# Google Health API User Data and Health Research Policy

Effective as of March 24, 2026

[Google Health API Developer Terms \& Conditions](https://developers.google.com/health/policies/health-api-developer-terms-and-conditions),
[Google Health API Developer and User Data Policy](https://developers.google.com/health/policies/health-api-developer-user-data-policy),
and [Google Health API Documentation](https://developers.google.com/health) are dedicated to
protecting privacy and security while facilitating health and fitness research.
The Google Health API may only be used for human subjects research, referred to
as health research in this policy, if the research is submitted for review,
reviewed or approved by an independent board whose aim is 1) to protect the
rights, safety, and well-being of participants and 2) with the authority to
scrutinize, modify, and approve human subjects research. Independent boards
include an Institutional Review Board (IRB) detailed in 45 C.F.R. §§ 46.101-115,
an Ethics Committee (EC) detailed in Directive 2001/20/EC or Directive
2005/28/EC, or another entity adhering to substantially similar
requirements ("Review Board").

Fitbit approved applications and web services using the Google Health API
for health research will be labeled Health Research Applications or
Health Research Web Services and collectively referred to as the
"Health Research Applications and Web Services". "You" and "your" as used herein
refers to these Health Research Applications and Web Services. In the event of a
conflict between this policy or any other terms with regard to accessing user
data, this Health Research Policy controls for Health Research Applications
and/or Web Services.

Health Research Applications and Web Services:

1. Are responsible for obtaining approval or waiver from a Review Board;
2. Must comply with the below policy, the [Google Health API Developer Terms \& Conditions](https://developers.google.com/health/policies/health-api-developer-terms-and-conditions) except as otherwise stated herein, and other applicable Google policies, including the [Google Health API Developer and User Data Policy](https://developers.google.com/health/policies/health-api-developer-user-data-policy); and,
3. Must comply with any applicable federal and state laws and regulations, including, the California Consumer Privacy Act, HIPAA, GDPR, the Common Rule, the FDA regulations on the protection of human subjects.

It is your responsibility to monitor and ensure your compliance with these
conditions on a regular basis. If, at any time, you cannot meet these conditions
(or if there is a significant risk that you will not be able to meet them), you
must immediately stop using our services. We also reserve the right to deny or
revoke your authorization for health research if you do not comply with this
policy or we have reasonable concerns about your compliance with this policy.

## Health Research Attestation

Health Research Applications and Web Services must submit:

1. A completed intake form
2. IRB/EC (or substantially similar equivalent) Approval/Waiver Letter
3. IRB/EC (or substantially similar equivalent) Accreditation
4. Exact data requested and rationale for use

## Determine Eligibility for Health Research

Health Research Applications and Web Services must confirm the eligibility of a
participant before obtaining informed consent and requesting permission to
access participant's data.

## Transparent and Accurate Notice and Control for Health Research

After confirmation of eligibility, you must comply with the Google Health API
Developer and User Data Policy's
[Transparent and Accurate Notice and Control](https://developers.google.com/health/policies/health-api-developer-user-data-policy#transparent_and_accurate_notice_and_control)
section.

In addition, Health Research Applications or Web Services must provide a
disclosure via a dialogue box or incremental dialogue boxes that include/s:

1. The nature, purpose, and duration of the research;
2. The risks and benefits to the participant;
3. The privacy, security, and data handling measures in place to protect the data;
4. The point of contact for any questions;
5. The retention period(s) for data collected for the study;
6. How to withdraw from the study;
7. How to delete one's data from the study throughout the lifecycle of the study, including whether the study permits deletion after the data becomes accessible to the public; and,
8. Any other relevant documents or information required by your IRB/EC.

You must also provide an option for the participant to save, store, or email the
above information, the Informed Consent documents, and any other documents
required by the IRB/EC. Each participant must sign and submit the required
disclosures and consents prior to participation in the study. It's recommended
that a copy of all signed documents be sent to the participant.

Health Research Applications and Web Services will follow the FDA's
[Use of Electronic Informed Consent Questions and Answers](https://www.fda.gov/media/116850/download),
or substantially similar standards. For example, you might include plain
language in your explanations with diagrams/infographics and you might ask
participants to correctly answer questions about the health research prior to
their enrollment.

## Limited Uses of User Data for Health Research

Health Research Applications or Web Services must comply with the below
requirements. These requirements apply to the participant data, the processed
data obtained from the Google Health API, and data aggregated, anonymized, or
derived from the processed data.

1. Limit your use of participant data to its intended purpose for collection.
2. Immediately de-identify participant data to the greatest extent possible for your study.
3. Do not use or share participant data with third parties for new research studies, or for any purpose different from the original study purposes, without obtaining a separate informed consent from participants, unless the IRB explicitly waives the requirement for separate informed consent.
4. Do not use or share data with members of your team who do not have a genuine need to know.
5. Only transfer participant data to third parties: a. If necessary to pursue the original research purpose and the third parties are bound to limit its access and use of the participant data to fulfilling that purpose; b. If the participant granted explicit consent to share specific data; for example, in the signed Informed Consent document presented to the participant; c. if necessary for security purposes (for example, investigating abuse); or, d. to comply with applicable laws or regulations.

**All other transfers, uses, or sale of participant data is expressly
prohibited, including:**

1. Transferring, selling, or using participant data for serving ads, including contextual, retargeting, personalized, or interest-based advertising.
2. Transferring or selling participant data to third parties like advertising platforms, data brokers, or any other information resellers.
3. Transferring, selling, or using participant data to determine credit-worthiness or for lending purposes.
4. Transferring, selling, or using the participant data with any product or service that may qualify as a health device pursuant to Section 201(h) of the Federal Food Drug \& Cosmetic (FD\&C) Act if the participant data will be used by the health device to perform its certified function.
5. Transferring, selling, or using participant data for any purpose or in any manner involving Protected Health Information (as defined by HIPAA) unless received by you under a valid HIPAA Authorization that was reviewed by an IRB or EC, as applicable.

An affirmative statement that your use of the data complies with the Limited Use
restrictions must be disclosed in your application or on a website belonging to
your web-service or application; for example, a link on a homepage to a
dedicated page or privacy policy noting: "The use of information received from
Google Health API will adhere to the Google Health API User Data and Health
Research Policy, including the Limited Use requirements." If you are unable to
add a disclosure, then your app's privacy policy must comply with the
requirements outlined in this policy. This option might make the review time for
your app longer.

## Secure Data Handling Recommendations for Health Research

Health Research Applications and Web Services must comply with the Google Health
Developer and User Data Policy's
[Secure Data Handling](https://developers.google.com/health/policies/health-api-developer-user-data-policy#secure_data_handling)
section. Health Research
Applications and Web Services are also recommended to follow best practices
recommended by the U.S. Department of Health and Human Services, [U.S. Food and
Drug Administration](https://www.fda.gov/media/116850/download) regulations, or
[ICH Good Clinical Practice Guidelines](https://www.ema.europa.eu/en/ich-e6-good-clinical-practice-scientific-guideline),
like applying for a Certificate of Confidentiality from the National Institutes
of Health, which may protect data from compelled disclosure to third parties.

## Publishing Data

Health Research Applications and Web Services may choose to publish the results
of their research, but may not suggest that Fitbit approves of the study design,
scientific validity of the research, or otherwise endorses the study findings
unless provided in writing by Fitbit. Health Research Applications and Web
Services must comply with the relevant laws and regulations as well as the
following requirements if you plan to publish your research, or make it publicly
available in any form:

1. Notify Fitbit for the study's inclusion in the [Fitbit Publication
   Library](https://fitbit.google/enterprise/published-research/).
2. If applicable, we encourage you to register your study in a public registry; for example, clinicaltrials.gov.
3. Publicly disclose the source of the information.
4. Refrain from publishing individual data that may be identifiable. Good practices for re-identification risk mitigation include: a. Wherever possible, provide summary-level aggregate data rather than individual-level de-identified data. b. If you must share individual-level de-identified data, instead of publishing the data publicly, provide it selectively to others only for purposes of peer review, subject to contractual commitments by the recipient not to disclose or attempt to re-identify the data. c. If you must publish individual-level de-identified data, you must do so in compliance with all applicable laws and at a minimum, use an accepted de-identification technique, like differential privacy, to preserve confidentiality, or obtain an expert determination that the risk of re-identification is very small.