驗證應用程式以搭配 Google Fit API 使用
透過集合功能整理內容
你可以依據偏好儲存及分類內容。
我們重視健康與健身資料對使用者而言特別敏感。確保資料的安全性與隱私至關重要。為確保在交換這類資料期間的安全性和隱私權，所有 Google Fit API 範圍都會受到限制。進一步瞭解如何要求存取受限制的 OAuth 範圍。
需採取的行動
您何時需要申請驗證？
- 如要在應用程式中新增 Google Fit 範圍，請按照操作說明準備受限制的範圍驗證。
- 如果是現有應用程式，請等待 Google 團隊與您聯絡，他們會提供更多驗證程序和後續步驟給您。在此之前，您的應用程式仍可繼續存取目前存取的資料和範圍。
常見問題
這項政策適用於哪些 Google Fit API？
政策適用於 REST 和 Android API。
Google Fit REST 和 Android API 有哪些已核准的用途？
經認可的 Google Fit REST 和 Android API 用途包括健身與保健、獎勵、健身指導、企業保健、醫療照護、健康研究及遊戲。此外，凡是有權存取 Google Fit REST 和 Android API 的應用程式，都不得將其用於未揭露或未經許可的用途。
| 核准的用途
|
| 健身及保健
這類應用程式可讓使用者透過手機感應器、手動日誌記錄或參加數位課程和引導式課程，追蹤自己的健身狀況以及距離目標的進度。
|
| 獎勵
這類應用程式會鼓勵使用者養成並維持健康相關習慣，以換取金錢獎勵。
|
| 健身指導
這類應用程式會提供虛擬人類的健身指導，以協助使用者達成健康或健身目標。真人教練可以存取使用者資料，藉此檢查進度並提供相關指導和支援。
|
| 企業保健服務
這類專為企業設計的平台，可協助保健管理人員為員工發布及管理保健計畫。
|
| 醫療照護
這類應用程式可協助使用者接受及管理臨床照護。這些應用程式可能會提供與臨床團隊交換健康和健身資料的服務，例如專門用於如糖尿病或高血壓等健康狀況的管理應用程式。
|
| 健康狀態研究
這類應用程式讓使用者有機會將自己的資料提供給健康狀態研究。這些研究通常經由機構審查委員會 (IRB) 或倫理委員會 (EC) 核准，並在取得使用者的同意聲明後進行健康相關研究。
|
| 遊戲
在這類應用程式中，使用者的遊戲進度會受到其健身和/或保健狀況的影響。這類遊戲會收集使用者的活動資料，藉此推動遊戲進程。
|
應用程式內揭露資料存取、蒐集、使用及分享行為的規定為何？
這份應用程式內揭露事項必須符合下列規定：
- 必須隨附於應用程式中，不能只出現在應用程式說明或網站中。
- 必須在正常使用應用程式時就能顯示，不需要讓使用者透過選單或設定頁面操作才能查看。
- 必須說明存取或收集的資料類型。
- 必須說明資料的使用和/或分享方式；
- 不得僅列載於隱私權政策或服務條款中；且
- 不得包含在與 Google Fit 資料收集無關的其他揭露事項中。
- 不需要使用者明確同意 (例如「接受」或「我瞭解」)，系統會在隨後顯示的執行階段提示中做出選擇；允許使用者關閉或滑開揭露事項，是我們可接受的做法。
建議的揭露聲明格式：
為配合政策規定，建議您參考以下範例格式：「(這個應用程式) 會收集健康與健身資料以啟用 (「功能」)、(「功能」) 和 (「功能」)。
例如：「Fitness Coach 會收集活動資料以提供分析和個人化指導功能。」
為確保符合政策規定，並向使用者清楚說明，醒目揭露事項也可能包含其他資訊。以上僅列出最基本的相關必要內容。
審查強化功能的實際運作情形為何？
如果您存取 Fit API，且使用者人數超過 100 人，我們會在課程中與您聯絡，協助您開始驗證程序。要求讀取/寫入任何已連結的讀取/寫入健康狀態範圍的權限後，您還需要執行安全性評估。包括在 Android 上使用 Recording API 和 Sessions API 讀取感應器資料的情況。
如何查看使用者的人數是否達到 100 人？
您可以在 Cloud 控制台中查詢專案。
之後會透過您儲存在 Cloud 控制台中的聯絡電子郵件地址與您聯絡，因此請確保這些資訊是最新資訊。
如何判斷我的應用程式是否需要進行安全性評估？
如果應用程式使用任何已連結的讀取/寫入健康狀態範圍，且已超過 100 位使用者的上限，就必須進行安全性評估。系統會另行通知，告知您必須通過驗證和安全性評估，並收到充分通知，協助您完成驗證程序。如要進一步瞭解使用的安全性標準，請參閱「應用程式防禦聯盟安全性評估常見問題」。
如果我的應用程式需要安全性評估，該如何進行？
當您受邀進行驗證時，我們會詳細說明如何進行安全性評估，並提供充足的通知來完成程序。
除非另有註明，否則本頁面中的內容是採用創用 CC 姓名標示 4.0 授權，程式碼範例則為阿帕契 2.0 授權。詳情請參閱《Google Developers 網站政策》。Java 是 Oracle 和/或其關聯企業的註冊商標。
上次更新時間：2025-08-31 (世界標準時間)。
[null,null,["上次更新時間：2025-08-31 (世界標準時間)。"],[[["\u003cp\u003eGoogle Fit API data is sensitive and protected; all scopes are restricted, requiring developers to follow verification steps.\u003c/p\u003e\n"],["\u003cp\u003eDevelopers must adhere to the Google Fit Developer and User Data Policy and address any gaps in their implementation.\u003c/p\u003e\n"],["\u003cp\u003eNew apps adding Google Fit scopes or existing apps with over 100 users will undergo a verification process, ensuring data security and user privacy.\u003c/p\u003e\n"],["\u003cp\u003eClear and prominent in-app disclosures are necessary, explaining data access, usage, and sharing practices related to Google Fit data.\u003c/p\u003e\n"],["\u003cp\u003eApps accessing specific read/write health scopes and exceeding the user threshold may require a security assessment to further enhance data protection.\u003c/p\u003e\n"]]],[],null,["# Verify your app for use with Google Fit API\n\nWe're conscious that health and fitness data is particularly sensitive to\nusers. Ensuring the security and privacy of that data is of utmost importance. To ensure security and privacy during the exchange of this data, all Google Fit API scopes are Restricted. Learn more about [requesting access to restricted OAuth scopes](https://support.google.com/cloud/answer/9110914#sensitive-restricted-scopes).\n\nWhat do you need to do?\n-----------------------\n\n- Read through the [Google Fit Developer and User Data Policy](/fit/policy)\n and address any gaps.\n\n- When you're going through the [OAuth verification process in the Google Cloud\n Platform console](https://console.cloud.google.com/apis/credentials/consent),\n follow the [appropriate verification\n steps](https://support.google.com/cloud/answer/9110914#ver-prep).\n\nWhen do you need to apply for verification?\n-------------------------------------------\n\n- **If you're adding a new Google Fit scope to your app** , follow the instructions to prepare for [restricted scope verification](https://support.google.com/cloud/answer/9110914#sensitive-restricted-scopes&zippy=%2Csteps-for-apps-requesting-sensitive-scopes).\n- **For existing apps**, wait until you're contacted by the Google team who will give you more information on the verification process and next steps. Until then, your app will continue to have access to the data and scopes it currently accesses.\n\nFAQs\n----\n\n### Which Google Fit APIs does the policy apply to?\n\n[The policy](/fit/policy) applies to both the REST and Android APIs.\n\n### What are the approved use cases for the Google Fit REST and Android APIs?\n\nApproved use cases for the Google Fit REST and Android APIs include fitness and wellness, rewards, fitness coaching, corporate wellness, medical care, health research, and games. Applications granted access to the Google Fit REST and Android APIs may not extend its use to undisclosed or non-permitted purposes.\n\n\u003cbr /\u003e\n\n|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|\n| Approved use cases \u003cbr /\u003e |\n| **Fitness and Wellness** \u003cbr /\u003e Applications that allow users to track their fitness / wellness and progress to their goals using phone sensors, manual journalling or participating in digital classes and guided sessions. |\n| **Rewards** \u003cbr /\u003e Applications that encourage users to adopt and maintain healthy habits in exchange for financial rewards. |\n| **Fitness Coaching** \u003cbr /\u003e Applications that feature virtual human fitness coaching helping users to achieve a health or fitness goal. Human coaches have access to user data to check on progress and provide guidance and support. |\n| **Corporate Wellness** \u003cbr /\u003e Enterprise focused platforms that enable wellness managers to distribute and manage wellness programs for employees. |\n| **Medical Care** \u003cbr /\u003e Applications that help users receive and manage clinical care. These applications may provide services that exchange health and fitness data with clinical teams, such as condition management apps focused on medical conditions like diabetes or hypertension. |\n| **Health Research** \u003cbr /\u003e Applications give users the opportunity to donate their data for health research studies. These studies are typically approved by an Institutional Review Board (IRB) or Ethics Committee (EC) and collect user consent for conducting health research. |\n| **Games** \u003cbr /\u003e Applications where a user's progress in a game is influenced or impacted by their fitness and/or wellness. These are games that collect a user's activity data as a way to advance game play. |\n\n### What are the requirements for the in-app disclosure of data access, collection, use, and sharing?\n\nThe in-app disclosure:\n\n- Must be within the app itself, not only in the app description or on a website;\n- Must be displayed in the normal usage of the app and not require the user to navigate into a menu or settings;\n- Must describe the data being accessed or collected;\n- Must explain how the data will be used and/or shared;\n- Cannot only be placed in a privacy policy or terms of service; and\n- Cannot be included with other disclosures unrelated to Google Fit data collection.\n- Does not need explicit consent such as an \"accept\" or \"I understand\" granted by the user as this is done in the runtime prompt that immediately follows; enabling the user to close or swipe away are acceptable ways to migrate out of the disclosure.\n\nRecommended disclosure statement formats:\nTo meet the policy requirements, it's recommended that you reference the following example format:\n\"(This app) collects health and fitness data to enable (\"feature\"), (\"feature\"), \\& (\"feature\").\"\n\nExample: *\"Fitness Coach collects activity data to enable analytics and personalized coaching.\"*\n\nThe prominent disclosure may include other information to ensure compliance to policy requirements and clarity for users but must at least include the above, where relevant.\n\n### What do the review enhancements mean in practice?\n\nIf you access Fit APIs and have more than 100 users, you will be contacted in\ndue course to begin a verification process. If you request read/write access to\nany of the linked\n[read/write health scopes](https://support.google.com/cloud/answer/9110914#sensitive-restricted-scopes),\nyou will also be required to carry out a security assessment. This includes\ncases where you are reading sensor data, such as steps, using the Recording API\nand Sessions APIs on Android.\n\n### How can I check whether I have 100 or more users?\n\nYou can look that up for your project in [Cloud Console](https://console.cloud.google.com/apis/credentials/consent).\n\n### How will I be informed that I need to go through verification?\n\nYou will be contacted via the [contact email addresses that you have stored in\nCloud Console](https://console.cloud.google.com/iam-admin/essential-contacts),\nso please make sure these are kept up to date.\n\n### How do I determine if my app needs a security assessment?\n\nIf your app uses any of the linked\n[read/write health scopes](https://support.google.com/cloud/answer/9110914?#zippy=%2Cwhat-are-restricted-api-scopes),\nand has exceeded the 100-user cap then it will need a security assessment.\nYou will be separately informed that you need to go through verification and\nsecurity assessment, and will be given ample notice to complete it. For more\ninformation about the security standards used, see\n[App Defense Alliance security assessment FAQ](https://appdefensealliance.dev/casa).\n\n### How do I get a security assessment if my app needs one?\n\nWhen you are invited to go through verification, you will be provided with\ndetails of how to get a security assessment with ample notice to complete it."]]
