[Android] Health Connect ... "앱이 헬스 커넥트에 엑세스할 수 없음"

 

Health Connect 를 열심히 로컬 환경에서 개발하고, 이제 PlayStore 내부테스트로 테스트를 시작하려는 순간! 

이런 메세지를 마주하게 될 것이다. 

앱이 헬스 커넥트에 엑세스할 수 없음
앱이 최신 상태인지 확인하거나 앱 개발자에게 지원을 문의하세요. 

This app can't access Health Connect
Check the app is up-to-date, or contract the app developer for support.

 

 

이 때, 우리가 간과한 것이 있으니!  자주 묻는 질문(FAQ) 까지 정독하지 않은 것 즉,  제일 중요한 "개발자 선언 양식"을 작성하여 요청 해야한다는 것!!

자주 묻는 질문(FAQ)  |  Android 개발자  |  Android Developers

 

Google Health Connect API Request 을 신청하면 일단 일주일은 소요가 되며, 대략 매주 월요일 정도에 승인 리스트가 나오는 것으로 알려져 있다. 

요즘 헬스 커넥트 때문에  health-connect-support 담당자와 1일 1메일을 주고받는다.. 휴...ㅠ 

빨리 승인이 되기를 😰

 

참고 자료 

Health Connect by Android Permissions

Data accessed through Health Connect Permissions is regarded as personal and sensitive user data subject to the User Data policy, and the following additional requirements:

 

Appropriate Access to and Use of Health Connect

Requests to access data through Health Connect must be clear and understandable. Health Connect may only be used in accordance with the applicable policies, terms and conditions, and for approved use cases as set forth in this policy. This means you may only request access to permissions when your application or service meets one of the approved use cases.

Approved use cases for access to Health Connect Permissions are:

• Applications or services with one or more features to benefit users' health and fitness via a user interface allowing users to directly journal, report, monitor, and/or analyze their physical activity, sleep, mental well-being, nutrition, health measurements, physical descriptions, and/or other health or fitness-related descriptions and measurements.
• Applications or services with one or more features to benefit users' health and fitness via a user interface allowing users to store their physical activity, sleep, mental well-being, nutrition, health measurements, physical descriptions, and/or other health or fitness-related descriptions and measurements on their phone and/or wearable, and share their data with other on-device apps that satisfy these use cases.

Health Connect is a general purpose data storage and sharing platform that allows users to aggregate health and fitness data from various sources on their Android device and share it with third parties at their election. The data may originate from various sources as determined by the users. Developers must assess whether Health Connect is appropriate for their intended use and to investigate and vet the source and quality of any data from Health Connect in connection with any purpose, and, in particular, for research, health, or medical uses.

• Apps conducting health-related human subject research using data obtained through Health Connect must obtain consent from participants or, in the case of minors, their parent or guardian. Such consent must include the (a) nature, purpose, and duration of the research; (b) procedures, risks, and benefits to the participant; (c) information about confidentiality and handling of data (including any sharing with third parties); (d) a point of contact for participant questions; and (e) the withdrawal process. Apps conducting health-related human subject research using data obtained through Health Connect must receive approval from an independent board whose aim is 1) to protect the rights, safety, and well-being of participants and 2) with the authority to scrutinize, modify, and approve human subjects research. Proof of such approval must be provided upon request.
• It is also your responsibility for ensuring compliance with any regulatory or legal requirements that may apply based on your intended use of Health Connect and any data from Health Connect. Except as explicitly noted in the labeling or information provided by Google for specific Google products or services, Google does not endorse the use of or warrant the accuracy of any data contained in Health Connect for any use or purpose, and, in particular, for research, health, or medical uses. Google disclaims all liability associated with use of data obtained through Health Connect.

Limited Use

Upon using Health Connect for an appropriate use, your use of the data accessed through Health Connect must also comply with the below requirements. These requirements apply to the raw data obtained from Health Connect, and data aggregated, de-identified, or derived from the raw data.

• Limit your use of Health Connect data to providing or improving your appropriate use case or features that are visible and prominent in the requesting application's user interface.
• Only transfer user data to third parties:
  • To provide or improve your appropriate use case or features that are clear from the requesting application's user interface and only with the user’s consent;
  • If necessary for security purposes (for example, investigating abuse);
  • To comply with applicable laws and/or regulations; or,
  • As part of a merger, acquisition or sale of assets of the developer after obtaining explicit prior consent from the user.
• Do not allow humans to read user data, unless:
  • The user's explicit consent to read specific data is obtained;
  • It’s necessary for security purposes (for example, investigating abuse);
  • To comply with applicable laws; or,
  • The data (including derivations) is aggregated and used for internal operations in accordance with applicable privacy and other jurisdictional legal requirements.

All other transfers, uses, or sale of Health Connect data is prohibited, including:

• Transferring or selling user data to third parties like advertising platforms, data brokers, or any information resellers.
• Transferring, selling, or using user data for serving ads, including personalized or interest-based advertising.
• Transferring, selling, or using user data to determine credit-worthiness or for lending purposes.
• Transferring, selling, or using the user data with any product or service that may qualify as a medical device pursuant to Section 201(h) of the Federal Food Drug & Cosmetic Act if the user data will be used by the medical device to perform its regulated function.
• Transferring, selling, or using user data for any purpose or in any manner involving Protected Health Information (as defined by HIPAA) unless you receive prior written approval to such use from Google.

Access to Health Connect may not be used in violation of this policy or other applicable Health Connect terms and conditions or policies, including for the following purposes:

• Do not use Health Connect in developing, or for incorporation into, applications, environments or activities where the use or failure of Health Connect could reasonably be expected to lead to death, personal injury, or environmental or property damage (such as the creation or operation of nuclear facilities, air traffic control, life support systems, or weaponry).
• Do not access data obtained through Health Connect using headless apps. Apps must display a clearly identifiable icon in the app tray, device app settings, notification icons, etc.
• Do not use Health Connect with apps that sync data between incompatible devices or platforms.
• Health Connect cannot connect to applications, services or features that solely target children. Health Connect is not approved for use in primarily child-directed services.

An affirmative statement that your use of Health Connect data complies with Limited Use restrictions must be disclosed in your application or on a website belonging to your web-service or application; for example, a link on a homepage to a dedicated page or privacy policy noting: “The use of information received from Health Connect will adhere to the Health Connect Permissions policy, including the Limited Use requirements.”

Minimum Scope

You may only request access to permissions that are critical to implementing your application or service's functionality. 

This means:

• Don't request access to information that you don't need. Only request access to the permissions necessary to implement your product's features or services. If your product does not require access to specific permissions, then you must not request access to these permissions.

Transparent and Accurate Notice and Control

Health Connect handles health and fitness data, which includes personal and sensitive information. All applications and services must contain a privacy policy, which must comprehensively disclose how your application or service collects, uses, and shares user data. This includes the types of parties to which any user data is shared, how you use the data, how you store and secure the data, and what happens to the data when an account is deactivated and/or deleted.

In addition to the requirements under applicable law, you must also adhere to the following requirements:

• You must provide a disclosure of your data access, collection, use, and sharing. The disclosure:
  • Must accurately represent the identity of the application or service that seeks access to user data;
  • Must provide clear and accurate information explaining the types of data being accessed, requested, and/or collected;
  • Must explain how the data will be used and/or shared: if you request data for one reason, but the data will also be utilized for a secondary purpose, you must notify users of both use cases.
• You must provide user help documentation that explains how users can manage and delete their data from your app.

Secure Data Handling

You must handle all user data securely. Take reasonable and appropriate steps to protect all applications or systems that make use of Health Connect against unauthorized or unlawful access, use, destruction, loss, alteration, or disclosure.

Recommended security practices include implementing and maintaining an Information Security Management System such as outlined in ISO/IEC 27001 and ensuring your application or web service is robust and free from common security issues as set out by the OWASP Top 10.

Depending on the API being accessed and number of user grants or users, we will require that your application or service undergo a periodic security assessment and obtain a Letter of Assessment from a designated third party if your product transfers data off the user's own device.

For more information on requirements for apps connecting to Health Connect, please see this help article.

 

 

 

Permissions and APIs that Access Sensitive Information - Play Console Help

 

미리보기: 민감한 정보에 액세스하는 권한 및 API - Play Console 고객센터