Common Apple HealthKit Compliance Mistakes
### Pitfall 1: Purpose Strings Don't Match Disclosure
Apple's Info.plist requires specific purpose strings (NSHealthShareUsageDescription, NSHealthUpdateUsageDescription) for each HealthKit data type. Many teams write vague strings ("Health data for your profile") that don't explain the actual use case. If your app accesses blood glucose data but only mentions "activity tracking" in the purpose string, you've created a mismatch with your privacy policy. Consequence: GDPR Article 6 violations (lack of lawful basis specificity), potential App Store rejection, and user trust damage if audited.
### Pitfall 2: Forgetting Downstream Data Handler Agreements
Many indie teams believe "self-hosted" means no DPA is required. However, if you use any cloud backend (AWS, Firebase, etc.) to store HealthKit data, that provider is a processor under GDPR Article 28. Without a signed Data Processing Agreement with your infrastructure provider, you're non-compliant even if you don't use a health-specific third party. Consequence: GDPR fines for processing without a DPA; potential regulatory enforcement.
### Pitfall 3: Selling or Using Data for Advertising
Apple's terms explicitly prohibit selling HealthKit data or using it for advertising/behavioral tracking. Teams sometimes repurpose health data for secondary analytics or marketing attribution. Consequence: App Store removal, potential FTC enforcement (health data falls under FTC Act Section 5), and GDPR Article 6 breach for processing without appropriate legal basis.