Pitfall 1: Conflating Device Permissions with Legal Consent
The mistake: Relying solely on iOS system permission prompts ("Allow HealthKit access?") or Android Health Connect permission dialogs to satisfy GDPR Article 7 consent.
Why it happens with Health (Flutter): Health (Flutter) integrates with native OS permission systems, so developers assume the system dialog is enough. It isn't. OS prompts inform users of *technical* access; they don't disclose *why* you need the data, what you'll do with it, or how long you'll keep it.
Consequence: Regulators (ICO, CNIL, BfDI) treat system permissions as notification, not consent. GDPR Article 4(11) requires consent to be informed and freely given. In enforcement actions (e.g., *British Airways/ICO* 2020), regulators have penalized companies that relied on device permissions alone. You face fines up to €10 million or 2% of global turnover, whichever is higher, under Article 83(4).
Pitfall 2: Missing or Vague Data Retention Disclosure
The mistake: Failing to specify how long heart rate, blood glucose, sleep, or workout data is stored, or stating "as long as the app is installed" without detail.
Why it happens with Health (Flutter): Because Health (Flutter) reads directly from HealthKit/Health Connect, developers assume data stays on-device and don't document retention. But if your app caches, logs, or syncs any of this data (even locally), you must disclose it.
Consequence: GDPR Article 5(1)(e) requires storage limitation—data must not be kept longer than necessary. Vague or absent retention policies violate this and trigger DPA investigations. Under Article 13, you must provide specific retention periods or criteria for erasure. Fines can reach €20 million or 4% of global turnover (Article 83(5)).
Pitfall 3: No Data Processing Agreement (DPA) with Apple/Google
The mistake: Not acknowledging that Apple HealthKit and Google Health Connect are *data processors* in the chain, and failing to secure written agreements.
Why it happens with Health (Flutter): Health (Flutter) documentation focuses on SDK integration, not legal processor obligations. Developers see "self-hosted" and assume no processor agreement is needed.
Consequence: GDPR Article 28 mandates a Data Processing Agreement with every processor. While Apple and Google's standard terms (their privacy policies and developer agreements) may suffice as processor terms, many DPAs interpret these as inadequate without explicit data processing addenda. UK ICO and EDPB guidance emphasize written agreements. Missing a DPA can void your data protection impact assessment and open you to enforcement action.
