App Store and Google Play rules for health apps

A practice app, a telehealth app or a wellness app has to pass two reviews before a patient can install it: Apple App Review for the App Store and Google Play review for Android. Both stores publish rules written for health and medical apps. They decide who may submit the app, what the listing may claim, what the privacy label must say and how a person deletes their account. An app that breaks them can be rejected at submission or removed after launch, and the store listing itself is advertising that the FTC Act reaches.

This guide walks through the Apple App Review Guidelines and the Google Play Health Content and Services policy as a practice owner or health company founder needs them: medical claims and disclaimers, the health apps declaration, privacy labels and the Data safety section, account deletion, and the HIPAA and FTC rules that apply alongside the store rules. For related topics, see our guides to marketing a health app or telehealth startup, why healthcare ads get disapproved, web push notifications for practice websites and apps and the FTC Health Breach Notification Rule. If your app ships with a connected device that carries a written warranty, see our guide to warranty rules for health devices and products.

This is general information, not legal advice. Sources cited were checked on October 31, 2026: the Apple App Review Guidelines (last updated October 16, 2026); the Apple Developer pages App privacy details on the App Store and Offering account deletion in your app (no date shown); the Play Console Help pages Health Content and Services, Provide information for the Health apps declaration form, Provide information for Google Play’s Data safety section and Understanding Google Play’s app account deletion requirements (no date shown); the HHS OCR bulletin on online tracking technologies (content last reviewed June 26, 2024, with its note on American Hospital Association v. Becerra), read through an archived copy dated October 22, 2026, because hhs.gov does not load from our server; 45 CFR 164.501, 164.502(a) and 164.508(a)(3); 16 CFR 318.2 and 318.3; and 15 USC 45(a)(1) and 52. Apple and Google revise these rules without a fixed schedule, so read the current versions before you submit. We found no federal rule or agency guidance written for app store listings of health apps as such. State rules differ, so have a health care attorney review your app, its listing and its privacy policy.

The short version

Apple says apps in highly regulated fields such as healthcare should be submitted by a legal entity that provides the services, not by an individual developer. Apple also rejects apps built from a commercial template unless the provider of the app’s content submits them.
Both stores require medical claims to be supported. Apple asks for disclosed data and methodology behind accuracy claims. Google requires proof of clearance for regulated medical devices and a set disclaimer for other health and medical apps.
On Google Play, all developers with a published app must complete the Health apps declaration, even to certify that the app has no health features.
Both stores require a privacy policy link in the store listing and in the app, and a privacy label that covers data your third-party code collects. The developer answers for its accuracy.
Apple bars using health data from HealthKit and similar sources for advertising or marketing. Google treats Health Connect data as personal and sensitive user data.
If the app lets people create an account, both stores require a way to delete it from inside the app. Google also requires a web link for deletion requests.
A practice app that collects patient information is subject to HIPAA. An app outside HIPAA can fall under the FTC Health Breach Notification Rule, and the FTC Act covers what the listing says.

Who may submit a health app

Apple App Review Guideline 5.1.1(ix) says apps that provide services in highly regulated fields, naming healthcare among them, or that require sensitive user information, should be submitted by a legal entity that provides the services, and not by an individual developer. Guideline 4.2.6 says apps created from a commercialized template or app generation service will be rejected unless they are submitted directly by the provider of the app’s content, and that those services should not submit apps on behalf of their clients.

For a practice, the plain reading is that the app should sit in a developer account held by the practice’s own business entity, not in a freelancer’s personal account or a template vendor’s account. That also keeps the app, its listing and its reviews with the practice if the developer relationship ends. Google Play’s health policy adds an advance notice form for apps built with permission from a government or recognized healthcare organization, which applies to apps that claim that affiliation.

Medical claims, accuracy and disclaimers

Apple Guideline 1.4.1 says medical apps that could provide inaccurate data or information, or that could be used for diagnosing or treating patients, may be reviewed with greater scrutiny. Apps must clearly disclose data and methodology to support accuracy claims relating to health measurements, and Apple will reject the app if the accuracy or methodology cannot be validated. Apple gives examples it does not permit: apps that claim to take x-rays or measure blood pressure, body temperature, blood glucose or blood oxygen using only the sensors on the device. Apps should remind users to check with a doctor in addition to using the app and before making medical decisions, and an app with regulatory clearance should submit a link to that documentation. Guideline 1.4.2 says drug dosage calculators must come from the drug manufacturer, a hospital, university, health insurance company, pharmacy or other approved entity, or receive approval by the FDA or one of its international counterparts.

Google Play’s Health Content and Services policy says it does not allow apps with health and medical functions that are misleading or potentially harmful. Apps regulated as a medical device must be declared as such, are identified as a Medical Device on Google Play and must provide proof of approval, clearance or certification on request. Other health and medical apps must include a clear disclaimer in the app description that the app is “not a medical device and does not diagnose, treat, cure, or prevent any medical condition,” and must remind users to consult a healthcare professional for medical advice, diagnosis or treatment. Apps that need external hardware, such as a blood glucose monitor, must disclose that in the description, and apps that use device sensors for health functions must state which devices are compatible.

Whether an app is a regulated medical device is a question for regulatory counsel, not for the store listing. If you are unsure, do not describe the app as diagnosing or treating anything until you have that answer.

What the listing itself may say

Apple Guideline 2.3.1 says marketing an app in a misleading way, such as promoting content or services it does not offer, is grounds for removal and for termination of the developer account. Guideline 2.3.7 says keywords must accurately describe the app and that subtitles should not make unverifiable product claims. Google Play’s policy lists misleading health claims that contradict medical consensus, false health claims about products and claims that a product is as effective as prescription drugs among the content it does not allow.

The store listing is also advertising under federal law. 15 USC 45(a)(1) declares unfair or deceptive acts or practices in or affecting commerce unlawful, and 15 USC 52 makes it unlawful to disseminate a false advertisement likely to induce the purchase of food, drugs, devices, services or cosmetics. Write the description the way you would write a page on your website: what the app does, who it is for and what it does not do. Leave out outcome promises, cure language and comparisons with prescription treatment. Our guide to why healthcare ads get disapproved covers the same claim problems in paid ads.

The Google Play Health apps declaration

The Play Console Help page on the declaration says Google announced the requirement in April 2024 and that all developers with an app published on Google Play must complete the Health apps declaration on the App content page, including apps on closed testing, open testing or production tracks. Developers whose apps offer no health features must still complete it and certify that no health features are offered. An app that is not mainly a health app but accesses health data to support other features is still in scope.

The form lists health feature categories. A practice app for booking, reminders, telehealth, records or billing fits the category Healthcare Services and Management, which the page describes as covering scheduling medical appointments, reminders, telehealth services, managing health records, billing and navigating health insurance. Medical Device Apps is a separate category for apps regulated as medical devices, and the page lists additional public disclosures for apps regulated as devices under the EU medical device regulations. The policy also says permissions not required for the app’s core function should not be requested, and unused permissions must be removed.

Privacy policies, privacy labels and Data safety

Apple Guideline 5.1.1(i) requires all apps to link their privacy policy in App Store Connect and inside the app. The policy must identify what data the app collects, how and for what uses, confirm that any third party with which the app shares user data, including analytics tools, advertising networks and third-party SDKs, will provide the same or equal protection, and explain retention, deletion and how a user can revoke consent. Guideline 5.1.2(i) requires clear disclosure and explicit permission before sharing personal data with third parties, including with third-party AI, and permission through the App Tracking Transparency framework to track a user’s activity.

Apple’s App privacy details page says you must describe the practices of third-party partners whose code you integrate into your app, and that you are responsible for keeping your answers accurate and up to date. Its list of data types includes Health, described as health and medical data including data from the Clinical Health Records API, HealthKit API and any other user provided health or medical data.

Google Play’s Health Content and Services policy requires a privacy policy link in the Play Console and a link or text inside the app, on an active, publicly accessible URL that is not a PDF. The Data safety Help page says all developers must declare how they collect and handle user data, including data collected through third-party libraries or SDKs, and that the developer alone is responsible for complete and accurate declarations. Its data types include Health info, described as information about a user’s health such as medical records or symptoms. The form also asks whether data is encrypted in transit and whether users can request deletion. The page says Google may take enforcement action when it finds a discrepancy between an app’s behavior and its declaration.

Before you fill in either form, list each SDK in the app, such as analytics, crash reporting, chat, scheduling and advertising code, and what each one sends off the device. The label has to match what the code does, not what the vendor’s sales page says.

Health data rules inside the app

Apple Guideline 5.1.3(i) says apps may not use or disclose to third parties data gathered in the health, fitness and medical research context, including from the Clinical Health Records API and HealthKit API, for advertising, marketing or other use-based data mining purposes other than improving health management or health research, and then only with permission. Guideline 5.1.3(ii) says apps may not store personal health information in iCloud. Guidelines 5.1.3(iii) and (iv) require informed consent and independent ethics review board approval for apps conducting health-related human subject research.

Google Play’s policy says data accessed through Health Connect permissions is personal and sensitive user data under its User Data policy, with additional requirements, and that apps conducting health-related human subjects research must obtain informed consent and should secure Institutional Review Board approval unless exempt. It does not allow apps that facilitate the sale or purchase of prescription drugs without a prescription, and it says transactions for regulated clinical services should not use Google Play’s billing system.

Account deletion

Apple Guideline 5.1.1(v) says that if an app supports account creation, it must also offer account deletion within the app. Apple’s guidance page on account deletion says offering only to deactivate an account is not enough, that you should tell people what information will be retained if you are legally required to keep it, and that apps in highly regulated industries, as described in Guideline 5.1.1(ix), may use additional customer service flows to confirm and facilitate deletion.

Google Play’s account deletion page says an app that lets users create an account must provide an in-app path to delete the account and associated data and a web link where users can request deletion, and that all developers must answer the data deletion questions in the Data safety form. For a practice, deleting an app account is not the same as destroying the medical record. Explain in the app which records the practice keeps under law and how a patient can ask about them, and ask counsel what your state requires you to retain.

HIPAA and the FTC rule behind the store rules

Under 45 CFR 164.502(a), a covered entity may not use or disclose protected health information except as the Privacy Rule permits. The HHS Office for Civil Rights bulletin on online tracking technologies says information that a regulated entity’s mobile app collects, including device information such as a device ID or advertising ID, generally is protected health information, and the regulated entity must follow the HIPAA Rules for any disclosure to the app vendor, a tracking vendor or any other third party. It also says HIPAA does not cover health information a person enters into an app that is not offered by or on behalf of a regulated entity.

The bulletin is still posted, with a note. On June 20, 2024, in American Hospital Association v. Becerra, the US District Court for the Northern District of Texas vacated the bulletin to the extent it said HIPAA obligations are triggered when a technology connects an IP address with a visit to an unauthenticated public page about specific health conditions or providers. The rest of the bulletin stands, including its guidance on mobile apps.

Under 45 CFR 164.501, marketing means a communication about a product or service that encourages the recipient to purchase or use it, with exclusions for treatment communications and for describing the covered entity’s own health-related services unless it is paid to make the communication. 45 CFR 164.508(a)(3) requires written authorization for marketing uses of protected health information. An app that sends patients promotions selected from their records needs the same review as any other patient marketing.

For apps outside HIPAA, the FTC Health Breach Notification Rule, 16 CFR part 318, applies to vendors of personal health records and PHR related entities that are not covered entities or business associates. Under 16 CFR 318.2, health care services or supplies include any online service such as a website, mobile application or internet-connected device that tracks conditions, symptoms, medications, fitness, sleep, diet and similar matters, and a breach of security includes an unauthorized disclosure. Under 16 CFR 318.3, a vendor or PHR related entity must notify affected individuals and the FTC after discovering a breach, and prominent media outlets when 500 or more residents of a State or jurisdiction are involved. Our guide to marketing a health app or telehealth startup covers the FTC side for founders.

Questions to ask before you submit a health app

Is the developer account held by our own business entity, and are we the ones submitting the app?
Does the app make any accuracy claim about a health measurement, and can we show the data and method behind it?
Could the app be a regulated medical device, and has regulatory counsel answered that in writing?
Does the Google Play description carry the not-a-medical-device disclaimer and the reminder to consult a healthcare professional, where required?
Which SDKs are in the app, and what does each one send off the device?
Do our App Store privacy label, Google Play Data safety answers and privacy policy say the same thing?
Does any health data reach an analytics, advertising or AI vendor, and is each vendor covered by a business associate agreement where HIPAA applies?
Can a person delete their account inside the app, and do we explain which records the practice keeps?
If the app sits outside HIPAA, have we read 16 CFR part 318 with counsel?

Use and avoid

Use: a developer account in the name of the practice or company that provides the services.
Use: a store description that states what the app does, who it is for and what it does not do.
Use: the disclaimer and consult-a-professional reminder Google Play requires, and Apple’s reminder to check with a doctor.
Use: an SDK inventory that you update before you change your privacy label or Data safety answers.
Use: an in-app account deletion path with a plain note on records the practice keeps.
Avoid: submitting through a template vendor’s or freelancer’s personal developer account.
Avoid: accuracy claims for health measurements you cannot support with data and method.
Avoid: cure, diagnosis or outcome language in titles, subtitles, screenshots or descriptions.
Avoid: passing HealthKit or Health Connect data to advertising or analytics tools.
Avoid: health permissions the app does not need for its core function.

An illustration

This example is invented. [Practice name], a physical therapy practice in [city], hires a developer to build an app for booking, home exercise videos and visit reminders. The first plan publishes the app under the developer’s own account from a template the developer reuses for other clients, with the subtitle “Recover faster from back pain,” a crash reporting SDK and an analytics SDK, and a privacy label that lists only contact details.

Before submission, the owner reviews the plan with counsel and their marketing contact. The practice opens its own organization developer account and the developer builds a separate app for it. The subtitle becomes “Book visits and follow your home exercise plan.” The developer lists what each SDK sends, the analytics SDK is removed from the signed-in screens, and the privacy label and Data safety answers are rewritten to match. The Google Play declaration selects Healthcare Services and Management and Physical Therapy and Rehabilitation, and the description adds the disclaimer and a reminder to consult a healthcare professional. The app adds account deletion in settings, with a note that the practice keeps treatment records as required by law.

Checklist

Open the developer accounts in the name of the practice or company that provides the services.
Read the current Apple App Review Guidelines sections 1.4, 2.3, 4.2.6 and 5.1, and the Google Play Health Content and Services policy.
Get a written regulatory answer on whether the app is a medical device before describing its functions.
Write store text with no outcome promises, cure language or unverifiable claims.
Add the Google Play disclaimer and the reminders to consult a healthcare professional where they apply.
Complete the Google Play Health apps declaration and choose each category that fits.
Inventory each SDK and the data it sends, then complete the App Store privacy label and Google Play Data safety form from that inventory.
Publish a privacy policy on a public web page and link it in both stores and inside the app.
Keep HealthKit and Health Connect data away from advertising and marketing use.
Build in-app account deletion, plus the web link Google Play requires, and explain which records you keep.
Review HIPAA authorization rules for any patient marketing sent through the app, and 16 CFR part 318 for apps outside HIPAA.

How we help

We build websites, local and organic search, Google Ads and lead generation and an AI front desk for independent practices. For a health app, that means writing store listings and landing pages that describe the app plainly, checking that the privacy policy, the store labels and the website say the same thing, and keeping tracking code off pages and screens where patients sign in. Our tools are built with HIPAA in mind. We confirm in writing what a BAA covers before any patient information flows through a tool, and if it is not covered, we do not route patient information through it. We are not a healthcare provider and we do not give legal or medical advice. Read our guide to healthcare marketing rules for the wider picture.

Can our app developer publish the practice app under their own account?

Apple Guideline 5.1.1(ix) says apps in highly regulated fields such as healthcare should be submitted by a legal entity that provides the services, not by an individual developer, and Guideline 4.2.6 says template-built apps will be rejected unless the provider of the app’s content submits them. We recommend a developer account in the practice’s own business name.

Do we have to complete the Google Play Health apps declaration?

Yes, if you have an app published on Google Play. The Play Console Help page says all developers with a published app must complete it, including apps on testing tracks, and apps without health features must certify that they offer none.

What disclaimer does Google Play require for a health app?

Health and medical apps that are not regulated as medical devices must state in the app description that the app is not a medical device and does not diagnose, treat, cure or prevent any medical condition, and must remind users to consult a healthcare professional for medical advice, diagnosis or treatment.

Does the privacy label have to include our analytics and crash reporting tools?

Yes. Apple’s App privacy details page says you must describe the practices of third-party partners whose code you integrate, and Google Play’s Data safety page says declarations include data collected through third-party libraries or SDKs.

Does deleting an app account mean deleting the patient’s medical record?

No. Both stores require an account deletion path, and Apple’s guidance says to tell people what information you are legally required to retain. Medical record retention depends on federal and state law, so explain in the app what the practice keeps and ask counsel what your state requires.

Sources

More in Health companies, vendors and employers

App Store and Google Play rules for health apps: what practices and health companies must disclose