Pitfall 1: Treating Health Connect Permissions as Sufficient for Consent
Android's runtime permission system (which Health Connect uses) prompts users to grant access but does not constitute GDPR Article 9 explicit consent or CCPA opt-in consent. The system permission is a *technical gate*, not a legal consent record.
Why it happens: Developers assume Google's permission UI satisfies privacy law consent requirements.
Consequence: You lack documented, affirmative consent to process special category data. A GDPR or CCPA regulator will find the permission log insufficient as evidence of lawful processing. You may face enforcement action, fines up to 4% of global revenue (GDPR), or corrective action orders. You cannot rely solely on the permission timestamp to demonstrate compliance.
Pitfall 2: Missing Data Processing Addendum (DPA) with Google
Google LLC is a mandatory data processor for Health Connect. Many indie teams skip formal DPA signature, assuming Google's standard terms cover it.
Why it happens: DPA negotiation feels bureaucratic; teams assume privacy policy references are enough.
Consequence: GDPR Article 28 requires a written contract governing processor obligations (data security, subprocessors, deletion, audit rights). Without a signed DPA, you have no legal instrument to impose GDPR obligations on Google. Regulators will cite this as non-compliance, and you bear liability for Google's processing failures.
Pitfall 3: Unclear or Missing Disclosure of Specific Health Data Types
Health Connect collects granular data categories (blood glucose, menstrual cycle, body fat %). Privacy policies that say "health and fitness data" without naming each type violate GDPR Article 13/14 (transparency) and CCPA Section 1798.100 (consumer notice).
Why it happens: Teams copy generic health-app language; Health Connect's breadth is underestimated.
Consequence: Regulators flag vague disclosures in audits. GDPR enforcement emphasizes specific, itemized notice. You may be required to halt processing until notice is corrected. CCPA violations trigger statutory damages ($100–$750 per consumer per incident).
