Авторизація даних здоров’я в мобільній розробці: що це таке, як працює та доступ до HealthKit

Що таке авторизація даних здоров’я?

Health data authorization is a mechanism that requires explicit and documented user consent before accessing their medical and fitness metrics. Unlike standard permissions (contacts, calendar), health data is governed by additional legal regulations: HIPAA in the US, GDPR in Europe, and Federal Law 152-FZ in Росія.

On iOS, health authorization is implemented through HealthKit: the user sees a screen listing all types of data the application requests and can select specific categories to grant access. On Android, Google Fit API is used with OAuth 2.0 authorization, where a separate scope is requested for each data type.

According to App Annie (2025), health and fitness applications are one of the fastest growing segments of the mobile market with an annual growth rate of 28%. Meanwhile, 71% of users deny access to health data if the application does not provide a clear explanation of the purpose of collection.

Key difference of health authorization from other permissions is the ability to grant partial access. A user can allow reading steps but prohibit access to heart rate data or medical records.

Як HealthKit працює на iOS

HealthKit is Apple's framework, introduced in iOS 8, that provides a unified centralized health data repository. Applications do not have direct access to HealthKit — they request authorization through HKHealthStore, and the user decides which data types to provide. All data is encrypted on the device and synchronized through iCloud with end-to-end encryption.

Запит доступу до HealthKit

The authorization process begins with creating an instance of HKHealthStore and calling the requestAuthorization(toShare:read:) method. The application passes two sets of types: types to read (HKObjectType that the application wants to read) and types to write (HKSampleType that the application wants to save). The system displays a consent screen where the user enables or disables each type individually.

An important feature: HealthKit does not show the developer which specific types the user allowed on the consent screen. After calling requestAuthorization, it is necessary to individually check access to each type via HKHealthStore.authorizationStatus(for:). According to WWDC Session 11108 (2024), Apple recommends checking authorization status before every read or write operation.

HKObjectType Data Types

HealthKit supports hundreds of data types divided into categories: quantity (steps, heart rate, calories), characteristics (height, weight, date of birth), clinical records (allergies, vaccinations, lab results), symptoms, and menstrual cycle. Each type is represented by a subclass of HKObjectType: HKQuantityType for numeric measurements and HKCategoryType for categorical data.

With iOS 18, Apple expanded HealthKit to support data from medical institutions via FHIR (Fast Healthcare Interoperability Resources). Applications can request access to structured medical records if the user has connected their hospital or clinic to the Health app.

Як Google Fit API працює на Android

Google Fit is a platform for working with fitness data on Android that uses OAuth 2.0 authorization. Unlike HealthKit, Google Fit is not built into the OS at the system level — it is a separate Google Play Services service that requires setup through Google Play Console and creation of OAuth 2.0 credentials.

Google Fit та OAuth 2.0

To access Google Fit, the application must register an OAuth 2.0 client ID in Google Cloud Console. Authorization is requested via GoogleSignInAccount and GoogleSignIn.requestPermissions(). The user sees the standard Google consent screen listing the requested scopes: fitness.activity.read, fitness.body.read, fitness.nutrition.write, and others.

Google Fit separates permissions into read and write for each data type. An application can request access to read step count without requesting write permissions. Starting with Google Fit API v2, all authorization requests must include a description of the purpose of data usage — without this, the request is rejected by Google moderation.

FitnessOptions та обсяги

The FitnessOptions class allows declaratively specifying which data types require access. For each type, the access level can be set: ACCESS_READ, ACCESS_WRITE, or both. The permission set is passed to GoogleSignin.requestPermissions() along with the user account.

The list of available types includes: steps (DataType.TYPE_STEP_COUNT_DELTA), calories (TYPE_CALORIES_EXPENDED), heart rate (TYPE_HEART_RATE_BPM), distance (TYPE_DISTANCE_DELTA), activity (TYPE_ACTIVITY_SEGMENT), and sleep (TYPE_SLEEP_SEGMENT). Each type has its own update frequency and permission requirements.

Приклади коду для доступу до даних здоров’я

The implementation of health data authorization requests differs significantly between iOS and Android. Below are working examples for HealthKit and Google Fit API.

HealthKit у Swift

In Swift, the HealthKit authorization request is performed through HKHealthStore by specifying the types to read and write. The example demonstrates requesting access to step count and heart rate data.

import HealthKit

let healthStore = HKHealthStore()

let readTypes: Set<HKObjectType> = [
    HKObjectType.quantityType(forIdentifier: .stepCount)!,
    HKObjectType.quantityType(forIdentifier: .heartRate)!
]

let writeTypes: Set<HKSampleType> = [
    HKObjectType.quantityType(forIdentifier: .stepCount)!
]

guard HKHealthStore.isHealthDataAvailable() else {
    fatalError("HealthKit недоступний на цьому пристрої")
}

healthStore.requestAuthorization(toShare: writeTypes, read: readTypes) { success, error in
    if success {
        // Перевірка статусу кожного типу окремо
        let status = healthStore.authorizationStatus(for: readTypes.first!)
        print("Авторизація HealthKit: \(status.rawValue)")
    } else {
        print("Помилка авторизації HealthKit: \(error?.localizedDescription ?? "неизвестная")")
    }
}

Google Fit у Kotlin

On Android, Google Fit authorization is performed via GoogleSignIn and FitnessOptions. The example demonstrates requesting access to step count and calorie data.

val fitnessOptions = FitnessOptions.builder()
    .addDataType(DataType.TYPE_STEP_COUNT_DELTA, FitnessOptions.ACCESS_READ)
    .addDataType(DataType.TYPE_CALORIES_EXPENDED, FitnessOptions.ACCESS_READ)
    .build()

val account = GoogleSignIn.getAccountForExtension(this, fitnessOptions)

if (!GoogleSignIn.hasPermissions(account, fitnessOptions)) {
    GoogleSignIn.requestPermissions(
        this,
        REQUEST_GOOGLE_FIT,
        account,
        fitnessOptions
    )
} else {
    // Дозволи вже надано — читання даних
    readGoogleFitData(account)
}

// Обробка результату запиту на дозвіл
override fun onActivityResult(requestCode: Int, resultCode: Int, data: Intent?) {
    super.onActivityResult(requestCode, resultCode, data)
    if (requestCode == REQUEST_GOOGLE_FIT && resultCode == RESULT_OK) {
        val account = GoogleSignIn.getSignedInAccountFromIntent(data)
        account?.let { readGoogleFitData(it) }
    }
}

Безпека та відповідність нормативним вимогам

Health data belongs to an especially sensitive category of personal data. Developers of applications working with HealthKit or Google Fit must comply with regulatory requirements in the region of their users.

HIPAA та GDPR для даних здоров’я

In the US, health data is regulated by HIPAA (Health Insurance Portability and Accountability Act), which establishes strict requirements for the storage, transmission, and processing of medical information. Applications working with HealthKit can comply with HIPAA if data is transmitted to the server in encrypted form and access is restricted.

In the European Union, health data is considered a special category of personal data under GDPR (Article 9). Processing such data requires explicit user consent and, in most cases, a data protection impact assessment. Violation of GDPR requirements carries fines of up to 20 million euros or 4% of the company's annual turnover.

In Росія, the collection of health data is regulated by Federal Law 152-FZ “On Personal Data”. Since 2025, all applications processing medical data of Росіяn citizens are required to use certified encryption tools and store data on servers located within the territory of the Росіяn Federation, in accordance with the requirements of Roskomnadzor.

Recommendation: before publishing an application that works with health data, consult with the legal department to verify compliance with local regulations. Apple and Google reserve the right to reject an application if its privacy policy does not meet the requirements.