Health Connect in Android 16: Granular Permissions and the Google Play Health Declaration
21 Jun 2026 · 4 min read · Erik van Kammen
Quick answer: Google Play's 2026 Health and Fitness policy update, announced on April 15, 2026, aligned with Android 16 granular permissions and added new high-sensitivity Health Connect data types, including Menstrual Cycle Phases, Alcohol Consumption, and Symptoms. Apps that access health data must complete the Health apps declaration form in Play Console, must not use sensitive health data for employment or insurance eligibility, and must keep their Data Safety form consistent with what the app actually collects. Here is what changed and how to prepare.
Health Connect is Android's shared store for health and fitness data, and it is where Google has concentrated its 2026 health-data rules. If your app reads or writes any health or fitness data, this update changes both what you can do with that data and what you must declare before submitting.
What changed in the 2026 Health and Fitness policy?
The April 15, 2026 policy update did three things that matter at submission time:
- It aligned Play's health rules with Android 16 granular permissions, so health permissions are requested and granted at a finer level rather than as one broad grant.
- It added new high-sensitivity Health Connect data types, including Menstrual Cycle Phases, Alcohol Consumption, and Symptoms.
- It tightened prohibited uses and made the Health apps declaration form a requirement for developers who access health data.
The new high-sensitivity data types
Three additions stand out because they are sensitive by nature and draw extra scrutiny:
- Menstrual Cycle Phases
- Alcohol Consumption
- Symptoms
If your app touches any of these, expect closer review and make sure your declared purpose is specific and genuinely tied to a user-facing feature.
Which uses are now prohibited?
The update is explicit: sensitive health data must not be used for employment or insurance eligibility decisions, and unauthorized social sharing of health data is not allowed. These are hard prohibitions, not best practices.
The Health apps declaration form
Developers who access health data must complete the Health apps declaration form on the App content page in Play Console. This is separate from, and in addition to, the Data Safety form. Treat it as a required submission artifact, not an optional questionnaire.
Keep the Data Safety form consistent
Your Data Safety section must reflect the health data the app actually collects and shares. Because Health Connect access often comes through an SDK, the declared collection and the real collection can drift apart. See Data Safety section accuracy for how mismatches happen and how to catch them.
The changes at a glance
| Item | What changed (April 15, 2026) | What to do |
|---|---|---|
| Permissions | Aligned with Android 16 granular permissions | Request the narrowest health permission your feature needs |
| Data types | Added Menstrual Cycle Phases, Alcohol Consumption, Symptoms | Declare a specific purpose for each sensitive type used |
| Prohibited uses | No employment or insurance eligibility use; no unauthorized sharing | Remove or redesign any such use |
| Declaration | Health apps declaration form required | Complete it on the App content page |
| Data Safety | Must match real collection | Reconcile the form with the binary |
How to prepare before submitting (checklist)
- Identify every Health Connect data type the app reads or writes, including ones accessed through an SDK.
- Confirm each one maps to a clear, user-facing feature and request the narrowest granular permission that works.
- Remove any use of sensitive health data for employment, insurance, or unauthorized sharing.
- Complete the Health apps declaration form in Play Console.
- Update the Data Safety form so the declared collection matches what the app actually does.
- Re-check after any SDK update, because a new version can change the health data it touches.
Where a pre-submission check helps
A pre-submission scan reads the permissions your App Bundle declares and the SDKs it ships, so it can surface Health Connect permissions and health-touching SDKs that need to appear in both your declaration form and your Data Safety section. That keeps the paperwork matched to the binary. For the broader permission picture, see app permissions and manifest compliance and the April 2026 permission changes.
Frequently asked questions
Which apps must complete the Health apps declaration form?
Developers whose apps access health data must complete it on the App content page in Play Console. It is required in addition to the Data Safety form, not instead of it.
What are the new high-sensitivity Health Connect data types?
The 2026 update added Menstrual Cycle Phases, Alcohol Consumption, and Symptoms as high-sensitivity types. Apps that use them should expect closer review and need a specific, user-facing purpose.
Can I use health data for insurance or employment decisions?
No. The 2026 policy explicitly prohibits using sensitive health data for employment or insurance eligibility, and it prohibits unauthorized social sharing of health data.
Does my Data Safety form need to match Health Connect permissions?
Yes. The Data Safety section must reflect the health data the app actually collects and shares. Since Health Connect access often comes through an SDK, verify the declaration against what the binary really does.