Researchers have looked into Android's Health Connect. Here's some of what they found: "In this paper, we present the first empirical investigation of Health Connect and show that its design suffers from inherent flaws that introduce serious privacy risks, including the creation of a covert communication channel that can be used to bypass existing access control mechanisms." "...our research demonstrates that Health Connect's design falls short of its stated goals and, ultimately, undermines the privacy protections Android has introduced in recent years." https://www.usenix.org/conference/usenixsecurity26/presentation/spyridakis