Engineering · 8 min read
Fitness App Features and Tech Stack: HealthKit, Health Connect, Offline Sync and Privacy
Fitness app features by app type and the stack behind them: HealthKit, Health Connect, wearables, offline sync, subscriptions, video and US privacy rules.
Zain Khalid MalikCTO & Co-founder, Innovation Insight·Published 
Short answer
A fitness app needs five pieces of engineering beyond its screens: health-data sync through Apple HealthKit and Android Health Connect (Google Fit APIs end with 2026), offline-first storage, store subscriptions verified on your server, a video pipeline using a managed service, and privacy controls for health data under the FTC Health Breach Notification Rule and Washington's My Health My Data Act. We usually build it in Flutter or React Native with a TypeScript or Python backend.
Features by app type
Most feature lists for fitness apps mix three different products. Split them by type first, then by user, because a workout library, a GPS tracker and a nutrition diary share accounts and subscriptions and very little else.
| Feature | Workout and training | GPS activity tracker | Nutrition tracker |
|---|---|---|---|
| Core loop | Pick a class or plan, follow the video, mark it done | Record a run or ride, save, share | Search or scan a food, log a portion |
| Content | Video library, programmes, exercise demos | Routes, segments, clubs | Food database, recipes |
| Device work | Video playback and downloads, casting to TV | Background GPS, sensors, battery | Camera barcode scanning |
| Offline need | Downloaded classes | Critical: recording with no signal | High: diary logging anywhere |
| Health sync | Write workouts and calories | Read heart rate, write workouts and routes | Read weight and steps, write nutrition |
| Social | Optional: challenges, leaderboards | Central: feed, kudos, segments | Optional: friends, shared diaries |
| Typical premium tier | Full library and plans | Segments, analysis, routes | Macro goals, no ads, reports |
Features per user
| User | Must have at launch | Usually later |
|---|---|---|
| Member | Onboarding with goals, content or recorder, progress charts, reminders, subscription and restore purchases, account deletion | Challenges, friends, AI plans, wearables beyond the phone's health app |
| Coach or creator | Upload and order content, build programmes, see completions | Messaging with members, payouts for third-party coaches, live classes |
| Admin | Users, subscriptions and refunds lookup, content moderation, push campaigns, data export and deletion requests | A/B tests on the paywall, cohort analytics |
The tech stack we use
| Layer | Our default | Why |
|---|---|---|
| Mobile app | Flutter or React Native (Expo where possible) | One codebase for iOS and Android; native modules only for health permissions, background location and the player |
| Local storage | SQLite (Drift on Flutter, WatermelonDB or op-sqlite on React Native) | Fast queries over months of history on the device, and a sync queue that survives app restarts |
| Backend | NestJS (TypeScript) or FastAPI (Python) on PostgreSQL | Relational data for users, plans and entitlements; PostGIS when there are routes and segments |
| Media | A managed video service (Mux or Cloudflare Stream) behind HLS | Encoding, adaptive bitrate and signed URLs without running FFmpeg servers |
| Subscriptions | StoreKit 2 and Google Play Billing, verified on the server, or RevenueCat | Entitlements must come from the store, not from the app's word |
| Notifications | Firebase Cloud Messaging and APNs | Reminders and social notifications on both platforms |
| Analytics | Product analytics without health fields in event properties | Keeps health data out of advertising and analytics tools |
For background on the framework choice, see Flutter vs React Native. Our React Native development and Flutter app development pages cover how we staff each.
Apple HealthKit
HealthKit is the on-device store behind the Apple Health app. Your app asks for read and write permission per data type (workouts, active energy, heart rate, body mass, dietary energy) and the user can grant some and refuse others. Two details catch teams out. First, HealthKit does not tell you whether read permission was denied; a query simply returns no data, so the UI must not assume "no data" means "no activity". Second, Apple's guidelines forbid using HealthKit data for advertising or selling it, and require a privacy policy. Write your app's workouts to HealthKit as well as reading from it; users expect their sessions to close their Apple Watch rings.
Android Health Connect and the end of Google Fit
On Android the equivalent is Health Connect, supported from Android 9 (SDK 28). Google states that the Google Fit APIs, including the REST API, are supported only until the end of 2026, and recommends Health Connect for mobile apps and the new Google Health API for cloud integrations. Anything new should target Health Connect, and any app still on Google Fit needs a migration this quarter.
- History: by default an app can read data from up to 30 days before it was first granted any permission. Older records need the PERMISSION_READ_HEALTH_DATA_HISTORY permission, otherwise the read returns an error.
- Background reads need the READ_HEALTH_DATA_IN_BACKGROUND permission declared in the manifest and granted by the user.
- Permissions are per data type, as on iOS, and Google Play reviews health permission requests against a declared use.
- Exercise routes have their own permission and consent flow, separate from the session.
Wearables beyond the phone
Most watches already write to HealthKit or Health Connect, so reading from the phone's health store covers Apple Watch, Wear OS and many others at no extra cost. Garmin, Polar, Oura and Whoop users often expect a direct connection, which means each vendor's developer programme, OAuth, webhooks and their own data formats. A wearable aggregator API saves that work for a per-user fee. Our rule: health stores at launch, one direct integration for the device most of your users own, an aggregator only when the list grows past three.
Offline-first sync
Gyms, trails and flights have poor signal, so every write goes to the local database first and a sync queue sends it later. Give each record a client-generated ID so retries never duplicate, keep an updated-at timestamp per record for merges, and design deletes as tombstones that sync like any other change. On LogFish, a fishing logging app for anglers who are often out of coverage, we built the React Native apps with Redux-persist and Apollo offline support so catch logs work without signal and synchronise automatically when connectivity returns. The same pattern carries over directly to workout logs and food diaries.
Subscriptions done properly
Use StoreKit 2 on iOS and the Play Billing Library on Android, but treat the app as a messenger only. The server receives App Store Server Notifications and Google Play real-time developer notifications, verifies each transaction with the store, and stores the entitlement. That is how you handle renewals that happen while the app is closed, refunds, billing retry and grace periods, upgrades between plans and a user who signs in on a second device. LogFish runs Stripe payments alongside the Apple App Store and Google Play subscription APIs, which is the shape you need when coaches are paid out on the web and members subscribe in the app. A service such as RevenueCat covers the same ground if you would rather not own it.
Video
Stream classes with HLS and adaptive bitrate so a class plays on gym Wi-Fi, use signed, expiring URLs so premium videos cannot be shared as links, and let members download a class for offline playback inside the app. Upload from the admin panel straight to storage with presigned URLs, never through your API server. LogFish's media pipeline used S3 presigned uploads, Sharp image optimisation, FFmpeg transcoding and CloudFront delivery; for a fitness library we would normally use a managed video service instead and spend the saved hours on the product. Live classes are a separate project with a streaming provider and a schedule, and belong in a later release.
Privacy rules for US fitness apps
Most fitness apps are not covered by HIPAA, because they deal with consumers rather than healthcare providers or insurers. That does not mean health data is unregulated.
| Rule | Who it covers | What it requires (checked October 2026) |
|---|---|---|
| FTC Health Breach Notification Rule | Vendors of personal health records outside HIPAA. The FTC says a health app that can sync with a fitness tracker is probably covered, even if some users never connect one | Notify affected people within 60 calendar days of discovering a breach; notify the FTC at the same time when 500 or more people are affected; notify prominent media when 500 or more residents of a state are affected. Civil penalties up to $53,088 per violation. An unauthorised disclosure, such as sharing health data with an ad platform without consent, counts as a breach |
| Washington My Health My Data Act | Entities doing business in Washington or targeting Washington consumers, for health data outside HIPAA; covers bodily functions, vital signs and measurements | Consent before collecting health data that is not needed for the service the user asked for; a separate signed authorisation before selling it, kept for six years; deletion on request including backups; a separate consumer health data privacy policy linked from the homepage. In force for most businesses since 31 March 2024, with a private right of action |
| GDPR (EU and UK users) | Anyone processing data of people in the EU or UK | Health data is special category data under Article 9 and needs explicit consent or another Article 9 condition; data protection impact assessment is expected for large-scale processing |
| Apple and Google store policies | Every app using HealthKit or Health Connect | No use of health data for advertising, no sale to data brokers, a privacy policy and a declared purpose for each permission |
In engineering terms that means: no health fields in analytics or ad SDK events, a consent screen that is separate from the terms of service, an export and delete path that also reaches backups and third-party processors, and a breach response runbook with named owners. Our security practices page lists how we handle access, secrets and logging on client projects.
AI features and how we approach them
AI plan generation, a coaching chat and camera-based form feedback are the common additions. Keep the model away from raw health records it does not need, log prompts without health fields, and test camera features across body types, clothing and lighting before launch. Toned.ai is our first-hand example: a fitness product driven by AI, built by three engineers, an ML engineer and a designer in five months from discovery to launch. We ran a discovery phase to define the first release and the AI capabilities it depended on, built and evaluated the AI components iteratively behind simple app flows, and developed the mobile app and backend in parallel with regular builds for the founders to test.
What it costs
A workout app MVP with this stack costs $23k to $42k, a Strava-style tracker $28k to $51k and a MyFitnessPal-style tracker $26k to $48k, with a senior offshore team. The full breakdown and store fees are in fitness app development cost, with detail in cost to build an app like Strava and cost to build an app like MyFitnessPal. To start a project, see our fitness app development service.
Sources
- Android Developers, Google Fit to Health Connect migration guide: https://developer.android.com/health-and-fitness/guides/health-connect/migrate/migration-guide
- Android Developers, Health Connect read data (30-day history and background permissions): https://developer.android.com/health-and-fitness/guides/health-connect/develop/read-data
- FTC, Complying with the Health Breach Notification Rule: https://www.ftc.gov/business-guidance/resources/complying-ftcs-health-breach-notification-rule-0
- Washington State Office of the Attorney General, My Health My Data Act: https://www.atg.wa.gov/protecting-washingtonians-personal-health-data-and-privacy
- Apple, App Store Review Guidelines: https://developer.apple.com/app-store/review/guidelines/
- Innovation Insight, Toned.ai and LogFish case studies
Need a number for your project?
Send a short brief and get a written estimate.
A senior engineer replies within one business day. No sales call required.
Zain Khalid Malik
CTO & Co-founder, Innovation Insight
Zain owns architecture, engineering standards and the platform team at Innovation Insight. He sets the bar for code quality, security and the tooling every squad ships with.
LinkedInRelated questions.
What tech stack is best for a fitness app?
A cross-platform mobile app in Flutter or React Native with SQLite on the device, a NestJS or FastAPI backend on PostgreSQL, a managed video service and store subscriptions verified on the server. Native code is limited to health permissions, background location and the video player.
Is Google Fit still available for new apps?
Google states that the Google Fit APIs are supported only until the end of 2026. Use Health Connect on Android and the Google Health API for cloud integrations.
Does HIPAA apply to fitness apps?
Usually not, unless the app works on behalf of a healthcare provider, health plan or their business associate. Consumer fitness apps are covered instead by the FTC Health Breach Notification Rule, state laws such as Washington's My Health My Data Act, and GDPR for EU and UK users.
How far back can an Android app read Health Connect data?
Thirty days before the app was first granted any permission, by default. Reading older records needs the PERMISSION_READ_HEALTH_DATA_HISTORY permission.
Should we build our own subscription backend?
Verify every purchase on your server either way. Building it yourself means handling store notifications, grace periods and refunds; a service such as RevenueCat does that for a fee. Small teams usually start with the service.