Is Health Connect data treated differently from other data?

Yes. Data accessed through Health Connect permissions is treated as personal and sensitive user data plus additional Health Connect rules — notably no advertising use and no sale or transfer to third parties. Other health data your app collects directly still falls under Google's broader sensitive-data policy, so the Health Connect rules are not the only ones that apply.

Does the Health Connect permission prompt count as user consent?

No. The permission prompt is an OS-level access control that decides whether your app can read a data type. Google separately requires an in-app prominent disclosure and consent before collecting sensitive data, and a permission grant is not automatically a legal basis such as GDPR consent. Treat them as distinct requirements.

What is the Data safety form and how strict is it?

The Data safety section is mandatory for every Play listing and must accurately state what data you collect, how you use it, and whether you share it. It has to match your actual behavior and your privacy policy — mismatches between your in-app disclosure, privacy policy, and Data safety form are a common rejection and enforcement trigger.

What deletion options does Google Play require?

Apps that offer account creation generally must provide in-app account deletion, an option to request deletion of data without deleting the account, and a web-accessible deletion path, all disclosed in the Data safety form. The exact wording and deadlines have evolved, so verify the current User Data and Data safety policy pages in the Play Console before you rely on specifics.

Google Play Health Data Policy: What It Requires

Q: Is Health Connect replacing Google Fit?

Health Connect is Google's on-device successor as the older Google Fit APIs wind down. New Fit sign-ups reportedly closed in May 2024, and the Fit Android and REST APIs are slated to be supported only until the end of 2026 — verify this at publish time, as the dates have slipped before. Google recommends Health Connect for on-device and mobile use, with a different path for server-side integrations.

If your Android app reads fitness or health data — especially through Health Connect — Google Play holds you to several overlapping rules: the Health Connect data policy, the broader Personal and Sensitive User Data policy, an in-app prominent disclosure plus consent, an accurate Data safety form, and account and data deletion paths. The single idea running through all of them: health and fitness data may be used only for the user-facing features you disclose, and it may never be sold, transferred to data brokers, or used to serve ads. This is general engineering guidance, not legal advice — and because some Play Console policy pages are hard to fetch programmatically, confirm the exact current wording in the official Play Console before you ship.

Does this apply to your app?

If your app collects, uses, or shares any personal or sensitive user data, Google Play's User Data policy applies — and health and fitness data is squarely within it. Two layers matter:

The Personal and Sensitive User Data policy covers all sensitive data your app touches, however you obtained it (direct entry, sensors, an SDK, or another API).
The Health Connect data policy adds further requirements specifically for data you access through Health Connect permissions. Data pulled via Health Connect is treated as personal and sensitive user data plus these extra rules.

A useful distinction: the Health Connect rules govern data obtained through Health Connect, but other health data your app collects directly still falls under the broader (and still strict) sensitive-data policy. Do not assume the Health Connect rules are the only ones in play.

Why Health Connect matters now

Health Connect is Google's on-device store and permission layer for health and fitness data, and it is the successor path as the older Google Fit APIs wind down. New Google Fit sign-ups closed (reported as May 1, 2024), and the Fit Android and REST APIs are slated to be supported only until the end of 2026 (verify — Google's deprecation dates have slipped before). Google's recommended migration is Health Connect for on-device and mobile use; server or cloud integrations need a different path. For the integration mechanics, see our Health Connect integration guide and the HealthKit vs Health Connect comparison.

What Google Play requires

Requirement	What it means for your app
Permitted use / minimum necessary	Request only the health data types your stated, user-facing features actually need, and justify each type. A March 5, 2025 Health Connect update tightened this with added eligibility and justification requirements, especially for health-records data types (verify).
No advertising use	Data accessed via Health Connect may not be transferred, sold, or used to serve ads, including personalized or interest-based ads.
No sale or transfer to third parties	You may not transfer or sell health and fitness data to advertising platforms, data brokers, or information resellers.
Prominent disclosure + consent	You must show an in-app prominent disclosure (an on-screen message) and get consent before collecting sensitive data. This is separate from — and not satisfied by — your store listing or privacy policy alone.
Privacy policy	Apps handling personal and sensitive data must post a privacy policy both in the store listing and accessible in-app, covering collection, use, sharing, and secure handling.
Data safety form	Every Play listing must complete the Data safety section, accurately stating what data is collected, how it is used, and whether it is shared. It must match your actual behavior and your privacy policy.
Account + data deletion	Apps offering account creation must provide account deletion, an option to request data deletion without deleting the account, and a web-accessible deletion path — disclosed in the Data safety form (verify exact wording and deadlines).
Background location	Accessing location in the background needs separate justification and declaration, is only allowed when core to a user-facing feature, and must be disclosed and consented.

A note on the health-specific content rules: Google Play also maintains a Health apps declaration and health content and services policies that can apply on top of the data rules. If your app makes health claims or offers health services, check those declarations in the Console too.

What this means for a fitness app

Treat the OS permission grant as access control, not legal consent. A Health Connect permission prompt decides whether your app can read a data type; it is not, by itself, a GDPR lawful basis or a substitute for the in-app disclosure and consent Google requires. See health data user consent.
Keep three surfaces in sync. Your in-app disclosure, your privacy policy, and your Data safety form must all describe the same behavior. Mismatches are a common rejection and enforcement trigger.
Do not monetize the data. No ad use, no selling, no handing it to data brokers — this is a hard line for Health Connect data.
Ask for the minimum. Request only the health data types your features use, and be ready to justify each one, particularly for sensitive health-records types.
Build deletion in early. Plan for in-app account deletion, data-only deletion, and a web deletion route from the start rather than retrofitting. See health data retention and deletion.

A note on limits

Google reorganizes and renumbers its policies often, and several items here — the Fit shutdown timeline, the March 2025 Health Connect tightening, and the exact deletion-flow wording and deadlines — change over time and are flagged to verify. Play policy is also only one layer: depending on your users you may also owe obligations under GDPR, US state consumer-health laws, and the FTC. Use this as a map, confirm the live policy text in the Play Console, and check Apple's health-data rules and your own health app privacy policy before you ship. This is general guidance, not legal advice — get advice from a qualified professional for your specific case.

General engineering guidance, last reviewed July 14, 2026. This is not legal, medical, or regulatory advice. Health-data laws (HIPAA, GDPR, state privacy laws) and platform policies vary by jurisdiction and change often, and how they apply depends on your specific product, users, and data. Confirm your obligations with a qualified attorney or compliance professional and check the current official sources before you ship.

What does Google Play's health data policy require?