How can an Apple Health step app stay privacy-first?

Key takeaways

• App Store Review Guideline 5.1.3 bans using HealthKit data for advertising, marketing or data mining, and storing personal health information in iCloud.
• A step viewer needs read access to Step Count only: no workouts, heart rate, location or write access.
• iOS asks permission per data type, and apps cannot tell whether you denied read access.
• StepIsland keeps Health records on the iPhone; with an optional account it syncs only the daily step total, goal, world and time zone.
• You can review any app’s Health access in the Health app under your profile, then Apps.

What does Apple require from apps that use Apple Health?

Apple sets the baseline in two places.

• The App Store Review Guidelines. Section 5.1.3 says apps may not use or disclose to third parties data gathered through HealthKit and related APIs for advertising, marketing or other use-based data mining, apart from improving health management or health research with permission. Apps must not write false data into HealthKit, may not store personal health information in iCloud, and must disclose the specific health data they collect (Apple, App Store Review Guidelines).
• HealthKit permissions. An app must request authorization for each data type it reads or writes, and explain why in its Info.plist using NSHealthShareUsageDescription for reading (Apple Developer). To prevent leaks, an app cannot even find out whether you refused read access (Apple Developer).

Privacy-first means going further than those rules, not just meeting them.

What Health data should a step counter read?

Only what the feature needs. For an app that displays your steps, that is one type.

Our explainer on what HealthKit permission a step counter needs covers the technical side.

Where should Health data be stored?

On the iPhone wherever possible. The useful pattern is to calculate what the app needs on the device and only sync a summary when a feature genuinely requires it.

StepIsland’s privacy policy describes exactly that. Without an account, your steps, goal, streak and companion stay on your iPhone. An Upmoat account is optional; if you create one, StepIsland syncs your daily step total, daily goal, chosen world and time zone, and friends you add can see your first name, world and daily step total. Detailed Health records stay on your iPhone.

How should analytics and marketing be kept separate from Health data?

1. No ad or tracking SDKs in the app. StepIsland contains no advertising or third-party analytics SDKs and does not track you across apps or websites, according to its privacy policy.
2. Health data never decides marketing. Who receives a news email is never based on Health data, and every news email has an unsubscribe link.
3. Website analytics stay away from health. Our websites use Google Analytics and Microsoft Clarity by default, with an opt-out link in every footer, and our first-party event log rejects anything about health, steps, workouts or precise location (see the Upmoat privacy policy).
4. Deletion is real. Deleting an account in the app removes the account, synced step totals, friends and push tokens from the server.

How can you check a step app’s privacy yourself?

1. Check its Health access. Open the Health app, tap your profile picture, then Apps under Privacy, and choose the app. You will see exactly which types it can read or write, and you can turn them off.
2. Read the App Store privacy label. Every App Store listing has an App Privacy section showing what data is collected and whether it is linked to you or used for tracking.
3. Look for write access you did not expect. A step viewer rarely needs to write data.
4. Read the privacy policy for what syncs to a server and who processes it.
5. Check that you can delete your account from inside the app.

What does a privacy-first checklist look like for developers?

• Request the narrowest set of HealthKit types, at the moment the feature needs them.
• Write a plain usage description that says what you read and why.
• Keep the app usable if someone declines, and explain how to turn access on later.
• Sync aggregates, not raw samples, and only for opt-in features.
• Keep analytics and marketing tools out of the app, or at least away from anything health-related.
• Offer in-app account deletion that actually deletes server data.

Frequently asked questions

Can apps sell my Apple Health data?

Apple’s App Store Review Guidelines forbid apps from using or disclosing HealthKit data for advertising, marketing or use-based data mining. StepIsland’s privacy policy says it never sells your data or uses Health data for advertising or marketing.

Does a step counter app need access to all my Health data?

No. An app that displays steps only needs read access to Step Count. It does not need workouts, heart rate, location or permission to write data.

How do I see which apps can read my steps?

Open the Health app, tap your profile picture, then Apps under Privacy. Choose an app to see which data types it can read or write and turn them off.

Does StepIsland upload my Health data?

Detailed Health records stay on your iPhone. If you create an optional account, StepIsland syncs only your daily step total, goal, chosen world and time zone so friends features work.

Can an app tell if I said no to Health access?

Not for reading. Apple does not let apps find out whether you denied read permission, to avoid leaking sensitive information. The app simply sees no data.

From the studio behind this journal

A step app that keeps your Health data in its lane.

StepIsland is Upmoat’s walking app and step counter for iPhone and Apple Watch. Pick a companion, set a goal and watch an illustrated world grow with your Apple Health steps, live on your Lock Screen, Dynamic Island, widgets and Apple Watch.

Explore StepIsland

Sources

1. Apple. App Store Review Guidelines, 5.1.3 Health and Health Research
2. Apple Developer. Authorizing access to health data
3. Apple Developer. authorizationStatus(for:) (HealthKit)
4. Apple Developer. NSHealthShareUsageDescription
5. Apple Support. Manage Health data on your iPhone, iPad or Apple Watch
6. Upmoat. StepIsland privacy policy (updated October 1, 2026)