and the link is the page it rests on, verified unchanged by fingerprint on every run.

The other store

• Apple bans advertising or marketing use of health data and prescribes research consent contents plus independent ethics review; Google requires a console declaration and a disclaimer but does not itself bar advertising use (its User Data policy limits use to expected functionality). partial
• Google gates health APIs behind approved use cases; Apple bans specific downstream uses (advertising, data mining, iCloud storage of personal health information, writing false data). partial

Check your app

pip install git+https://github.com/petresandu-cloud/okkok
okkok audit path/to/app

The report names this rule as apple.5.1.3.health-data and says what to do, who does it, where, and how it knows.