Guideline 5.1.3(i) prohibits apps from using or sharing health, fitness, and medical research data collected from specified Apple health APIs for advertising, marketing, or use-based data mining, and permits health research use only with explicit user permission. The prohibition extends to third-party disclosure for these purposes.
This analysis describes what Apple's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes categorical restrictions on health data use that apply to all apps accessing Apple health APIs, independent of whether the app is a HIPAA-covered entity. The restriction on use-based data mining for health data is broader in its stated scope than standard commercial health data governance terms typically applied outside HIPAA-regulated contexts.
The updated guidelines do not directly affect end users of apps, but they establish new requirements for developers submitting apps to the App Store. Developers must now provide regulatory documentation for apps requiring approval, implement content moderation safeguards for user-generated content and AI content creation platforms, and ensure all app information and creative assets meet specific accuracy and appropriateness standards. Developers who fail to implement safeguards or remediate violations after notice may be considered in violation of the Developer Code of Conduct, potentially resulting in app removal or account termination.
View change record →⚠ Apps that use health API data for advertising or unauthorized data mining may be removed from the App Store.
⚠ Violations of health data restrictions may trigger regulatory inquiry from the FTC or HHS OCR depending on the entity type.
Cross-platform context
See how other platforms handle Health Data Use and Sharing Restrictions and similar clauses.
Compare across platforms →"Apps may not use or disclose to third parties data gathered in the health, fitness, and medical research context—including from the Clinical Health Records API, HealthKit API, Motion and Fitness, MovementDisorder APIs, or health-related human subject research—for advertising, marketing, or other use-based data mining purposes other than improving health management, or for the purpose of health research, and then only with permission.Excerpt from Apple's App Store Review Guidelines
(1) REGULATORY LANDSCAPE: This provision engages HIPAA for apps operated by covered entities and business associates, FTC Act Section 5 for unfair or deceptive health data practices, and GDPR Article 9 for special category health …
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Get the weekly coverage letter
Companies change their terms without announcing it. We capture governance documents, compare each new version with the last, and publish what changed, with the source text behind it. One email a week on what we found and what we could not reach.
This provision establishes categorical restrictions on health data use that apply to all apps accessing Apple health APIs, independent of whether the app is a HIPAA-covered entity. The restriction on use-based data mining for health data is broader in its stated scope than standard commercial health data governance terms typically applied outside HIPAA-regulated contexts.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Apple.