Health Hazard, Handle with Care: Investigating the Privacy Risks of Android's Health Connect

Android's Health Connect framework was recently introduced to unify health and fitness data management across apps, promising transparency, user control, and privacy through on-device storage and fine-grained permissions. In this paper, we present the first empirical investigation of Health Connect and show that its design suffers from inherent flaws that introduce serious privacy risks, including the creation of a covert communication channel that can be used to bypass existing access control mechanisms. Accordingly, we use dynamic analysis to systematically examine Health Connect apps, and uncover widespread privacy-invasive behaviors. We find that 60.9% of apps fail to comply with Health Connect's UI data transparency guidelines, and 25.6% do not report the collection or sharing of health records. Additionally, 19.6% of the apps exfiltrate Health Connect data (including records generated by other apps) over the network, combining health information (e.g., blood pressure) with personally identifiable data such as names, emails, Advertising IDs, and phone numbers. These practices violate Google's policies and undermine user expectations of control. We disclosed our findings to Android's Health Connect team, who verified our findings and informed us that our research allowed them to strengthen their review and policy enforcement processes, and take action against bad actors. While this is a step in the right direction, our research demonstrates that Health Connect's design falls short of its stated goals and, ultimately, undermines the privacy protections Android has introduced in recent years.