WHAT THE POLICIES SAY

Apple Health is the iOS Health app and HealthKit platform (Apple Inc., Nasdaq: AAPL). Apple's legal disclosures state health and fitness data is processed on-device, encrypted and inaccessible by default when the device is locked, and end-to-end encrypted in iCloud even under default Standard Data Protection — Apple states it cannot read health data synced to iCloud when two-factor authentication is on. Health app data is not accessible to Apple's advertising platform, and App Store rules bar third-party apps from using health data for advertising or selling it to data brokers. Caveats: data shared with authorized apps or healthcare organizations may be retained under those parties' policies, Apple's general privacy policy governs account-level data, and France's CNIL fined Apple Distribution International 8 million euros in 2022 over App Store advertising identifiers (not Health data).

TRACK RECORD

1 ENFORCEMENT ACTION

[2023-01-04]

On December 29, 2022, France's data protection authority (CNIL) imposed an 8 million euro administrative fine on Apple Distribution International for depositing and/or reading advertising identifiers on French users' iPhones (iOS 14.6) without consent, in connection with App Store ad personalization; the action concerned Apple's App Store advertising practices at the corporate level, not Health app data.

web.archive.org ↗

TIMELINE

NO ENTRIES ON FILE YET.

ULTIMATE PARENT

TOOLS WE RECOMMEND

PLUS

RECEIPTS

10 ON FILE

[2026-01-05] · COLLECTION

Apple's iCloud data security overview (support document 102651, published January 5, 2026) lists Health data among 15 data categories that are end-to-end encrypted in iCloud even under the default Standard Data Protection setting, stating that Apple does not hold the encryption keys for these categories and cannot recover the data.

support.apple.com ↗

[2026-02-11] · COLLECTION

Apple's 'Health App & Privacy' legal disclosure (updated February 11, 2026) states that the Health app consolidates data from the user's devices, health records, and authorized apps, and that all health and fitness data other than Medical ID is encrypted on-device and inaccessible by default whenever the device is locked with a passcode, Touch ID, or Face ID.

apple.com ↗

[2025-10-31] · OWNERSHIP TRANSPARENCY

Apple Inc., the developer of the Health app and HealthKit, is a California-incorporated public company traded on Nasdaq (AAPL) that files audited annual reports with the U.S. Securities and Exchange Commission; its Form 10-K for the fiscal year ended September 27, 2025 (filed October 31, 2025) publicly discloses its corporate structure, governance, and risk factors.

sec.gov ↗

SHARING

Apple's App Store Review Guidelines, section 5.1.3(i), prohibit third-party apps from using or disclosing to third parties data gathered in the health, fitness, and medical research context — including HealthKit API data — for advertising, marketing, or other use-based data mining purposes, and section 5.1.3(ii) additionally forbids apps from storing personal health information in iCloud.

developer.apple.com ↗

[2025-07-30] · SHARING

Apple's Privacy Policy (updated July 30, 2025) — which governs the account-level personal data Apple holds, including data associated with a user's Apple Account — states that Apple does not sell personal data as 'sale' is defined in Nevada and California, and does not 'share' personal data as that term is defined in California.

apple.com ↗

[2025-09-01] · SHARING

Apple's 'Health & Fitness Apps Privacy Overview' (September 2025) states that information users choose to share with third-party apps in the health, fitness, and medical research context may not be used for advertising or sold to data brokers under Apple's rules, and that all such apps must provide a privacy policy describing how users can revoke consent or request deletion of their data.

apple.com ↗

[2026-02-11] · SHARING

Apple's 'Health App & Privacy' disclosure (updated February 11, 2026) states that when a user stops sharing Health app data with a healthcare organization, information already shared may be retained by that provider in its own records — data shared out of the Health app to authorized recipients is no longer under Apple's control.

apple.com ↗

[2022-12-07] · TRACK RECORD

In a December 7, 2022 press release announcing Advanced Data Protection for iCloud, Apple stated that iCloud already protected 14 sensitive data categories — including Health data — with end-to-end encryption by default, and that enabling Advanced Data Protection raises the total to 23 categories; the feature launched in the US by end of 2022 and worldwide in early 2023.

apple.com ↗

[2023-01-04] · TRACK RECORD

web.archive.org ↗

[2026-05-11] · TRACKING TECH

Apple's 'Apple Advertising & Privacy' disclosure (dated May 11, 2026) states that Health app data is not accessible to Apple's advertising platform or used for advertising purposes, and that the platform does not link user or device data collected from Apple apps with third-party data for targeted advertising and does not share user or device data with data brokers.

apple.com ↗

LAST REVIEWED 2026-08-04 · METHODOLOGY v1.7