On the evolution of security and privacy in Android health APIs

Introduction With the rapid proliferation of mobile health technologies and smart devices, safeguarding sensitive personal health data has become critical. Android 14 introduced Health Connect as a centralized platform designed to optimize health data management, grant users granular control over their information, and enable secure, transparent inter-app communication. However, whether Health Connect represents an effective advance over earlier Android solutions remains to be evaluated. Methods A structured, technology-agnostic evaluation framework was designed using a threat model grounded in European cybersecurity (NIS2 Directive, Cyber Resilience Act) and privacy (GDPR) standards. Across defined security and privacy criteria, Health Connect was comparatively evaluated against its predecessor solutions (Google Fit and the Android Sensors API) examining storage integration, encryption, operational models and permission granularity alongside empirical verification using the OWASP Mobile Application Security Testing Guide (MASTG). Results Health Connect provides stronger native architectural support for security (availability, integrity and authenticity) and privacy (data minimisation, user consent management, transparency, accuracy and storage limitation) compared to the general-permission, cloud-dependent or developer-dependent models of Google Fit and the Android Sensors API. However, security support for confidentiality remains partial due to an empirical failure in runtime/database-level encryption within its local sandbox. Discussion Health Connect marks a significant step forward in Android health data protection, largely driven by fine-grained permissions and local container isolation. Nevertheless, the lack of database-level runtime encryption and sparse technical documentation represent key shortcomings. Addressing these issues and improving implementation transparency are essential to consolidate user and developer trust across the digital health ecosystem.