The Android SDKs require two types of permissions. Android Permissions and Health Connect Permissions.
Android permissions
These are the permissions needed for the execution of Services, Activity Tracking, and Showing Notifications:
<uses-permission android:name="android.permission.ACTIVITY_RECOGNITION"/> <uses-permission android:name="android.permission.FOREGROUND_SERVICE"/> <uses-permission android:name="android.permission.FOREGROUND_SERVICE_HEALTH"/> <uses-permission android:name="android.permission.POST_NOTIFICATIONS"/> <uses-permission android:name="android.permission.RECEIVE_BOOT_COMPLETED"/>
Among these, FOREGROUND_SERVICE and FOREGROUND_SERVICE_HEALTH are considered “Sensitive permissions”. Those permissions need to be explained when you upload your app to the Google Play Store, here is what the ROOK documentation says about it:
Google may require you to provide an explanation about the FOREGROUND_SERVICE/FOREGROUND_SERVICE_HEALTH permissions, these permissions are used by our Automatic Sync and Background Steps features, to extract health data and upload it to ROOK servers. We recommend you to ask users for permission before enabling these features (Google may also require a video proof of a screen where a user can turn on/off these features).
Links:
Health Connect permissions
These are the permissions needed for reading from the Health Connect container. The permissions listed below are only for READ operations as the rook-sdk only reads data.
We recommend that clients request all permissions at once to avoid unexpected behavior. (The SDKs has functions like requestAllPermissions , requestPermissions(HealthPermission.ALL) or requestPermissions for that)
<uses-permission android:name="android.permission.health.READ_SLEEP"/> <uses-permission android:name="android.permission.health.READ_STEPS"/> <uses-permission android:name="android.permission.health.READ_DISTANCE"/> <uses-permission android:name="android.permission.health.READ_FLOORS_CLIMBED"/> <uses-permission android:name="android.permission.health.READ_ELEVATION_GAINED"/> <uses-permission android:name="android.permission.health.READ_OXYGEN_SATURATION"/> <uses-permission android:name="android.permission.health.READ_VO2_MAX"/> <uses-permission android:name="android.permission.health.READ_TOTAL_CALORIES_BURNED"/> <uses-permission android:name="android.permission.health.READ_ACTIVE_CALORIES_BURNED"/> <uses-permission android:name="android.permission.health.READ_HEART_RATE"/> <uses-permission android:name="android.permission.health.READ_RESTING_HEART_RATE"/> <uses-permission android:name="android.permission.health.READ_HEART_RATE_VARIABILITY"/> <uses-permission android:name="android.permission.health.READ_EXERCISE"/> <uses-permission android:name="android.permission.health.READ_SPEED"/> <uses-permission android:name="android.permission.health.READ_WEIGHT"/> <uses-permission android:name="android.permission.health.READ_HEIGHT"/> <uses-permission android:name="android.permission.health.READ_BLOOD_GLUCOSE"/> <uses-permission android:name="android.permission.health.READ_BLOOD_PRESSURE"/> <uses-permission android:name="android.permission.health.READ_HYDRATION"/> <uses-permission android:name="android.permission.health.READ_BODY_TEMPERATURE"/> <uses-permission android:name="android.permission.health.READ_RESPIRATORY_RATE"/> <uses-permission android:name="android.permission.health.READ_NUTRITION"/> <uses-permission android:name="android.permission.health.READ_MENSTRUATION"/> <uses-permission android:name="android.permission.health.READ_POWER"/>
These are the two types of permissions that you must request from users to utilize all functionalities of the SDKs. For Health Connect data the you need authorization from Google.
Data access on Health Connect
When using the ROOK SDKs to request data, Health Connect recognizes the requests as coming from a development application and allows access to all data types. However, when the application is published and downloaded from the Play Store, Health Connect checks the application ID to determine if it is authorized to retrieve the requested data types.
Here is an example:
The application “MyHealthScore” wants to read Heart Rate, so it asks the user for the
<uses-permission android:name="android.permission.health.READ_HEART_RATE"/>permission.The user accepts.
MyHealthScore sends a Heart Rate read request,
Health Connect receives the request and checks if the application ID;
com.sample.myhealthscoreis allowed to read Heart RateIt is NOT allowed, so Health Connect rejects the request.
Conclusion: Even though the user granted permission to read Heart Rate MyHealthScore still needs permission from Google.
How can MyHealthScore get permission from Google?
MyHealthScore needs to fill out a Developer Declaration Form in Google Forms that they will fill their application ID com.sample.myhealthscore and the data types that they want access to, along with other data and questions that Google asks for.
These data types are different from the permissions for example the permission <uses-permission android:name="android.permission.health.READ_STEPS"/> allows for reading of StepsRecord and StepsCadenceRecord so these 2 are the data types that need to be declared in the Developer Declaration Form
The ROOK documentation has a list of all data types that the SDKs use to facilitate the process:
When you are developing with the Health Connect SDK data access is unrestricted. In order to have data access when your app is launched to the PlayStore you MUST complete the Developer Declaration Form, more information Here. When you are asked about what data types is your app using please add the following data types as READ access: ActiveCaloriesBurnedRecord BloodGlucoseRecord BloodPressureRecord BodyTemperatureRecord DistanceRecord ElevationGainedRecord ExerciseSessionRecord FloorsClimbedRecord HeartRateRecord HeartRateVariabilityRmssdRecord HeightRecord HydrationRecord MenstruationPeriodRecord NutritionRecord OxygenSaturationRecord PowerRecord RespiratoryRateRecord RestingHeartRateRecord SleepSessionRecord SpeedRecord StepsCadenceRecord StepsRecord TotalCaloriesBurnedRecord Vo2MaxRecord WeightRecord
If the client wants to ask Google for all data types they can do it (In fact Google encourages this if you are not sure about what you need), the list just contains the exact data types the SDK uses.
Links:
Other useful links
Android developer documentation about Data Access on Health Connect: https://developer.android.com/health-and-fitness/guides/health-connect/publish/request-access
Developer Declaration Form clients need to fill to get authorization: https://docs.google.com/forms/d/1LFjbq1MOCZySpP5eIVkoyzXTanpcGTYQH26lKcrQUJo/viewform?edit_requested=true