Health content and services policy 2026: Google Play for health apps
TL;DR
Google Play's Health Content and Services policy in 2026 reaches every app on the store: since August 31, 2024, all published apps must complete an accurate Health apps declaration, even to say they have no health features. For a healthcare app, four gates decide the release, and each has its own review.
- Health apps must be published from an organization account, which needs a D-U-N-S number.
- Apps not regulated as medical devices need a description disclaimer; regulated apps must show proof of clearance on request.
- Health Connect access is requested per data type and reviewed against approved use cases, with extra scrutiny for substance use and clinical vitals.
- Medical records in Health Connect are still experimental, and Google says its Play policy for them is still being developed.
Google Play now asks every app about health
The Health apps declaration is not optional for anyone. Every developer with an app published on Google Play must complete it, testing tracks included, and an app without health features still certifies that. System services and private apps are the only exceptions.
The account comes before the form. Google Play requires an organization account for health apps, "such as medical apps and human subjects research apps," next to financial, VPN and government apps. An organization account needs a D-U-N-S number, which Dun & Bradstreet issues for free. An app on a staff member's personal account has to move first.
Since September 30, 2026, Android checks who built the app
Distribution outside Play now has a gate too. Since September 30, 2026, Android's developer verification protects users who install apps on certified devices running Android 7 and higher in Brazil, Indonesia, Singapore and Thailand, with a global rollout planned for 2027. Google Play registers 99% of apps automatically; apps distributed outside Play must be registered in Play Console or the Android Developer Console.
That matters for health apps sideloaded onto clinic tablets. Also, since August 31, 2026, new apps and updates must target Android 16, API level 36.
Clinic tablets installed outside the store are covered in our guide to healthcare kiosk app development.
How we built this guide
Every rule here comes from Google's policy and help pages and Apple's App Review Guidelines, read on November 3, 2026.
The pages that rank for this question are thin. Privacy World's summary of Google's health app policy dates from December 2023, before the declaration deadline. Terra's one-question FAQ covers a single rejection type. Mercury Development builds native and cross-platform Android apps and earns from releases, so read the opinion sections as an interested view.
Google Play and the App Store for health apps at a glance
| Requirement | Google Play | App Store |
|---|---|---|
| Who publishes | Organization account with a D-U-N-S number | Legal entity that provides the service, guideline 5.1.1(ix) |
| Health questionnaire | Health apps declaration for every app | None |
| Medical claims | Disclaimer, or proof of clearance on request | Disclose data and methodology; link clearance documents |
| Health data API | Health Connect, reviewed per data type | HealthKit, guideline 5.1.3 |
| Private release | Managed Google Play, up to 1,000 organizations | Custom and unlisted apps |
For the App Store side, see our App Store approval for healthcare apps guide.
The Health apps declaration: pick categories you can defend
The form asks you to select every health feature the app has. Health and fitness covers trackers such as activity, sleep or nutrition. Medical covers 10 features, from Diseases and Conditions Management and Clinical Decision Support to Healthcare Services and Management, Medication and Treatment Management and Mental and Behavioral Health. Regulated apps, including software that interfaces with medical device hardware, select Medical Device Apps. Research studies and patient communities select Health subjects research.
Google reviews the declaration with the app, so treat it as a claim: select only what the app does today, and match it to your listing, Data safety answers and manifest permissions. Apps in the EEA and Northern Ireland regulated under EU MDR or IVDR must also publish device details, including the SRN, an eIFU link and the UDI-DI.
Medical claims: a disclaimer or proof of clearance
The policy splits health apps in two. Apps regulated as medical devices must provide proof of approval, clearance or certification on request. Apps that are not must state in their description that the app is "not a medical device and does not diagnose, treat, cure, or prevent any medical condition," and remind users to consult a healthcare professional.
Pick your side before you write the listing. Google's category guidance adds that apps making a health claim should disclose their purpose, the basis for the claim, intended users and risks, inside the app. Apple asks for the same in guideline 1.4.1: data and methodology behind accuracy claims, a reminder to check with a doctor and a link to clearance documents.
Google widened this policy in its October 30, 2024 announcement, consolidated health rules under one page and let regulated medical devices use Health Connect data with explicit consent for their approved purposes.
Whether you need proof of clearance at all is decided step by step in our FDA decision tree for health apps.
Health Connect permissions get their own review
Health Connect access is granted per data type, against six approved use cases: fitness and coaching, rewards for healthy habits, corporate wellness, medical care, human subjects research and health-integrated games. Google forbids selling health data, using it for ads or for credit, insurance, employment or lending decisions, and using it in apps that target only children.
The review is a written argument. For each data type, Google asks for a justification of how the data benefits the user, and says not to request types the app does not need. Sensitive categories, such as reproductive health, substance use, clinical vitals and symptoms, get heightened scrutiny. Access is allow-listed per package name; when you add a data type, the new request must list every type the app still uses.
Two details catch teams late. On Android 14 and higher Health Connect is part of the framework; on Android 13 and lower users install the Health Connect app, which runs on Android 9 or higher. Starting in Android 16, BODY_SENSORS is being replaced by granular health permissions such as READ_HEART_RATE.
Medical records in Health Connect are not open for release yet
Health Connect now has a Medical Records API for reading and writing FHIR-based records, behind a separate permissions screen. Its APIs carry an experimental annotation, need the Android 16 SDK, and Google says the Play policy for medical records access is still being developed, so apps may face additional requirements before release.
Payment and research rules
- Payments. The policy says transactions for regulated clinical services should not use Google Play billing.
- Prescriptions. Apps may not facilitate buying prescription drugs without a prescription.
- Research. Human subjects research apps need IRB or ethics committee approval and participant consent, and must show proof on request.
- Government health. Apps built with permission from a government or recognized healthcare organization submit proof through the Advance Notice Form.
- Privacy policy. Link it in Play Console and inside the app, on a public, non-geofenced URL, never a PDF.
Which payment channel each product type needs on both stores is covered in our guide to HIPAA compliant payment processing.
Why health apps get rejected on Google Play
Google names the common Health Connect rejection reasons itself: unclear justification, a use outside the approved cases, more permissions than the app needs and too little detail on how data is used and shared. Rejected requests can be resubmitted. Terra advises replying with screenshots and a screen recording of where the data appears in the app.
The rest of the pattern follows from the policy. A medical claim with no disclaimer. A declaration that says wellness while the listing says disease management. A health app on a personal account. And timing: Google's publishing page warns that certain apps get extended reviews of up to 7 days or longer, so do not book a launch for review day.
Which release path fits your health app
- Patients on their own phones: a public listing from an organization account, with access gated at login.
- Staff on managed devices: managed Google Play, private to up to 1,000 organizations through their EMM console. Private apps are exempt from the Health apps declaration.
- A pilot before launch: a closed testing track, which still needs the declaration. Personal accounts created after November 13, 2023 need 12 testers for 14 days before production, but health apps belong on an organization account anyway.
- Kiosk tablets outside Play: register the app in Play Console or the Android Developer Console before developer verification reaches your market.
What our healthcare requirement records show
Two patterns from our healthcare requirement records, without client names.
A hospital-to-nursing-facility coordination app named App Store review as a delivery risk before any code was written, because a narrow B2B app depends on a reviewer's reading of the rules. On Android, facilities that manage their devices can take a private app through managed Google Play, outside the Health apps declaration.
A substance-use program for patients at treatment facilities wanted a private release and was still considering Google Play and the App Store. Managed Google Play reaches organizations, not patients' own phones, and substance use is one of the Health Connect categories Google scrutinizes most. Settle the store language and the data types first.
Write the declaration before the code
On Google Play the release review reads four documents: the Health apps declaration, the store listing, the Data safety form and the Health Connect justification. A reviewer can hold each against the app and the others. Written in release week, they expose a data type the declaration cannot defend.
Write them during design instead, as a one-page claims sheet: what the app does, what it never claims and which data types it reads. Engineering builds to that sheet.
Written by Rob Devereaux, Chief Operating Officer at Mercury Development. Rob has run the firm's operations from Hudson, Ohio since 2019 and has over 20 years of operational and financial experience.
Releasing a health app on Android? Map the review first
Tell us what your app does, which health data it reads and who installs it. We will return a Google Play review map: the account type, the declaration categories, the disclaimer or clearance proof, and the Health Connect justification for each data type.